{ "Event": { "published": true, "date": "2026-02-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-27", "timestamp": 1772236982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "02adfb44-89e2-4204-975a-849635528e93", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d9d1de-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "91183c03-61e9-484e-9539-5cb8e47961e1", "comment": "Malware payload (Mirai)", "value": "70c718a46f56511ff7405f8cf4264ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "35025c95-ab55-49a9-b43c-00a26ad15cd9", "comment": "Malware payload (Mirai)", "value": "00420c2af80efff60cc8a36ab399a5370d2e48ebc0cdee02703d5d02038c5d7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "6adab729-f5ad-4ed1-a554-fe0870d17d2c", "comment": "Malware payload (Mirai)", "value": "aea850890c79fbb33d98eb8ff266fd874f3f8242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "16bcdde9-d601-4af5-9efa-b912f04f8d6b", "comment": "Malware payload (Mirai)", "value": "9a2764c984786f32210283bfc0510470d6eda8203df21c64901a19d59f8a27edd959f74c093e2ae879958c03299ec01a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "9b93feea-f4da-40b0-a072-48acc6882269", "value": "T10C634BCAF983D5B6F8970930107AEF639DB3D6BE21A8DA43C3A455369D12502F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "b06fa168-5e59-4c40-a7c7-e2e2867bef4c", "value": "1536:TtWvgqAcQQsTb6vF7lOvZOWsIyq3XkZSQL:TtDqAasn6NJOvwfIyq8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223933, "uuid": "72783b75-9530-45d5-982d-8b384ce01b65", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223933, "uuid": "a7ababe4-6858-440a-a02a-66916feec110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "16d8aa77-4020-4c62-8649-1f30693dc854", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de91ff0-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772212213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212213, "uuid": "485254f2-cd3a-45ef-80f7-77b77639a62e", "comment": "Malware payload (AteraAgent)", "value": "fc61bdc3beb959034b4c99c77c4525bd", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212213, "uuid": "03700a2c-6846-4eaa-a500-87debc741c4f", "comment": "Malware payload (AteraAgent)", "value": "01b1014f04ea920b3a11ff9c6251213a9a1eb37c506bdc6f70374244e852c8cd", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212213, "uuid": "267ba9b6-b4ac-459c-a073-2b7a09d610ea", "comment": "Malware payload (AteraAgent)", "value": "69557cd82bcd8c9e2cb245d0edbbe562ac6263bf", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212213, "uuid": "07324a58-2076-4632-b413-c1087ab7bd87", "comment": "Malware payload (AteraAgent)", "value": "230b9ff67e384241ba3fd593fdc0294947e0de565c1b0bb92a315622041bed5ad854358c6c17edc423117002d1917e3b", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212213, "uuid": "0a21e789-9d8a-4f68-9123-dea33ddb465e", "value": "T117862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B61A5F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212213, "uuid": "0551ceb3-7fbf-46bd-89d9-8196e566a9dd", "value": "196608:wW/FKmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:fKqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212213, "uuid": "be451f33-eccc-4e58-b01a-7b5e12e70cfd", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212213, "uuid": "702e7e98-9ba9-4474-b600-39ac905b6ae7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212213, "uuid": "c0e46ede-c1b6-46aa-8af0-82f68c572d47", "value": "viewinvite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887478aa-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772211076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211076, "uuid": "95546c04-7e3f-40f4-a511-5ec1dd3940de", "comment": "Malware payload (Mirai)", "value": "bd0b38996045a19deff993bfdf5e5f5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211076, "uuid": "a719d3ac-239e-4bfc-8dcf-f9e47b105c66", "comment": "Malware payload (Mirai)", "value": "02082001f835e38b674ac75f1a4b2e91c77ddfcddfe2383b6b955736eb94fb05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211076, "uuid": "d3ce9307-e15f-4b2a-a506-550270454ecc", "comment": "Malware payload (Mirai)", "value": "022711e0c8296175eab4731fecc1bef86e243cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211076, "uuid": "8cbf15c6-a799-4595-9734-68fff676bff8", "comment": "Malware payload (Mirai)", "value": "a76a6deeade3a6dc7926fdc9e3bcdbc380558f522bc447f8012e9b08f669cff7c63c642fcfc703837f1333ed6918467e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211076, "uuid": "c52a3935-d2fc-427d-a106-8185764a422a", "value": "T1F293E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211076, "uuid": "615595ef-81c3-42e7-8d8f-ef1bbb9b72b6", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNZsOLYMhp:PO+d8zBWLac0yMNZBph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211076, "uuid": "f870cf9f-4954-43aa-a39b-e7aa4401021c", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211076, "uuid": "040383e4-32f6-424b-b126-60a45c17465b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211076, "uuid": "9e681744-4c68-49f0-baf9-85cf2679d9fa", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fa6522-1380-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772157622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157622, "uuid": "d21a261f-ff53-4530-a7cc-7f9051601641", "comment": "Malware payload (Mirai)", "value": "a44764278a3166b0b482ad2cf2bc68c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157622, "uuid": "5564e4f0-3a88-4d6e-bbb3-4f75b19107d4", "comment": "Malware payload (Mirai)", "value": "031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157622, "uuid": "5798408a-2062-4dc1-a286-ef77fcb9c661", "comment": "Malware payload (Mirai)", "value": "bb542f94655253ab371f5432f6c3da88045ddc9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157622, "uuid": "b63aa559-2e55-4dba-8fdf-8a689fc37341", "comment": "Malware payload (Mirai)", "value": "777199e1fb72fb414e3a177f4fd38f477e24bb2c8df85747b9610149b065113cbd6b612cb3fb7ce01b085772a1c811db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157622, "uuid": "45c845c6-b33f-4238-94c4-eda6d41d3567", "value": "T1B3138CB7C559ADD4C14947B5AA208E3823A3F90093671FFA5E8685A99007EFCF21D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157622, "uuid": "166659cf-3746-4854-bf92-94834ab63720", "value": "768:RYXNhfPu+8r2FPDoLbxOME0ClBsoXYkrxCCo:RYXNh++loLbxPE0MokrxCCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157622, "uuid": "ae8e45df-27eb-4d87-bb1a-0791cb62745b", "value": 42676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157622, "uuid": "908b4b00-26ae-4a2e-ac9a-f9ce78a7f4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157622, "uuid": "68370f2a-3b9d-4b4a-bf13-6b1d61d6eced", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407b7e53-140a-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772216968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216968, "uuid": "cc2ad634-fe3f-43b3-8c25-a4e99032e48b", "comment": "Malware payload (Smoke Loader)", "value": "161a61a7e8f162d8fd04917fc67f45a0", "object_relation": "md5", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3869", "colour": "#5D0369", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216968, "uuid": "eb7a4bfe-966b-4415-95c3-8a8826070a70", "comment": "Malware payload (Smoke Loader)", "value": "04e11ae8b8e2a20e234630c01f9baf17793e901c630b94ff969ec149d19b39a9", "object_relation": "sha256", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3869", "colour": "#5D0369", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216968, "uuid": "30dda282-707d-431e-bdf1-fb226f510152", "comment": "Malware payload (Smoke Loader)", "value": "76f2dce8dbaa2c14296d9e1c21315949c313733f", "object_relation": "sha1", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3869", "colour": "#5D0369", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216968, "uuid": "881b306b-6444-468e-8fb9-48f6b00262e1", "comment": "Malware payload (Smoke Loader)", "value": "faa3b3da7e9856d8d8a02cfb74bfc357c8e95e5601f93f9f67f74be337ddf74c28684b6e1660388e5429123897cf3679", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3869", "colour": "#5D0369", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216968, "uuid": "5a319f3f-b4ba-4c43-b3f3-7f48ba2bab7a", "value": "T1B0E633BB850500D0366C93462316D4B51189EDE6765B8AE0F657CB7823F7C4ABCF18BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216968, "uuid": "5752042f-79f4-491e-b110-ff82aadf91ec", "value": "393216:wxYlbxfsqcA/D/zG9R1f8o/4+jKc736EjVOwtX:wAVka/DCdr/4+mcL6EJdtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216968, "uuid": "969ebb44-8294-4730-bb7a-77435e7a46a6", "value": 14470163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216968, "uuid": "abbdd88c-581c-420e-bf82-27366f1fc58f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216968, "uuid": "9bed18cc-c3d5-4fd0-b5b0-90012ffa2041", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df877467-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (QatarRAT)", "timestamp": 1772210363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210363, "uuid": "8bff1662-d22c-4bc5-b855-61bb1f94ed0c", "comment": "Malware payload (QatarRAT)", "value": "cc2d56e151fccf815bf1c71830f9a11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210363, "uuid": "bcccbf31-b34b-4471-a353-946aa47167ea", "comment": "Malware payload (QatarRAT)", "value": "04fffcd5e0509e3609e5dc106afb8bfa7fab3a948ab63627cdc424cb7709f94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210363, "uuid": "c6820025-d54e-4d59-8fd1-9dc77f5b6d45", "comment": "Malware payload (QatarRAT)", "value": "e5ce759797298baeeb5d25504dcee0c77149cf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210363, "uuid": "a0acc87f-0191-4b94-81b6-e53c0246a884", "comment": "Malware payload (QatarRAT)", "value": "e955abdf6a53744e6ab4c6fd6dcae4dff71fa64907f85c17d9fe14be1ccaf568014612412cc735396ff0555a34f8a880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210363, "uuid": "4c201037-cce1-4887-9e42-e06c56388409", "value": "T1A86645069E74497CD5AA42739871F438B73D74EE8A9DAF0BF97C90E33AD22107916342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210363, "uuid": "129abf68-ea03-47bc-bac7-38f00861c3b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210363, "uuid": "442a276c-4aab-42f4-89a9-2d39e8afcae3", "value": "98304:S4wxEJ/2C2WojPJw80Rp7XcO15YeOVgypS7J3paSmAMDHbb:Z6k2C2WUJB0HXZBnypS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210363, "uuid": "fd9750a8-38b3-4261-9ec2-4d3b68ffb577", "value": 6715392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210363, "uuid": "b74499cc-b560-4ea9-ac77-cefd5b9fca8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210363, "uuid": "6346a86d-6b10-4afc-8907-d81a01c00f38", "value": "cc2d56e151fccf815bf1c71830f9a11a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ca2d43-13d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772195456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195456, "uuid": "f7a9184f-742b-42bb-926d-516e93fd8a16", "comment": "Malware payload", "value": "bd71c56b6c0824e7fd86a9c63c779b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195456, "uuid": "9ca9ac3e-c67f-4077-8626-992da551d406", "comment": "Malware payload", "value": "05c7e49b984ee28895558d1f40ec69b54ff4b5dacc5092b300e284c5c13236a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195456, "uuid": "54eda30d-abca-4549-ba9f-8f2dd47e70ee", "comment": "Malware payload", "value": "b41362e805c992b98622e3bd44a220880a78228a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195456, "uuid": "d23a2b50-20ad-4a22-b23f-1aa4187babe8", "comment": "Malware payload", "value": "906a5edbaa526e023795dda4bc0267a3854a11c02f7241a7a500de0274fdaa45ce5454481ff64745679b20527fdc20df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195456, "uuid": "5f279dc5-8a7b-4a40-87fc-47b92dd45576", "value": "T1CAD73378375008ABF0D4BE3588DBFA74A646BC077BB1C49797A42571044FD8A6EBAF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195456, "uuid": "54c784a4-47c6-4261-975d-00e934378ef9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195456, "uuid": "2c123bb3-13cc-4d40-b2db-ab4b93ffc4dd", "value": "1572864:l9zF/3QKKbLSCU/+gFWJ0iz+yCoeTZ0AMGM2DsKzGIlEJxB3OTbg:l9l34SC++gFIeTkB2DsKz4XeTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772195456, "uuid": "4df9c6d3-a925-41be-b1a7-1117eaae674f", "value": 62827830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772195456, "uuid": "d6378f17-8b89-4e4e-bf4b-3553502a9a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195456, "uuid": "bc376954-ba0e-4dbb-a812-18e004fd5823", "value": "WindowsServices.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79922bc-13ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177708, "uuid": "952a1bc0-d010-4d43-9f55-9adfd652e924", "comment": "Malware payload", "value": "135e7084345029d5077c57e944946e9a", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177708, "uuid": "50fddac4-287e-45fc-a386-51c5c4ac84a0", "comment": "Malware payload", "value": "05f533ac6d17b1fe183a200244019efa0d96abd6499e6d8795d1980423c1dcaf", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177708, "uuid": "48a8e4e1-3560-48cd-8354-fa63204f424b", "comment": "Malware payload", "value": "2c4a9e5241f1386464ae7d706275dc82d8b975d8", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177708, "uuid": "012f7007-1262-4b7e-a2b5-ac396aa6cf51", "comment": "Malware payload", "value": "ead2e4556bdf7c136177a8eae10b797fde32a8a3d2188b00e5ba7385ead94d2a4078bc98d9b261bc12da36c998bfa3fc", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177708, "uuid": "b7069531-63dd-4372-891e-dd6cb9e5f407", "value": "T19BF29F15B68F860C70B3478857AF07744B2F7A5F1E3E418A418DEA8A8FE39119C563B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177708, "uuid": "a1c5b026-3601-4b39-8bb0-4fe08a3f36aa", "value": "768:tp3emAmbmAmImDmDmEmAAQmgmJmJmJmJmJmJmJmJmJmJmJmJmJmJmJmJmJmomqeH:hEenT9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177708, "uuid": "ba09f9f0-80cb-4a3c-a17a-493d29de2ce9", "value": 37302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177708, "uuid": "514784ba-9f96-4d8d-a690-08417bec8db0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177708, "uuid": "74ec6a4b-7d76-4132-8d14-a4ea4af9f22d", "value": "05f533ac6d17b1fe183a200244019efa0d96abd6499e6d8795d1980423c1dcaf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b11ebfe-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "3b7c2235-d7c4-4f63-bb58-d30c5cf298c0", "comment": "Malware payload (Mirai)", "value": "c7e763d6a1ccf92408db5c57e83bafaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "3f3bc04e-9552-4d4c-b8b4-c4c73e9cece2", "comment": "Malware payload (Mirai)", "value": "05f6766499af6ecb6ebe1ee4a4ae977a18d9ad68ecfd83a6ced7ea2fa9054a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "abd1446a-ba52-4e78-89f5-1a40676c86b2", "comment": "Malware payload (Mirai)", "value": "beae1d682e40c9210d0085e62b1abb79ef2e11ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "dc2d02ea-708d-4280-a827-1977a36d7879", "comment": "Malware payload (Mirai)", "value": "a0c92c1f58949f4b1f2c0aff2fd49a1de8aee3787c778908e6ae08ca3b194d404ab7551890010508a3adf851aeb30b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "bae64536-7e79-472b-ab0a-aa87f2b55056", "value": "T18A03F1B82119D533C9325C3BD9B103C16AA85AB4D1A7E417C87E89AC97377C4F68938F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "29fd270d-66ee-465d-b85f-c60cd8672149", "value": "768:DGPjXBOTsh1aqh3kosh+IkLpFw71qB7IuszFKwMKBJ7ImU9q3UELy80:WLYptVh0whqFIlQ/8IeLz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223939, "uuid": "c975a1c2-9431-460b-8629-85aaa1867a42", "value": 40340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223939, "uuid": "2ab5d7fd-e727-4389-a249-01ccdefd7f29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "2bdf2df6-d727-4666-90ec-f7cb78799700", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdf80fd-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213070, "uuid": "699c144e-aa6d-4e58-80b7-b053f7c4d4c2", "comment": "Malware payload (Mirai)", "value": "10541b80d59f4d1dfd36153b2105daff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213070, "uuid": "da1d722c-64cd-46b3-baa1-aeb81cd5ec0f", "comment": "Malware payload (Mirai)", "value": "05f8475c58aab16a5970af6be2fb61265d9c2ff306d399cc82940cc75fe99eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213070, "uuid": "75b24f2a-5276-40e3-a1ce-65a9aa9c06b4", "comment": "Malware payload (Mirai)", "value": "c7a72784aff4a2206464da8b2cc363c9bcbb8b3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213070, "uuid": "91e81569-dcc8-45b9-ac24-2da024f7ea88", "comment": "Malware payload (Mirai)", "value": "287a9256ac8b08cbccb5bafca44005488027fc4133905ff03ca613f09023fb811054f3b36089f50ebb02849ce2645156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213070, "uuid": "227cb0c6-6e30-4e52-9a9f-624d37c7c448", "value": "T18004D60AAFA11EBBC8AFDD3705A90A4239CC641722A53FB57674C524F54EA0F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213070, "uuid": "8e19e8d9-2b32-458c-9a5c-4ede50dd1c78", "value": "3072:+d2kBaokRjENmKlMH2XLxWAFXbtG4J0o6P:+d2kBaoCjENuH2XLxWAFRG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213070, "uuid": "6bf3d33a-ce15-4c98-a19d-d8f99b47a523", "value": 175596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213070, "uuid": "8bbbf617-f587-4a25-8053-3bdc1299a9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213070, "uuid": "d1b6b449-ded6-4f6d-a009-80f1441f865a", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f119bcbc-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772209963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209963, "uuid": "3edc5f4e-daa7-4e59-abc3-9685e5a48155", "comment": "Malware payload (ConnectWise)", "value": "d85cff963c8140db971252cc37858750", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209963, "uuid": "450b14ee-48ad-4497-8341-8f117d28d8eb", "comment": "Malware payload (ConnectWise)", "value": "061475b7f04838dc0cc4b0dcddb3f84422d2084aa96770e8a50dbcd0e1e5bc1b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209963, "uuid": "a934a571-8d98-4a81-a0ff-911ed75d7367", "comment": "Malware payload (ConnectWise)", "value": "815b921c4b2e2c2c7a77cc7198831e8c3f894715", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209963, "uuid": "c21062b3-4e5d-4096-88ed-9b6963b0ced9", "comment": "Malware payload (ConnectWise)", "value": "33bff92d5a8c0cfc947ed074e202e8067b6f8cedc051e944e4213a45c818f930a819ad6d02f7d0b79c9c51f2e507033c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209963, "uuid": "3f2b2f33-b268-4e66-8ba1-a8e2e76dbdb2", "value": "T15E646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209963, "uuid": "a9287b65-e945-48d7-9102-d9ee69d792f4", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209963, "uuid": "15705e25-f9bb-467f-9c44-deb0b259c612", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9X:J1iw7gryNkSV1hy1Z1u2JLu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209963, "uuid": "113e95ec-0f90-40a1-9931-ebc79752329e", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209963, "uuid": "e4a973df-e7ea-492e-8b0f-d6e51fc7a126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209963, "uuid": "bf20a307-cc82-4395-9698-d19cb16fd0be", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e33a08-13e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772202757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202757, "uuid": "3f748de6-57e7-402f-8b2e-bc1c480c4f63", "comment": "Malware payload", "value": "d54894c0608c60bbba673a5c1e31af4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202757, "uuid": "713b8a54-3f43-4fda-a3d1-229190a7c49a", "comment": "Malware payload", "value": "0635dd15cb585c36fd03cacbad59a044ff606b967d51ceac3614c44f2d604427", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202757, "uuid": "6ceebc9f-25b0-44d2-8dba-6866b974e0b4", "comment": "Malware payload", "value": "9f056027145c19f117013c923aec0a49e6cb0c74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202757, "uuid": "bbd1a189-a76a-48b9-bf66-c5201d23a314", "comment": "Malware payload", "value": "7791a43b03232c4ea3693c12740dca8856ee7c777d3bc07a2186e15d911175957aa39efad2da53a7f167b0be0b993480", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202757, "uuid": "515991ec-df87-4514-8300-1ac7dbeeff67", "value": "T1AAD129B025F04C736E601684F3772BA6AB77D85389E3618C35DE1E296F87B42B5AF011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202757, "uuid": "d6a589e3-d203-458b-81ee-c31bd555cdd7", "value": "96:cRuOB6/rqBi+8u56fm6fexCUxCafCqEKEVdENE0tEAEpgEFEl9p9+:cRuC6zclZ5v8MFxp+26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202757, "uuid": "6431308e-679b-47ec-a428-0c83b3710cdc", "value": 6317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202757, "uuid": "6f58105c-d7d5-4614-a944-788a1b2cd7ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202757, "uuid": "34b029ec-889b-4897-bcb5-05b492aa49ea", "value": "0635dd15cb585c36fd03cacbad59a044ff606b967d51ceac3614c44f2d604427.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ff2d01-1371-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772151424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151424, "uuid": "bcad969a-6230-4312-9df2-7ecc38c726c0", "comment": "Malware payload (AsyncRAT)", "value": "5da8b50e3801876596fa5db284ddc1ea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151424, "uuid": "74341641-08b9-4ab7-b122-32d941db0e33", "comment": "Malware payload (AsyncRAT)", "value": "06c3c5c83e6ba31c0dd481c3246f708aaae6bec9406bb2e492ee2dd4c65c821e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151424, "uuid": "bbd8f44e-94d1-46e6-8c50-977cee8d318c", "comment": "Malware payload (AsyncRAT)", "value": "3eed1e227aa5c8a971cba07f0c6eed0f9078fbc2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151424, "uuid": "265e08c1-2083-4f08-adc5-138dd6720312", "comment": "Malware payload (AsyncRAT)", "value": "f3defb7e2633f14161def0bb67ee9dd43bedf1c4f606eedfb91135ddca709e67b2541f11eff61e5135ed4afa771ab143", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151424, "uuid": "67589c2b-853c-4682-9efc-0fa0d0b09474", "value": "T15DD31782B650C2A1E4784A73E0A7E9F10F327C5EEB1A691F3584FF173973141AD13A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151424, "uuid": "b9180740-b25c-48a9-80c1-46b2b0830879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151424, "uuid": "19b64d55-fea4-4622-a223-c3f31042cd32", "value": "3072:vQFJ9j4OjNBz65/M6If+3Js+3JFkKeTnN:iJ9DxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772151424, "uuid": "f0bae05c-c10e-42cc-96ef-f93728328af8", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772151424, "uuid": "7313935d-41a1-4ede-a3f6-d14ef70a93e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151424, "uuid": "f1b9ddd8-4cb5-4af2-8bea-baf6c64acd83", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1fea79-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175250, "uuid": "b77b3bf1-bae7-4766-8c57-b355881899e3", "comment": "Malware payload", "value": "fe9db3aed6a04c762472afdf2face254", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175250, "uuid": "8b8503a7-8ad9-42d3-9d00-55d0ee1c41b8", "comment": "Malware payload", "value": "07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175250, "uuid": "e5b4653f-d74c-4760-8f8c-a1cc423f3117", "comment": "Malware payload", "value": "94e98b714bfb102d143957cf1e00bd45b5b8fa4d", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175250, "uuid": "704da409-d692-4cc6-895e-db7dbea37ff6", "comment": "Malware payload", "value": "da4adeb0681dd5d99a40f97c067ef5cfd980773d8b7fc0af3a7660869f39cc380ba5248f656a0d1b52353f432999116d", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175250, "uuid": "8563023e-24a8-4573-95a0-c77be8f56b56", "value": "T1D4E34A2EBA151075D266C478CE874503FF737C5687A09BCB17919EB60E27AD0BF3AA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175250, "uuid": "819fc17e-0e74-4e89-a6f3-4a3115748499", "value": "8f4a65bc2708f6149bf9a32b9e1d2416", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175250, "uuid": "835adc45-1347-43f9-abba-4c9b2263072a", "value": "3072:XOJQsTtxRGiwtsvccTJOLHonuKV1uKNJy/7:XOJ556XtsvbTJOLi1uKNJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175250, "uuid": "403008a6-5397-4bb6-a8e4-bab40b6fed73", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175250, "uuid": "6db41cd0-aba7-4533-ad82-28a5768587aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175250, "uuid": "899f55ac-35af-4a50-820d-eff9c3a6313d", "value": "07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855a7d7e-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212360, "uuid": "aca6dd23-ea1f-41d1-952f-ac610cc0b157", "comment": "Malware payload", "value": "d63db73f0a29783c3148e3362700e82f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212360, "uuid": "72e399d1-54a0-41bc-aef6-a499b9be8031", "comment": "Malware payload", "value": "08c0188a6a819e9515bfa14f2dede4fe343745c124038383995b7352741830c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212360, "uuid": "55532a81-a364-4ede-9687-6ceb3fd44a8d", "comment": "Malware payload", "value": "901b02351a7e1cd9f4326d3727f7811d00a2e7e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212360, "uuid": "efd74b62-c282-4442-81be-f6b8bb719e82", "comment": "Malware payload", "value": "410bef74c9680be69d392926fe39a8e81a03cb2dc7a5451d39f97722b07cae61edd6ef310201ecfd9d20a108d9283193", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212360, "uuid": "163c5922-870d-408c-a971-b03efc7e81e5", "value": "T1D8E20A691715A018353A1231A5B1B48285F9FDDF363121D4DE3CCAFBB34FAAA5D38E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212360, "uuid": "52254cb7-1fa7-40eb-893a-52bf66f03e46", "value": "192:gnfrZ4lUX/UtAKkDt4zd4EDR64fon7lCQjj5Ff7bHX5vktQnSnc4TZfx42:gTn1K+EDdfooQnf3mif4TZfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212360, "uuid": "ea6c633a-ccba-4702-8dbd-d260579ba100", "value": 34198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212360, "uuid": "2d3ac79b-0866-4f3c-a846-1b58149abf5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212360, "uuid": "b185f17c-8fb0-473d-874a-d019a06c9874", "value": "d63db73f0a29783c3148e3362700e82f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d871fdb-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772190845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190845, "uuid": "e9a9879e-b3ab-4649-b974-f893d858dfc9", "comment": "Malware payload", "value": "29ed331b2882b68878d258e034c75d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190845, "uuid": "ce10fb75-0746-4a6f-9bf8-081bfeefc493", "comment": "Malware payload", "value": "099d63e692457bfccc2cf59278ae6a268cb03964f18d0d27f536027b43c89896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190845, "uuid": "8cfb6dba-b22a-498e-8102-b4386eaaac18", "comment": "Malware payload", "value": "043da4c73ed932229de096de8fd849e22f85a9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190845, "uuid": "0ad04ce2-3d19-4eb3-9906-fa750b665fd1", "comment": "Malware payload", "value": "8183dc4bb721c7465b103f0273d1751c6c457709ea21bc50221c4eb53547e021f7dc4a93b1d066efce9c30af9d33029a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190845, "uuid": "c956ea79-188f-489e-9a5f-12eb16e6be21", "value": "T1AB46027623F420EAC5F987BAD6818131FF71B64E332055AACA95852C3F3A96435BF305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190845, "uuid": "96e09ff6-6c7d-4954-8e3e-5a75ea6c7d05", "value": "e583f115cad25699bca7cb64affd0cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190845, "uuid": "5df062ac-df34-4ee8-baf4-3e49226dff66", "value": "98304:fOf7Imqs3RBsztyZuibCzykITOxOiwZLF+7peXmCUvBEd2COpsvuAqkDMCO1DadX:fOf7Imqs3RBshuiYO4i0LQteXmCUvBEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190845, "uuid": "c5d68209-27a1-45fe-ba33-67fb1c8233af", "value": 5352088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190845, "uuid": "1e5b5421-9160-4b83-a337-bcaa0c53a8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190845, "uuid": "bcfae6e0-404b-4cd0-882e-821e74c42217", "value": "googleupdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78ddb22-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772209947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209947, "uuid": "4130e481-cc32-4217-973f-049bec7780fa", "comment": "Malware payload (GoToResolve)", "value": "b0646d5521b84139d1aff3b59e1b3263", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209947, "uuid": "c64f5da1-a0fc-47b7-8d8a-59e9a2136118", "comment": "Malware payload (GoToResolve)", "value": "0a0c51170da4483e4593f0290c17826907b91998ada8900270bed20fd0b85e09", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209947, "uuid": "1e636f92-59ff-4fe4-ba7a-3998a31f5f2a", "comment": "Malware payload (GoToResolve)", "value": "ef6ea87b382981f1246465acd62aa0f245c0fb99", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209947, "uuid": "913923c6-1c8d-43b7-9eef-059baf99e4ba", "comment": "Malware payload (GoToResolve)", "value": "c5b794b4891ffac7189102e5201b63a3a206a4a0512353e7ca9fddce43618628d686a3c21e25eb4cc7184e3ef03260ee", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209947, "uuid": "81636e99-f9c5-4de0-9b48-463a878b2a75", "value": "T15C3733173988C571C6AE01B25468AB7E967C9D210F7105EBF7EC7E4D2B303D36A3264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209947, "uuid": "9c00e85d-bfe5-4783-9344-4d4547fa81aa", "value": "393216:OuH6t/ADslrnxHHiACqwWFgvUX0TE5HkCshd2t1Q7tDjy1bpJs8zoajmG4cKhuEf:tH6ZGsBxFCQEUX35dsAtO7t419mz+6qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209947, "uuid": "553e1b34-5d3c-40d2-8b58-0f1bd1295fa2", "value": 24526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209947, "uuid": "d7e0b38a-a919-49aa-acdd-b248323ad841", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209947, "uuid": "388ccb2a-67a6-40c9-94b2-a9028d121ae7", "value": "SSA_E-STATEMENT_ADMIN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a579b0-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190702, "uuid": "a43f1102-4b63-468b-87e2-964dc02ddc11", "comment": "Malware payload (Mirai)", "value": "243e899ee69a98af0232ff77f8151453", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190702, "uuid": "94d02d6c-ed84-46a4-bfc3-627310ff391a", "comment": "Malware payload (Mirai)", "value": "0b83905c06cab88e86e29b13ad4e704ee260ae9e55f5340eba1984a75aa66bee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190702, "uuid": "350dc4b2-22e6-4f60-86d4-b0daed6b4d42", "comment": "Malware payload (Mirai)", "value": "8638f6478ca4eb03d84d829b950fbda3c67468c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190702, "uuid": "e82b8bc2-b4b6-42d2-b9dd-5ecb74fdc5a4", "comment": "Malware payload (Mirai)", "value": "c5362a8825abc3e59c82cd4353cf0cd520e2e15f6de6957e0b0c630cae22fbaab73383b80f63eff22e5be38bd8e3a75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190702, "uuid": "0b648f27-6bd3-4d41-8fc6-0869ade06ea4", "value": "T194262951FACB50F6D9031E3004ABE2AF67306D054B25EFD7EA407F1AE93B6965D32218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190702, "uuid": "fe0f44a8-3ef9-4885-a157-2c27a2bea235", "value": "49152:RtVq1wU09ZmaogUiadcpnZOGYSixpHfFBUyoTwPbd1il/mjltDHWe7YMvIP6MOgi:o09JogF9cQGzLnwYitOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190702, "uuid": "e3ada54e-168f-4f28-9f1a-6b56c0e35e1e", "value": 4673536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190702, "uuid": "af4fdc9a-cabb-49d6-b5a2-aafbad22fa6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190702, "uuid": "9c16bf75-202b-474c-9120-678d468e900c", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd537f7-13b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178578, "uuid": "16d5e4ea-04f8-45d8-b21d-cdb4e662e134", "comment": "Malware payload (AgentTesla)", "value": "18c02b45aac69d88b3e17f119cecfa84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178578, "uuid": "a348cadb-6762-42ec-a174-4e6ff25a999e", "comment": "Malware payload (AgentTesla)", "value": "0c5b9b1d9a569a97cf1eee2268d2085076d4ffbdc6ba7f80216354b18a3975d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178578, "uuid": "18967e4e-843f-4475-a518-4dc2fdb05881", "comment": "Malware payload (AgentTesla)", "value": "8c5addcf477a5f0426f6e1d01c802fe899fa015f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178578, "uuid": "252dc7df-9965-45b1-afc8-9268a78c08a1", "comment": "Malware payload (AgentTesla)", "value": "cd5fd18e67468c753cc18aba21c05b6a8de15b36f2fb71296b17f60f10840eabffb5afd71f073b63b1521f72a8064bb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178578, "uuid": "cf2e9706-0d6c-48e9-971d-e1ea2da89012", "value": "T1A895C07BB122CB6CD0CAC5B824E396F21E307E141AB6524616CE275F2E73D502D5E98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178578, "uuid": "3120cccd-5222-466d-8f07-fc35f4ba5d88", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178578, "uuid": "52c36576-b630-4d98-8fde-95b38e6e645f", "value": "24576:7ff84r7YFz75ELy9vS9/aOHR+SfKstbokJMxqavDzWLyvt487diDxHp+0:78a7anKy1S9/aOHRniUod1vDSLyh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178578, "uuid": "ebc08c53-9d79-4ae0-9e85-26532dcab13f", "value": 2028032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178578, "uuid": "1c71f799-3896-41b5-b1cf-4e0ea46809ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178578, "uuid": "23fd8883-b01e-41e8-8881-5a10c8aeb113", "value": "RankupServicecleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b190d8-1405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214855, "uuid": "e92eb4a0-46e2-443d-ac50-d1d89499030b", "comment": "Malware payload", "value": "04d87b4129faf13aefb3ced61a840c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214855, "uuid": "08a0f398-08b8-40f1-b0c3-5845113434b0", "comment": "Malware payload", "value": "0c5bb51fe1f141819593d62a6d1a2f3225f8b30cd687165f3d920de770d45c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214855, "uuid": "5f95bf86-6202-446c-a223-99f343ade2c3", "comment": "Malware payload", "value": "30edd855b88dd8d60f616ffe92c3cecc781d36be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214855, "uuid": "c9e287bb-3722-433e-a840-fe2cbc57a0f4", "comment": "Malware payload", "value": "7cc39cda8a782513b9c2ee1f602660b93b7b616b0c6b9f6db8c60da7a9594425cdb8ca7ffa642362946afaeeeb86c837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214855, "uuid": "30b0ae84-8a18-4b4f-ae1e-f8d711debbdd", "value": "T11CA68B41FDCB10FAEA430A3105ABB27F63315C064F64EBD7EA403B29F97BA951936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214855, "uuid": "6b4e4344-37a7-489d-9b69-82640e00498c", "value": "98304:t188ePWsgdFckAst9uGI+zxakzV3Es+he9y1X4CScC2G+HunywM1QQ6:JjskJAst9uEznV0sqlpj5CUH+ywS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214855, "uuid": "9b36f3a4-f026-43e2-bf32-9feef195ccd8", "value": 10233601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214855, "uuid": "47a4828d-fc8e-41be-a844-09774c5369a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214855, "uuid": "3404b9ca-8915-4de2-afba-cadb07abc1d9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fe9b97-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212956, "uuid": "56d751ed-c9e5-41c1-876a-bf6ebfb72ace", "comment": "Malware payload (Mirai)", "value": "68ba579383d462319091988981340440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212956, "uuid": "4bb3c0c3-bdcf-4ec5-b8a4-31ecd7e6a5c0", "comment": "Malware payload (Mirai)", "value": "0d1ccf3bd239a8335a403b1ed97d0c2609a27a7ca63db2761cb260990f63be96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212956, "uuid": "bd156b94-7171-4630-b189-57a61a113fa3", "comment": "Malware payload (Mirai)", "value": "7dfe4dfbfff8fe613d0f89f9cfaf7bbd2cd80245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212956, "uuid": "5b86c6ed-377c-4ecd-bc52-85b6c373129b", "comment": "Malware payload (Mirai)", "value": "22f962f3dee5b8ee4ffd86f7e18308452c40af73a30a391d12ad0e8d526591cca240577659b4152d2d6d5fd0ee0f8bea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212956, "uuid": "b9a87172-8bf3-4d41-af51-50d128343a73", "value": "T1B903E10707D811CCC9D3B17B9BB5BA4A0464AD4DE7BE66AD4A18A042DEE1BDD362C343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212956, "uuid": "6fa67fcc-0801-4f25-bcbd-0a1149ed20aa", "value": "768:15zGYSTbRCklMeLnwsA0wYwm8jo2c/WwaNe9dWn84yrOdZOyTCck/2nbcuyD7UHm:3Guklj268jtBFNmdmyraOgCcRnouy8Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212956, "uuid": "68371631-c707-48d5-95af-1fbd1c29ce31", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212956, "uuid": "03f5ada7-50cc-4e50-bc04-aa1f26413ad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212956, "uuid": "0e5bec17-d876-4ac7-88ef-a3098d28a523", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1be570-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155734, "uuid": "3273ed6f-403d-4ac3-9492-b144f13e5604", "comment": "Malware payload (Mirai)", "value": "4b9ac9fc27a93f3864ef13a469a2e342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155734, "uuid": "e13871a6-18a9-4ac2-8f09-6f4815a1589e", "comment": "Malware payload (Mirai)", "value": "0d4c666c386f655df0b53719251644790d60840d6b846e76c7f82e8f6c0b2e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155734, "uuid": "94e4f952-ee7d-40a5-97dd-6606de8c4207", "comment": "Malware payload (Mirai)", "value": "5165fa3193b9ce7eec873a959b227feb1daa9294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155734, "uuid": "17be4bb2-233f-4e4c-be80-0b77d12a471d", "comment": "Malware payload (Mirai)", "value": "10253575cc0159bfb1195a95c2b5669d9ee677b0cb6b22296b9ea052c7527fc9a10d338a77a54733999a2bb8bba1db01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155734, "uuid": "8bbc18ea-4fe0-486d-9cd3-0a0b6abd5020", "value": "T12643A70E2E258FACFBAD863547B79F24964833D627B1C584E16CE9001EB034D745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155734, "uuid": "9d8be5bb-9edf-4c7f-bea6-2c4f7cbc3851", "value": "1536:ub+kUPQupLfsLfCELfZQ6mREATMNEugjYeV:a+kUP107NEusYeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155734, "uuid": "d82b4764-72cf-48d3-bc1d-cbfaac4e7ade", "value": 60232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155734, "uuid": "f6f8f278-d4fa-4c33-aaab-f0cd0c15a32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155734, "uuid": "99b775f2-b146-41d5-944a-0b858a75d798", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeea9d7-13ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177722, "uuid": "0e2fd504-dab2-4541-a13c-23fdbd58ac8d", "comment": "Malware payload", "value": "c62f486eebe9a554a6dd96184270be0a", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177722, "uuid": "4d37a5da-1bb8-4d59-b667-65bb88318351", "comment": "Malware payload", "value": "0e8c792e3d480e7f7e65f932caa10c6af3f7a75fd78d626f1a6c866b5a812f5d", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177722, "uuid": "a0cf9cb6-37eb-4325-8552-e2d4783b683b", "comment": "Malware payload", "value": "c36f3978a7f2ff2e70fe2181f84f6a51069de652", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177722, "uuid": "58ed5e99-2126-4abd-a03f-62af5f80eca0", "comment": "Malware payload", "value": "1a3fb76fe19388a0e0260aac789d9ea849d91cc4a5051e65def75f6b7324ebf7a5533e63bda7e401fcff18934dd22ad6", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177722, "uuid": "0ea1f80c-3d4d-492e-b0f0-6de77ec1d77c", "value": "T1AAC137006BF95604BAF36B05A9BFA051493B795D9E76DB4C0089C54E03F2A44CCA7F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177722, "uuid": "55279e14-def2-4e0a-8ba4-71bf91c80650", "value": "96:WyEBs5sZ54BfOOF5yFwFiOD1hsZ56vHAttGEznxdelwiQRcwHRHA2VBAvz4/+Elt:WyeWf4qFictQGEznxdeChc8j0iVLWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177722, "uuid": "91772991-2edb-4990-878e-02d3764c65e5", "value": 6032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177722, "uuid": "a20c5821-6b0e-4b05-a118-816964fe2590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177722, "uuid": "31607c6f-e237-482b-8162-c9fab0702e0d", "value": "0e8c792e3d480e7f7e65f932caa10c6af3f7a75fd78d626f1a6c866b5a812f5d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816a3243-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772212353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212353, "uuid": "38a43449-b672-48cc-92da-de91743c1a49", "comment": "Malware payload (AgentTesla)", "value": "33cd8ea2e341fb3ac93853845398e449", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212353, "uuid": "ede4dc82-6433-4cdd-92b6-04470659fc05", "comment": "Malware payload (AgentTesla)", "value": "0e9c2713eb538590b38297840b4cdcd52e12a5c3b73c42530d9875ccd6c55ce6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212353, "uuid": "e9d6ae89-7e7b-40c9-bbca-678301f2f250", "comment": "Malware payload (AgentTesla)", "value": "1289b6fbd8de6350660b863ada3a257302373340", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212353, "uuid": "592e779a-6ae2-4312-bc91-b44af514403f", "comment": "Malware payload (AgentTesla)", "value": "4a9d869e0de3aeaf4c9a9fcef4f5e3c06a9733d815cee62668ec3e47d60e843deae8fd51a83858421a0a5fe9d4ef1bd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212353, "uuid": "589c0c83-1fc4-42a4-9f79-f0dc3c2fedc4", "value": "T19F559EDEF3A13FF516A39C1A61BCB392A3D85E154D409029917EB760437369CE92EE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212353, "uuid": "86aa6c75-fbb6-4192-b765-d0b659957841", "value": "12288:T6AyvNcR3rQq8OagQkOlm9MSHCwwQYihGCxn7PsxK85zgZTatnnatZX4z05VO7sm:VzQkOlm9fHNYOb7PsoRtatnoy7b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212353, "uuid": "9bc4a7ad-1d4b-4d38-8f06-aefdd5ddf5fe", "value": 1352683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212353, "uuid": "1ead81f2-d69a-4c5b-8cb5-d490d77b5fe8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212353, "uuid": "ae06769c-24ca-449e-ba0f-7fab82f1ea2e", "value": "33cd8ea2e341fb3ac93853845398e449.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f671c-13db-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772197031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197031, "uuid": "90b45ca3-7fd2-4e6b-8b1a-85d6884704a9", "comment": "Malware payload (SalatStealer)", "value": "8e5eabc488a632c7bbbb2dd464d3101f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197031, "uuid": "5800cfc1-f905-479c-9626-f2f1c505c806", "comment": "Malware payload (SalatStealer)", "value": "0ea0649da1694c00f30318743567cfc46387ebe3ac7191f9e4661b38d4a79b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197031, "uuid": "8a4f0ce8-9d7e-46d3-bafa-d8eb0d61bfa0", "comment": "Malware payload (SalatStealer)", "value": "877f5addc0cab14a443c14b7a5ee27f012e4368c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197031, "uuid": "3ffe13e8-67e5-4e5d-9848-7b9ac4889c5a", "comment": "Malware payload (SalatStealer)", "value": "49c08dd90cd48030b58dc6625ce1f77c631c27ff90dc6df310b349f7c08d53944b9b7e4719714bddc66b155384f306dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197031, "uuid": "b992861e-55ff-4d74-9e2d-510bf80eee18", "value": "T1B1C65B41FA8B98F5E9031831406BB23F63315D049B28DBDBFB543F6AFC7B6911966209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197031, "uuid": "96bde607-e410-4eb6-bc3e-91e10aa31edb", "value": "49152:Li811vwTevHX9SegoOP0yH9pJ0tS1E2k5+CP/ibP+NdaMrD4RRNKhMhOeELiw63i:Ga1vwY9mpKib6aMwy2wJStJHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772197031, "uuid": "5a9d54b3-05f0-4015-93cd-f42f9ac0214b", "value": 12115968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772197031, "uuid": "03ca2c9e-2907-4fed-a07b-4aa76ed1338d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197031, "uuid": "d49b4a79-40e5-496a-8a0c-3d3ee70f567f", "value": "0ea0649da1694c00f30318743567cfc46387ebe3ac7191f9e4661b38d4a79b7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9b7d18-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216589, "uuid": "0498f758-9c30-4a6b-b15f-586d4fdc68a9", "comment": "Malware payload", "value": "ca0f461a5b362662fea4809fb6380f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216589, "uuid": "64936ef3-f12f-42cf-a07a-667f94cad31d", "comment": "Malware payload", "value": "0eea871c96429d90bc721090d2f4ffa7faf91d1dc49dfd5b91f70e4c2bf0c41e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216589, "uuid": "5787f725-eac1-4c5c-abf5-47c2c6679e87", "comment": "Malware payload", "value": "80e5a88d70ceac5e9168df0e0fd5e9d527c8d06e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216589, "uuid": "f2d9d313-9bca-4af3-b9d9-c70d4ca1c6c1", "comment": "Malware payload", "value": "ac684239e1df0d6fec296536d1fe664d92788b801591e4dc4bdd00306434bb0470ddb985935665157a43a5bf5f3c137c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216589, "uuid": "f12da1a6-eb74-4eff-a768-53e32cb84fc4", "value": "T15DD30746BD418F13C5C321F7FBDE42983A1A6F6DD6EA31029925BFA037864D60E36252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216589, "uuid": "ea5f2b56-707a-4cc6-acd7-4b21586c3b21", "value": "1536:VmbY43nzRGmdrbAIM24V5TDsTydchMo8O+MHqJRcxxR92lwSwywJzUND45LK5P/T:cnz0urb94L42dcm+yCXEDV+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216589, "uuid": "687ac838-2010-4abc-b2bb-965a586d39c7", "value": 138912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216589, "uuid": "064d05b6-63e0-4643-bb65-85ea6861c70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216589, "uuid": "49684009-cc34-4408-901d-e65c8cb8e622", "value": "kirk.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ff9ac9-13c4-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772186958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772186958, "uuid": "bdac2426-d206-492f-892b-1db97154a1c5", "comment": "Malware payload (SantaStealer)", "value": "a542e8ecfa81b3b31ed0ebeb8fef542b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772186958, "uuid": "ba940992-2435-4364-b478-55d6315c14bb", "comment": "Malware payload (SantaStealer)", "value": "0ef9f3e2f6a6a73b8089c257ae0bb861e47f424fbf7a2aca7efa87342ec129ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772186958, "uuid": "de0ca046-3ba5-436a-8836-148b21bbc272", "comment": "Malware payload (SantaStealer)", "value": "27292bda1be3b4d4eea6c6b64640f29b45aad03b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772186958, "uuid": "01ef2b9f-689b-4ee1-9a31-21d35914aa5b", "comment": "Malware payload (SantaStealer)", "value": "7bdc9ea5b0d94eba74f9c94e3e994e06d5909ad970df8fa076a1f52c5c730633a6f55db3412f98b7c809d5ac9ff04371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772186958, "uuid": "8be235d7-f42e-4c82-84ae-fd762feffabf", "value": "T135F6171024D96607FC7EEFBD85DCB6444F7AB2953723EA389B4109E90FD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772186958, "uuid": "4450a0ee-884b-4cd5-9f10-eaa2a9539ad1", "value": "196608:D0c1T0Pn1W0llAN/5nvmLLYuQYjamx4zvj5eIypfZUYIegdUTRDykz:Dxw1W0llAN/5nuLLZxsjg5UYILdUTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772186958, "uuid": "150fb058-1e60-4f2d-b348-e071d0a79fc3", "value": 15386112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772186958, "uuid": "eb877535-3641-4d96-b64a-0d696fcea617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772186958, "uuid": "93449c2f-0996-47bd-95a0-998ed78edf86", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb13e4c2-13e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199162, "uuid": "3b30ce40-ecb5-4b78-8226-5cd4768b111f", "comment": "Malware payload", "value": "37bfd105b84d9e199c118088f2e1473b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199162, "uuid": "f0cfc981-534b-41ba-83c9-616ac843e615", "comment": "Malware payload", "value": "0f331a7db40669b61d9e85212f8cd45277f6be2220a347329b3515e624c430b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199162, "uuid": "68e1d1e5-a9bb-4481-8002-1bc0f81eaff0", "comment": "Malware payload", "value": "024771648be60a0d2c128f140c6e9e4bafd44c37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199162, "uuid": "395f26ed-0f71-4ead-847e-8f91f59c0af4", "comment": "Malware payload", "value": "8ccae73b52a15c975cdf245e5b04a5bb7f83235e0b8b5b772f132be9978b7f8ecc030db4eca329fb9ce6f44c225373e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199162, "uuid": "8f69eec2-6c40-4da9-a32b-21ddb635b7bf", "value": "T14932563B21F08B32D3C420C953A65B654E72A70B452614B9F4FE6739AF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199162, "uuid": "33f5b978-ec71-4a43-afc3-37702a6ecfe9", "value": "96:cAu1B6msht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj6YFWnR98b:cAuH6L4hvZ5mN9oKNpivYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199162, "uuid": "43109c98-e5c2-4543-9a26-9a678c593657", "value": 11082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199162, "uuid": "c22e52fc-64c5-41eb-94b0-88481423193d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199162, "uuid": "4f45a30b-2166-43e0-ad73-bd98ed076321", "value": "0f331a7db40669b61d9e85212f8cd45277f6be2220a347329b3515e624c430b3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067aa5eb-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176069, "uuid": "9f2bffce-f8d5-4b87-81ff-7bc8c4b2e4ff", "comment": "Malware payload", "value": "2d55653379abc152e66955da0b98c289", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176069, "uuid": "f265f5ba-edcf-472d-b4a1-b8a0655e7033", "comment": "Malware payload", "value": "10030b7aabe7b1ca7894032801e0806b8a6212536ec1892a7ba94a714cf92ee5", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176069, "uuid": "e644146f-db90-4284-9ce9-e46ae1a7c6bd", "comment": "Malware payload", "value": "c44bbc681afd6df1bf8e8615f1eb953bb79cbcbc", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176069, "uuid": "c9a2e886-8af5-42d6-b201-a9b727d346fc", "comment": "Malware payload", "value": "0655a6082ccb95ce95e78e87307106215914a5c7ddf8536f71f1524b4fdad48f5e9dee6c84a14a88ae5707e98e9ca2aa", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176069, "uuid": "18eb43a8-d2e6-4a32-a09f-7221e098287d", "value": "T106816D6620FE2522E4DE8A755DFE45C77717EDD578F2881105A70CE47C81A8B121C0CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176069, "uuid": "c295de37-79a9-4567-8046-245a37a7b17a", "value": "48:9C1toxRFnIVLohfTkzCum+vBBmZnbkpFfpEZ8wJYZLMLuphmo1KIn0Foc6T5tiMc:+ohnIVUYmOvBcZbknps1I0FeVti2GQVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176069, "uuid": "12b3feb3-7500-49dd-9409-5d467df2627f", "value": 3983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176069, "uuid": "60554d70-2cf3-414a-9161-edd3b445a9c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176069, "uuid": "a494ce9a-1825-4dfd-b1e8-c32ca9b46b36", "value": "b90f64171cb45ad2f8ccc4167b56c322a221fb74a3e0c2731b4657c70916bdb3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656b5400-13b1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178805, "uuid": "5d4efa75-34f6-499b-9da3-db59e2159d5a", "comment": "Malware payload (AgentTesla)", "value": "39b03a25cc21e99d80dd4accbdb0bcd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178805, "uuid": "4285e8b9-e7d7-45db-bc3f-026d8ae40d38", "comment": "Malware payload (AgentTesla)", "value": "11784d1302924de204de6e9bb1192b79a1351753bda84a49b153938185836dfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178805, "uuid": "ed6bfe8e-57e5-489e-9be6-9198811c89c3", "comment": "Malware payload (AgentTesla)", "value": "63abaabfdc548812e3bee59c1e011b41d94b58f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178805, "uuid": "effc5a0e-66d1-463a-9b11-20704fdf8f8d", "comment": "Malware payload (AgentTesla)", "value": "c1a8b255c2a3c22434f9578c32910765130ebef3410221ae54fab3078dcb7890cbc927c5b3a2aff577570310eef7cede", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178805, "uuid": "a556959e-ad3c-4234-b1f8-8f4e19b86b07", "value": "T18895C077B122CB6CD0CBC9B824E396F21D307E240AB5124656CE1B5F2AB3D906D5D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178805, "uuid": "086547a3-d9f1-420f-a8e5-5626c5a45e0f", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178805, "uuid": "9e4944a9-814a-4a2d-acb3-eb9133f2fddf", "value": "24576:3fs4r7YFz75ELy9vS9/aOHR+SfIstbokJMxqavDzWLyvt487diDxa/+0:Psa7anKy1S9/aOHRnwUod1vDSLyh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178805, "uuid": "59c9ba16-16bb-4598-8914-e02c96dbcc90", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178805, "uuid": "8859a486-803f-467e-a042-21d1f1eb1ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178805, "uuid": "e87d5185-da36-4899-b5bb-b31f100851e1", "value": "RankupServiceFreeTemp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be6cb66-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772211458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211458, "uuid": "7b22e31a-dd24-4bbd-bed2-d0943c757581", "comment": "Malware payload (NirCmd)", "value": "7cf0d9559693e8d68eeb7b445921c5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211458, "uuid": "86728b03-88ed-48f8-b6b7-4ed3bd7b0529", "comment": "Malware payload (NirCmd)", "value": "118c437b3b2c0bf359c8a29d802afe100c0dde8b62f6eae4bd617455e7ed60b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211458, "uuid": "2b04ad6f-c737-4ef2-9db6-ffc5501bd774", "comment": "Malware payload (NirCmd)", "value": "d76b614e5a2f0845466c0b7ed510c0c22a03774d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211458, "uuid": "56ca1e7c-d994-416b-a881-e96069148055", "comment": "Malware payload (NirCmd)", "value": "e06a9189200de8dcb6060c7e4ad07ca2873aa3c9e87130678b95928997a384dfc633213c658edbbe154e718b115fe2d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211458, "uuid": "6e7ecdfa-9792-4737-bdcd-453690d5b739", "value": "T1B2A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211458, "uuid": "8932d9ca-6f84-47c5-8671-b3505a292532", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211458, "uuid": "b25e04d3-815d-41e9-98ff-b458914bcebf", "value": "49152:ABRiTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:akTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211458, "uuid": "573181de-1b8a-4848-8c31-31c695a0d230", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211458, "uuid": "f2f60e77-5330-4c8f-9fda-a82d0f05aa2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211458, "uuid": "27b68d57-abe6-4ead-80c8-4edcc82e318c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a454a77e-13df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772198668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198668, "uuid": "73884cf4-723f-416f-a5c7-bb85b8749f0d", "comment": "Malware payload", "value": "91a88b6811d3a122b5560082fe6c2257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198668, "uuid": "731adcec-c87d-4525-ac9a-6ad172b26e6f", "comment": "Malware payload", "value": "11ccdd359c97d76f2ba6a8d0ce3cca08cff1cf638eae3f2bc6ba2732b8877e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198668, "uuid": "d89980a5-16ce-4adb-8474-0fa36dad6909", "comment": "Malware payload", "value": "6c467af0be1b12805a1d8805c3bf94c6a1b99e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198668, "uuid": "10049722-6de0-44ed-bd07-7f83fada7d59", "comment": "Malware payload", "value": "8606cee884ef51aa22b1a663e5fe8289511d887b6ce6b8096de96c7687470bcdcaa97c11bf929679c61c548a2b2c6d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198668, "uuid": "278d5eeb-d0fd-486a-a7ed-39d8a9d5e5b5", "value": "T1E445BF0273C1C066FFAB95334F5AF6115BBC79260123AA2F13981DB9B9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198668, "uuid": "a3baca86-d7fd-4587-808e-b1cf39ed2ea7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198668, "uuid": "d78defd5-5e7c-46c5-8782-7beab53a4d80", "value": "24576:Y5EmXFtKaL4/oFe5T9yyXYfP1ijXdaT8TQRVGhmebc8WM03JjX:YPVt/LZeJbInQRaT0wVGP/03J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198668, "uuid": "b806a5eb-58b0-415d-8b16-43655a6b83e1", "value": 1274880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198668, "uuid": "b6c5b1c5-d920-4886-a9e8-9fda55c4baaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198668, "uuid": "03a02096-66fd-47e4-8b9e-04e9e66e56ce", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfaf571-13e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772198922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198922, "uuid": "d091e2bb-ffe8-49e7-8351-8a56ede7c90e", "comment": "Malware payload (Mirai)", "value": "865b4e4fecb1c03804c29da06bb237d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198922, "uuid": "d9315ab3-c6d4-4b27-bc65-4e55c6aaf4e0", "comment": "Malware payload (Mirai)", "value": "12217354e513e207f3d772890ad4bdf87e9f5cb04d639ea189b6a002d8b64657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198922, "uuid": "48e159db-f6a4-4c1d-8223-8689ad4f100c", "comment": "Malware payload (Mirai)", "value": "5150302f725dad8ef8911dd6b41cb2037cbe5a12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198922, "uuid": "9429907e-5394-4c47-8ef8-59f8afac66b6", "comment": "Malware payload (Mirai)", "value": "5a0b85c62b243bb20b338b71af9fa4db55da857d2ded9214ff7c042caa959550bd7afa4dea4c8592ac25e3e0c7a53a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198922, "uuid": "9cd72646-cdfd-4521-a2c4-9f5a69f79c65", "value": "T145F30A46F8815B16C5D112BEFE1D128E37231BB8E2DE72139D245F647B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198922, "uuid": "bc17392c-641e-417a-b9d0-d1ed93a9eea6", "value": "3072:NxSHZasU974KOXQdqaxefaNKSF9c7Ag9b6:NkHtmROXQcaxAaXgAg9b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198922, "uuid": "e91f658a-0dac-4664-98ec-32b72cb2083a", "value": 157308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198922, "uuid": "a81ee729-26bc-481e-b47b-4ea523524ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198922, "uuid": "be491982-bb66-4484-90bd-900d1dc490ec", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429e0ed2-137e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772156842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156842, "uuid": "63119ae5-ded0-4dfc-bec6-79b8e57d59db", "comment": "Malware payload (Mirai)", "value": "a53315e9e44749c7a702834dc726e2c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156842, "uuid": "ceb85125-62bf-4218-9e32-f21ef85a8b79", "comment": "Malware payload (Mirai)", "value": "128bf0790cd11aacb53eaa299d05e4ce2cb02f36e14c52323493b1395e7ad9b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156842, "uuid": "45e27589-bb2f-4096-a02d-ca635cdf7eb8", "comment": "Malware payload (Mirai)", "value": "39b589e359941dc200877a55e876ec122cb878f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156842, "uuid": "e94cfb5e-4832-41a4-84bb-879c27b465b4", "comment": "Malware payload (Mirai)", "value": "73e4301e7ef502d4075812b7e9c5c1237687cdb923b8223c900b6d152071bb4d4041ec841b754d47d51f296145bba1de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156842, "uuid": "253a39e3-da50-4164-b92d-472872703c48", "value": "T149231781B8D19A02C9D453B7FA6E418E33256398E2DF33079D222F557BD682F0D7B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156842, "uuid": "5ff85a0a-4cac-422f-81f6-77807b1651f9", "value": "768:Pu5lt0vq1lCCZdnLTaW7nDfaZNePmGehIWvLci4fyQpn83ZNOPcusLS:qlivUY8LTN7nLaZMjWLGaQpn8H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772156842, "uuid": "46878b7d-ea30-4748-a511-79238714fdac", "value": 46968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772156842, "uuid": "02bdcc4a-107a-421e-abaa-12aad3a9cf06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156842, "uuid": "f88854df-3f2f-499a-9d1d-b9f0dfa82eae", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292b2a41-13e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772202756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202756, "uuid": "f0cbd150-f30b-4956-9b5b-d70ebc797a6f", "comment": "Malware payload", "value": "73e08403bf586db35e478c9936754ad0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202756, "uuid": "66608cc2-f5bc-41ce-b564-f1581fbf76a9", "comment": "Malware payload", "value": "138479047bc63b023b6b6f93a15300e32e0ba2bd8ae2b3ade6aecc7c22b869f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202756, "uuid": "714665af-3886-45a7-bcfa-859c99ff3ab3", "comment": "Malware payload", "value": "6f4cfa7e830fbc52da51da096049d21404346e8d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202756, "uuid": "d9cf41ab-27b7-4ec2-b92a-59a12bc2765d", "comment": "Malware payload", "value": "214569efea687f5c06b3b22fca30a994963c69d42503aaf0abf9ff4a97a447c4507a581ae5371260c1235075fb1f5eab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202756, "uuid": "0500e5c0-68e0-4c26-8dc6-fd7700fec74b", "value": "T14F22453B21F08732D3C050C953A65A614E72A70B492614B9F4BEA33AAF2C90731E7F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202756, "uuid": "829ef233-b8a5-4bc7-b5ae-425651dcfd36", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj0zCjsF:cCuYK6p4hvZ5mN9oKNpivl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202756, "uuid": "178e4320-1897-4dd6-9a2e-38cac30eb255", "value": 10059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202756, "uuid": "f7929408-7701-47b8-813b-f7e47cf76297", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202756, "uuid": "2b84f6ca-664b-497e-876b-9c765117e7e1", "value": "138479047bc63b023b6b6f93a15300e32e0ba2bd8ae2b3ade6aecc7c22b869f5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a5dde-1426-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772228892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228892, "uuid": "93ec9b76-bf17-4a20-a3a8-51f335838636", "comment": "Malware payload", "value": "2dd54a1a164182c0b87d9eb2b254be74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228892, "uuid": "cc24540c-d7b3-443a-a55c-6c58a9edc510", "comment": "Malware payload", "value": "139480e1c4ae77b2b865460af38b48ad32fbc8a68c3c657baac3ab3896226192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228892, "uuid": "172ba0bd-52ca-45ed-875e-2cdde7c02f17", "comment": "Malware payload", "value": "89673fcc6c344b60c267588ed79362c355de78f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228892, "uuid": "a989bebe-600a-45c7-bce6-1968e2091519", "comment": "Malware payload", "value": "f15431ba163c8bb26d1323a27f5b7ff067028d6dffef86efe529fdadbd01aaa76f0bae0187339fb209012a76d51de630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228892, "uuid": "78dc1f74-4f31-472c-a17e-064a903eeae5", "value": "T186947D27F6D08437D16336B9DC1B9698A929BD505D24244A3BF83E4C4F39383F92629F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228892, "uuid": "cb5f00f5-a844-42e6-ad07-124c42ce58de", "value": "a36817d78b68cd4fff8a5565537870bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228892, "uuid": "4fea7c6d-9ea5-4482-8a62-7e68d98f0529", "value": "12288:7MSU4joci8M6PW1GVFeFd60DFUyhevYM:ASUCpM2W1Gvgmyevv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772228892, "uuid": "85043016-7fc6-43b5-94e7-0430ba2839bd", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772228892, "uuid": "a5df4200-2965-406d-813b-dd48dda8f4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228892, "uuid": "4b33b430-70e2-44d9-a6ab-ec14e33f8216", "value": "Trojan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febd603a-13b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772182069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182069, "uuid": "57811e99-75f1-4507-b41c-71fed00023c6", "comment": "Malware payload", "value": "53cbc5fdcc64f3aab147f6e859fc952c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182069, "uuid": "8d0ab2ad-d9f4-47eb-bdf0-705a02880b73", "comment": "Malware payload", "value": "13b1703e61ad11f3ed6af1dc454edeaa6d2be9b2428414af2b9beacf7169ce63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182069, "uuid": "64dc4e6a-f4f9-465e-92e3-4158bd76994e", "comment": "Malware payload", "value": "2cf94f1dceb1440f3b32cef99cb9fcebfb83f065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182069, "uuid": "693a87f2-5c69-4c10-b2a2-df85f7933954", "comment": "Malware payload", "value": "24538d4237cf14949fec5879ee4e1e76e38b58177f89abf090c5ad28faa4f5140903dd809b107d8cf8f59b382405b7b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182069, "uuid": "2d39269d-62b0-4051-a011-2d025d423ff3", "value": "T1246423C473AD8B40C3C9E6F4F98944EBB65E88F35091AC5D8D59EB7CA732D4B89009D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182069, "uuid": "aee4d9d7-0c95-4d5f-a370-a4e20ed32857", "value": "6144:9fZLx3Tl/ezz5Sg2CUMMooIxe6mphWvSfSwE0In6lbV3cdP/GR:xZLn8z5T2bMGIxJtw4n8hy/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182069, "uuid": "077e2f02-ce79-402f-a159-6cce04699801", "value": 317624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182069, "uuid": "acd627c6-9a29-4cc9-9561-0dfdf3f51d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182069, "uuid": "024e3d76-dabf-4950-9447-74e9b395d7a9", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d300bab3-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191444, "uuid": "319dfd49-b276-4490-b620-9c464bed7c5f", "comment": "Malware payload", "value": "387367029aebe5ad527ce48ffbf9bd21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191444, "uuid": "58218eb5-16d3-4e2d-b4fa-1680569c70ad", "comment": "Malware payload", "value": "146dcb410897ae8220278fd97ab6a8849f69e8d60be8a14521a6b4daf3a947e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191444, "uuid": "e2636ddb-a81f-4f88-b42b-df2ac5c45d8d", "comment": "Malware payload", "value": "ee29b9b62d358575c4d11274760f3e3fddf6778a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191444, "uuid": "d267f5c1-7593-4aa5-b602-1d5ffb66dfa0", "comment": "Malware payload", "value": "ad25cf6fe6c0788b4bd129690ed4744c593b6b70fe9dc294802025ddaf14dc80af4bbd4b125642b74ebb93b3f94c92ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191444, "uuid": "8284034a-a22a-460c-b819-d533dffa77c4", "value": "T1F9B723237684806DE56A02315E6F6EA4E2A96C331B2141DBF690FF591CF05D1BE33B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191444, "uuid": "6abbbcae-603c-441d-ace6-9fbbde8337f5", "value": "a5a0f941862df8e0d01359e62a3aaaf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191444, "uuid": "9759f420-1a2d-4b8f-a927-d6e70f4989fd", "value": "1572864:J79AuHgIvNLcwMyHE0AoFAhs8blELYkahNm/m:JZNvewEkwsoEyPsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191444, "uuid": "757c950d-9c79-4ca5-a240-2f8969206e10", "value": 50347448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191444, "uuid": "ac475a7d-7c0d-4770-8356-0e27d7ea312c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191444, "uuid": "87244bb7-1002-45d7-9188-7df0068b74e2", "value": "GoogleMeetv45675installerBaseSite_Agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008ce26d-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772199681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199681, "uuid": "84a3bb57-dc8e-4a63-aa37-7cf8753f9d07", "comment": "Malware payload (Phorpiex)", "value": "a9203e947614ec06570b5753edfc1b68", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199681, "uuid": "360b5484-7804-4b21-86aa-f3205d9a9137", "comment": "Malware payload (Phorpiex)", "value": "153c1bbfce8fcf4d644a8b7a3843e92e30239d977eb9f4bb21cca7765e48b10d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199681, "uuid": "650758f9-2303-4e9a-be36-9deea9c213c9", "comment": "Malware payload (Phorpiex)", "value": "b64bb5e5fb565e9f59777ef5025e2bb25a98eb96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199681, "uuid": "9f693d33-0f29-491e-a3c9-876d0671e487", "comment": "Malware payload (Phorpiex)", "value": "3284de4b9f35d9655a3e801eb5b5f78e432f2232dbfe4148359a5d2055562645fd8fbbd5b497ffdbb885e94646dfe6f0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199681, "uuid": "e22441b5-d1be-437c-bd2b-7a98a74f3f18", "value": "T189723B0FAA408036DBD11070863B466385B9A87627D8EDC7FBF4A5CE4AA42D1F43616F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199681, "uuid": "d7fab322-52b9-4774-a7d2-fa57c7d51a26", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199681, "uuid": "53bc93d9-3a05-4bae-9c82-38cacb962c02", "value": "192:uZ5qwTiyXgzhDDRdyYRNnOFSr3URvimpVFAh0Z4W2KUSfnzQlrxDtsSPZmJxTmvI:GJi3DzyunrmpV00FnU0dav8U9cIkdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199681, "uuid": "0402edaf-07c0-4f83-8a3c-fc6d3dcac824", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199681, "uuid": "c4a5e0a7-87d9-4e2f-b364-94aa50e06d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199681, "uuid": "212752c3-68de-4051-b568-94ab9175c8c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffe1cfb-1422-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772227276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772227276, "uuid": "f649b709-be7c-4ca2-8566-26022a98890d", "comment": "Malware payload (ScarfaceStealer)", "value": "aca7275bb8b68d7b44d54bc988b28b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772227276, "uuid": "c0364a54-1a5d-4e4b-83f7-db328e4886f0", "comment": "Malware payload (ScarfaceStealer)", "value": "15f5bd35e6ee3577ebb66f724177e417f95ad6b688f54e32bd6db6b8d0f27666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772227276, "uuid": "f8259dfd-9a3d-4b08-ac9c-bddae08cf1be", "comment": "Malware payload (ScarfaceStealer)", "value": "b5026b858acaa056a890061d7b0724632bf22e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772227276, "uuid": "d974646f-ab44-4251-a530-4db8255d10f8", "comment": "Malware payload (ScarfaceStealer)", "value": "00d4bda170d3ab0ce3d0e3eb9a3dbea65376f9b2492acfb6338fa873671bf166c2e3359ed4a0088ba6b16d27d25b423f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772227276, "uuid": "cdf2bada-a448-440d-95bf-71912809b50a", "value": "T1DBD623FD0AD242B494D34A40718B93AA75C1724E86FC4C1E3DD72D02262ADEE654EEF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772227276, "uuid": "bdc232d5-5918-4e70-90c8-4f7f75ad6937", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772227276, "uuid": "bca8b842-002d-4102-afe7-b980070d9af0", "value": "196608:IsJS6EDhMZ2c5LGFE9LO/a2tJgu/oy6ZFmYJFT8QHviGxQoGb1S35/UwBBY9C7:IYi/GIE9K/a2tCu/mDbHSm3/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772227276, "uuid": "b69ab7fa-1750-4d0d-b15c-a1cbcaf9e714", "value": 12641792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772227276, "uuid": "a74d949c-6e76-47b2-8e41-d722f72d250c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772227276, "uuid": "5a8b7748-d0a3-419b-ae17-7e27a425be1f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8996a4d4-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212367, "uuid": "f33da3a4-8c25-455f-8909-52641c00225a", "comment": "Malware payload (PhantomStealer)", "value": "4fa7562ee83ca3f230642783140d060c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212367, "uuid": "1fb139c7-c4a7-4ce2-b592-449fa20a194d", "comment": "Malware payload (PhantomStealer)", "value": "16685515579eefe740a8b62bfc2c46da848c6487ef5367442f60b57ee1d82485", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212367, "uuid": "e0d27a5e-6ebb-42ee-9ca7-62905ce4dc2a", "comment": "Malware payload (PhantomStealer)", "value": "8879c9638c39ae5bbc6093433bbc69575474ce30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212367, "uuid": "aadaa2dd-7c14-4604-8575-9fc610fbb836", "comment": "Malware payload (PhantomStealer)", "value": "dc4239fc3d511d3c6474c8aca2cec77d601a425b8857f4ff752d4909b9da655e520a92d3946d0fd59467a385f92dcf01", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212367, "uuid": "089cf2c5-8fd4-4fad-b1e1-1371b5c7e4d6", "value": "T1FF26BE764EA677C40F187D24F4B458298F3124E10A91901F3B3375DAFA9FACA385798E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212367, "uuid": "6de605d6-5e15-4153-8d3d-4e6ae690938b", "value": "49152:fhKSthQhFqJneakQ+3jH3kaJ3FFJ9giv8shTi:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212367, "uuid": "458ef931-3f33-4226-9e7e-9148104dff1b", "value": 4645343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212367, "uuid": "d1168f66-3530-40b2-beea-57ec057a90fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212367, "uuid": "bc744513-6898-4f49-a03c-22775baa4ba4", "value": "4fa7562ee83ca3f230642783140d060c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c577b0a-13ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204479, "uuid": "46731171-7691-4194-8f44-ddebcce391c8", "comment": "Malware payload", "value": "9fd2265f9e7c478056d80382f4057981", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204479, "uuid": "bc5158e1-80f6-40b4-a346-e76d756dcde6", "comment": "Malware payload", "value": "169f02bdc037e014dd51cb3bda3dcc7fe29e929d566bcac8ee1ba439a7c3b35b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204479, "uuid": "ddcf1f7f-212a-41bb-80bd-8043bb7722d1", "comment": "Malware payload", "value": "b6b22466b011bace31062401d48d283a05388012", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204479, "uuid": "844bed75-a969-4a3e-96b9-6778455e477e", "comment": "Malware payload", "value": "31a59f41a16b8cf7fcbe052cd08dd838abe17dc625f29eb0ec69f21ef0cae73532a26bc65cb23a2fa839bc026d47dc08", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204479, "uuid": "fd1c705e-7103-4318-8815-440d807638a2", "value": "T169A27E7621F04A33AA9055C4B3772BA14F72D65784A321B8B4FE1B359F59B0370FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204479, "uuid": "8a04ec20-9d5a-489b-9766-1557db19e41a", "value": "192:cCu2g6p4hvZ5m5FoKNpivFDFCrxIT+10DUwoKmjLaeOWO+8TRi/:Bbp4hvZ5m5FoKNpivFDQrxIT+10DUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204479, "uuid": "d0d0f46d-d47b-4e82-bc0e-174f9e42f7f7", "value": 21422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204479, "uuid": "ee047b74-169c-4296-9eb9-5532da9bb1df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204479, "uuid": "470fb910-30bf-4df5-9e42-e317522208ba", "value": "169f02bdc037e014dd51cb3bda3dcc7fe29e929d566bcac8ee1ba439a7c3b35b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94141e4e-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179313, "uuid": "96a44efc-a0f1-4eeb-978d-cb7a66179501", "comment": "Malware payload", "value": "5347d83b04a5beba12497a76fef82944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179313, "uuid": "c205159e-0f21-4915-8523-c891e9fb0b60", "comment": "Malware payload", "value": "170c92627a82988b208362fb7fd892594f90e8d3414be01e48128f7f6fd4353c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179313, "uuid": "8f480f3f-6f42-41d3-a59d-c48ffe08788e", "comment": "Malware payload", "value": "89c0a4b60745b2d6ab2e599982b8b801058ed312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179313, "uuid": "cb4a40dc-17cb-4362-8e1b-43082ceaa5be", "comment": "Malware payload", "value": "4a6497d532471c1b3c0ef36b994ec22c454ea1d6534608b812346daf6fbfb7efb2c778d142130b75a5c1a1361d9201e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179313, "uuid": "c90d197a-12b1-4e94-af32-d33bba7b4fe3", "value": "T11B859EF131264857D82B8BBBD921C650136A239B8EFE34901D981B55A3783E17FF6ED0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179313, "uuid": "f365cf90-4cd1-4c6a-ab73-b9a3d072fb5a", "value": "0de8734c7c7e79546042492cde5159a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179313, "uuid": "d5e0bdce-5b88-4c9b-b460-4fcd11087554", "value": "49152:CCMtHtu5Kv5oAsjiFHNotYQ8Q5pts80paBZjA3:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179313, "uuid": "f4e5b6b6-20c9-42db-8f83-aa6bb1e124d5", "value": 1777452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179313, "uuid": "75fbf234-170c-4ff8-954a-e730941105d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179313, "uuid": "07acc18f-cb91-4c8c-9eb5-3f1eff5173db", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443e63d2-13ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204090, "uuid": "4d9af1ef-0fb4-4777-b883-c8235396e0c3", "comment": "Malware payload", "value": "dba7ca0e96d4084345cd7391d94ff95c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204090, "uuid": "583b1668-4351-4ddc-bece-cc8852d63d70", "comment": "Malware payload", "value": "176f26971afe92683e062bd1c19706048c4c9c072d0045421892bd927e683bce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204090, "uuid": "50ff5a1c-52bc-4012-bd46-b77735b5c1df", "comment": "Malware payload", "value": "b46bdc3c39f164777eb91ba5d3cf210fa1fdc583", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204090, "uuid": "c4d7a352-25a7-475b-9291-9ff70155a60d", "comment": "Malware payload", "value": "999f9cd3e547c238dbeb7eee2708300836bbec7fa0f97fbf3d715bc958b708a5fb2ed95fe4855fa95d36210802984a4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204090, "uuid": "7d3a81fe-9542-48d0-8899-1ea2d3c7b590", "value": "T1E591B5B435F14C732E645580F3772BA6ABB7D84349E3318C35DE2E296F86B02A5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204090, "uuid": "2d7f3a33-c3c4-42ee-9c5e-2d940f4a7949", "value": "48:cnRu9+19nB6g3ijlwnmQpklwn80pklwni8pklwnEoC5pklwn+i+1l3MT+1l3idTr:cRu6B67sdfpZC1CbTbhblPWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204090, "uuid": "1dca1fe3-bbcf-401d-9155-8bfe51c3a310", "value": 4280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204090, "uuid": "6bc97960-9c76-4d36-84af-af0d74f0bfe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204090, "uuid": "e79a7e91-a1ff-4533-9fa3-21f40eb38bd0", "value": "176f26971afe92683e062bd1c19706048c4c9c072d0045421892bd927e683bce.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4698b611-13ef-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772205382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205382, "uuid": "a401d225-1b42-4e4e-b24b-9dce74b185b1", "comment": "Malware payload (SalatStealer)", "value": "2daf06e6bc2438351019aea31331dc16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205382, "uuid": "e52475f0-85b2-4d71-ba61-402ae3dccc30", "comment": "Malware payload (SalatStealer)", "value": "1814c89858bdca2f5bb287a6ecd298b0c0d540488715795e441d40da808efc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205382, "uuid": "76602c3f-9461-41d3-b3dc-d99aebedaf30", "comment": "Malware payload (SalatStealer)", "value": "2f078f0fcf36d83d1eeeecce44dc034c71b1fdd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205382, "uuid": "7b6a65a8-bba9-4c1e-a99d-21e2bf2fdc38", "comment": "Malware payload (SalatStealer)", "value": "c9600b83a1f643f8595c1e25fcf021475ab4a18c0fbaafc72b12d2c71537ed8820f682b3264c2fea00b331afe1240baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205382, "uuid": "2739595b-963d-4b70-89d6-83777692d5c0", "value": "T12EC67C41FA8B54F6EA035831506BA23F23315D048B24DFDBEB547E6AFC7B6821937609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205382, "uuid": "935ef9f4-56f5-48b6-9629-e3cccc043bf9", "value": "98304:D6XA3ZwRSFHbVfvTF8ZAHT+utApJ0ebLSgzMW1Xys96e82YhEU:BwRSFHbVfvTF8ZAHT+utADzMWNyq8X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772205382, "uuid": "c834a534-470e-4bdc-a132-159efc644821", "value": 12113408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772205382, "uuid": "052078de-d1d9-4b80-9854-8e84c63bd185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205382, "uuid": "f662b314-f66f-468a-b28f-f77a116a905a", "value": "x1814c89858bdca2f5bb287a6ecd298b0c0d540488715795e441d40da808efc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c312378-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216585, "uuid": "ea098829-332d-4e58-b1e6-0e09cdeff3d8", "comment": "Malware payload (Mirai)", "value": "eb54445232e39955548324767e2ea064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216585, "uuid": "68d2e701-ddb3-412c-9684-120a18cf7509", "comment": "Malware payload (Mirai)", "value": "18885ca7604a0bc3cda7b203e17e20634712bf9b3e57fb48036936aa16e7ae92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216585, "uuid": "e3102ab9-9a65-48cd-9d20-500caddf1586", "comment": "Malware payload (Mirai)", "value": "8579c8ce42de0236945d9aed9e88631b50842a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216585, "uuid": "08ef8e3f-e7f3-4183-8b5c-e1b3f88b7d4a", "comment": "Malware payload (Mirai)", "value": "244ab17f43407fa9adae2890b34fe6ff12453b8a751f9f422f9f46e3428df58908fa0f4bfd30195b88aa1abe34d05807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216585, "uuid": "59d160ef-acb4-44e9-b5e6-7e71e1c6b6b3", "value": "T153C31663DE26AF4AC117A4F462F24E781B52FD6649470FFAA476EAE44103CCDB1053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216585, "uuid": "3367795d-aad1-494b-8bed-7bfe6619a3eb", "value": "1536:+yYjVUvV1VI8ALlC8KFukc7gfLUSzzHRIWymciBqCQGm1+e:OjVQ1lALluFkWUSvxIWrciB9W1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216585, "uuid": "97567214-e6fe-4300-ad02-1f027c051e83", "value": 122592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216585, "uuid": "b3854fe8-1c67-415c-995f-4c0c51185e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216585, "uuid": "1c8173a7-674e-4b19-85e8-cfa1b1e263a1", "value": "kirk.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283d7ce9-13ae-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772177414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177414, "uuid": "7903079e-a873-464a-b136-5736c32c8464", "comment": "Malware payload (DCRat)", "value": "3c44cac394ebdd67a50c8c7c3c27556a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177414, "uuid": "e3e286a3-269e-4a35-ab37-3fdfd2d1b151", "comment": "Malware payload (DCRat)", "value": "18f2809e280da54b81ebd9e4b85ce8307f13d0b0323b35ecf9fcc75ca3dce971", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177414, "uuid": "00c5a0d9-64bf-4a46-8afe-ab358ccf5b1c", "comment": "Malware payload (DCRat)", "value": "8318b8178be6ca9203538188ffa8d01376e265ef", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177414, "uuid": "8d4fb66e-d61a-4b30-9df8-40033048ca44", "comment": "Malware payload (DCRat)", "value": "79d1112f94f5b16811fcc6e83bfbc55f93778e92c0082933f95114ee4a7feeab5ae6e819f9fe53125a8a8ffcc97c0fa6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177414, "uuid": "bb964cfd-3c15-43e6-92d1-d8eef4b92fc1", "value": "T129455A027E44CE11F0091233C2EF454847B999516AA6E32FBDBA377E59523A77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177414, "uuid": "8b1ca5fc-2f1c-46cd-8ea7-951189cf3fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177414, "uuid": "015c0096-2020-45b5-933b-5cb402b1e141", "value": "24576:LI1/+GBT69ME945WExrG5oihx0X2g3JQUTJfeJcQ1H:8JxEeh0U2mTTJg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177414, "uuid": "a9377997-02e8-4150-8b9f-b02b65c36057", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177414, "uuid": "792a001e-59a0-4ba8-8916-3fe7776479f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177414, "uuid": "c7e8fa7e-9c85-44ca-965b-54d9c9418663", "value": "3C44CAC394EBDD67A50C8C7C3C27556A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c38dc3-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176571, "uuid": "bee56807-fd05-4d96-8658-2da0b49fe075", "comment": "Malware payload", "value": "1204c9c00e2ab3f28d79d140bba20a4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176571, "uuid": "d7e91119-a1d3-4a93-8b67-7b619aba67a1", "comment": "Malware payload", "value": "18fdd53c991d33a9b834c90b914875c92f398e5fba4b949065c64ab9b2912a9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176571, "uuid": "5290c7ef-ff7c-4cda-9aed-79abea192f3b", "comment": "Malware payload", "value": "5a41965eb9240a4892de39b76431b0962617a183", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176571, "uuid": "3ca0aff2-2e26-495b-9e48-f1eaed985e91", "comment": "Malware payload", "value": "3a66dc50d7a5c3406fc4573ab83378093a7a8f28d07eaa4decaa4f7320688b17fab0fbc5ee0a61cd654f4ff07594632d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176571, "uuid": "57c32b2e-335b-4ca6-8b4d-645fe1511b57", "value": "T14DF4071272D58AA2D159A732C0F70C005BF4B196B737EB4F7A8127BE18037958E4B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176571, "uuid": "570a13ae-2a68-4647-b67d-37a11a7cb503", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176571, "uuid": "bec2c21b-569e-4180-a95c-a87990e644ee", "value": "12288:Ier9C8u7b8TsRkIrcTanLiv370A1eXXFthTH:bQysRkYLM0V1thTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176571, "uuid": "74d22fe4-c71c-4c23-b6e9-872c02a0190a", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176571, "uuid": "41876f16-0cae-4c7c-810b-b7113c9b867d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176571, "uuid": "ce9d8023-4f7d-4c91-a3e6-4b78d2ac223e", "value": "18fdd53c991d33a9b834c90b914875c92f398e5fba4b949065c64ab9b2912a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7f83db-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212964, "uuid": "e1a824e9-bc94-4ea2-b0cc-d2a2d9db7cfc", "comment": "Malware payload (Mirai)", "value": "3fa94b0db728d48b1b1b1ce94bc53267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212964, "uuid": "ca111559-b4c0-4f59-90e8-534db379d4e4", "comment": "Malware payload (Mirai)", "value": "19c08dd3eaf63191b519d02a409cbdd788d29e28bfaa12403e979a64e8ce723b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212964, "uuid": "cf21b70e-ac7c-41c0-bf86-22fa83df926d", "comment": "Malware payload (Mirai)", "value": "7dbad9162aad38a6fab76818ad1a727fc739bd95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212964, "uuid": "e771d534-361e-4df2-b332-0349ab06739d", "comment": "Malware payload (Mirai)", "value": "27c3b5df3ae264b71f7014517f4773984a7ac1e84d355c54525e5f7db96fddc77d770e668ffc623cc44fe46660d9739d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212964, "uuid": "65f7e3bf-b8d8-4f19-a135-253b89189f27", "value": "T160B3ADEFF34B1591C8628BF013C39BDE2E2722129F6B85E73C0E567A18751DB491A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212964, "uuid": "da587fe4-92fb-4562-b33b-1b3972d7d864", "value": "1536:LLOwW5OIMbLQT/vl9NMJJ6m3WXfeoiWR9g//LW9:uw/IMbszd9cJ6c2eoiU9g/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212964, "uuid": "3554f152-ce27-455a-9fce-bedb40364981", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212964, "uuid": "9b2ef5e5-6ff9-4448-8ff0-1bcd040448ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212964, "uuid": "e0a70d09-cbc8-48cd-83c8-cdd4d2d74fc3", "value": "sora.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29d8cc7-13e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772200893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200893, "uuid": "a0874d61-d5ad-4981-9798-542b78139b0b", "comment": "Malware payload", "value": "e5a5bd72a0dce16ddc93ad10b70ae89c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200893, "uuid": "ceb71414-7465-475f-9797-8395b426353c", "comment": "Malware payload", "value": "1a1159ccdf502419ecbfe5cfc4782dbfd8f06f1f022586bfeb3fc53031048438", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200893, "uuid": "6d89c259-aa27-4f94-8de8-2e6667d35101", "comment": "Malware payload", "value": "04cfb40a1408fae8711789dedae6c9676e2d15de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200893, "uuid": "5288b856-be83-4185-a4c9-68fbaf295823", "comment": "Malware payload", "value": "66592657b9c22379357d61d71e0624d8caf63b7d8c55d749bf6aff1999a0429e0953945c18aa1b1430103a0167290115", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200893, "uuid": "b0b60caf-1eef-4947-9042-f2309ac12932", "value": "T1F491B4B420F018332D215540B3771BE6ABB6D85796A3668C34DD1F3A6F9BB03A5AF421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200893, "uuid": "846d6739-5851-4239-8b16-eb1c78017c03", "value": "48:cnRu9RJ9nB6gTUblrmTUblr8FUvylriJUbylrEJUbylr+nUbylrMJUbylri0Uylq:cRu7B61xvxhvwJUvU9UXU8wmlLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200893, "uuid": "a7a3b211-4fbe-414c-b5e9-72da32a0b239", "value": 4553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200893, "uuid": "1eaaf6aa-3069-41c4-abae-85f330db52c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200893, "uuid": "56fcf695-bf98-4cb2-96f6-2b2164a2609c", "value": "1a1159ccdf502419ecbfe5cfc4782dbfd8f06f1f022586bfeb3fc53031048438.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54078262-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216572, "uuid": "f4863b30-808b-4419-8d71-b04e6f7c7e14", "comment": "Malware payload (Mirai)", "value": "8e5c5b1b33e1ac273101714f5ab1d86e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216572, "uuid": "bcee89da-37b9-4174-8e98-b04b0186b385", "comment": "Malware payload (Mirai)", "value": "1b7dda490d43cfc9186373b7ab449477642b5e6e57188a62b2bcb292106dc6ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216572, "uuid": "c2abedb1-ed37-4e66-99c9-5aa0ee872d34", "comment": "Malware payload (Mirai)", "value": "fe9c8a4b734c7c0f2310c1eb5948c74fb02b260b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216572, "uuid": "044f1dd5-b99c-4ce6-9b07-7443892a01d3", "comment": "Malware payload (Mirai)", "value": "41bb47a5323d56d6acbbf096d079ddec25690c9942900fb9c1b68a4add3e406937fdab1cb98e7961b7ea6816ba60bdc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216572, "uuid": "5116822e-682a-4f0e-9ab2-1dab4a8c5c8c", "value": "T11704A81A6F238F6FF269827047F34E30975976DA16E1D684E2ACD5501F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216572, "uuid": "afcc8554-7f79-4c75-8bed-ab232b62943b", "value": "3072:6NdQopCfRnE9XxQ8diQSvQAD4ear0gx7cz:6nAMhdJA+r0qcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216572, "uuid": "9b7114ee-8712-43dd-a5ca-a77eb0417422", "value": 178488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216572, "uuid": "63ff7664-0f82-4ed1-ada1-a8df03610423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216572, "uuid": "c5b489e4-cb84-4a0c-985c-a8dce5f20f97", "value": "kirk.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d25462-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223927, "uuid": "e9993e18-df6c-473f-82e3-f3f8a8da4a6f", "comment": "Malware payload (Mirai)", "value": "1574d4dca38c698c2a0aedc23d182234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223927, "uuid": "650980af-4c4f-451a-8222-103cf4460d71", "comment": "Malware payload (Mirai)", "value": "1bd36ccedcad1be4add977e7296eebf6e8e0c89a5cb117695989f7b90581f45f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223927, "uuid": "3ca838fb-c05b-4dd9-81fc-a2b6c744e524", "comment": "Malware payload (Mirai)", "value": "2b787d565e6ed2f1fd746ff6de9d69e0aa2f7bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223927, "uuid": "8145b3b5-bf29-4fdc-a525-b1dfda1b7260", "comment": "Malware payload (Mirai)", "value": "60db657768c9974d637c46f798815d9f40a1076e106744864d2e52a387ef19e9a33743dcf0f4ba7e290f3d0882edf5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223927, "uuid": "3ae33006-dcb5-431e-a45d-3e3f1a0c6560", "value": "T130B3AEEBF64715A2C85243F013C79F8E3E232390AE57A4E76D1E267B15760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223927, "uuid": "8ff2f68f-560d-4b2b-8eb4-b813b1686fc0", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJr/LWW:6fIw3e8ZE3MYlphDgJrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223927, "uuid": "a6e6b84b-08d0-4839-a93c-8011ea1250fe", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223927, "uuid": "e50251a5-f58b-46a6-a002-17ae5ec9dfd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223927, "uuid": "f9e54c27-89e6-4bbb-9da2-9cb27f3e74f7", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312b5727-13f7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772208782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208782, "uuid": "9fa4c626-4166-4574-9eba-0c9ca924f352", "comment": "Malware payload (RemcosRAT)", "value": "231e7b516429326b9084b1772ef77d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208782, "uuid": "f6416ee9-b087-450b-948a-e123885589e9", "comment": "Malware payload (RemcosRAT)", "value": "1bd50faa3a761deff7f9b94efb42cac9ee9b074e5296ec721a089f34af9e972a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208782, "uuid": "ebb27ce8-dd40-4907-b531-668592a60aed", "comment": "Malware payload (RemcosRAT)", "value": "3a8301aeb54da9380eef272d59825c505a7ecc49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208782, "uuid": "08361b40-5838-4b5c-a6c1-860424d47e2f", "comment": "Malware payload (RemcosRAT)", "value": "2b2a46e5a21bf8b11d5c03c44d92c74b437c8f07a734de70e3f1a6c16af71b3bbb55230d10984440cae89f3b6876445f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208782, "uuid": "9cdc4afb-fcd8-4630-8810-9aeffd1d2de1", "value": "T1DF5501642796DD06C36D433158E5F17897B59E97B120C20ABEEE3D97BB2EF110A82343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208782, "uuid": "24752550-8b6d-4ddf-93b0-8fe3ca470b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208782, "uuid": "2b210e4a-d69d-47e8-a4d4-1d51f126220a", "value": "24576:CKSrMii7OCuCJZFqFJChgncP7g17XAmYYUWHSkyAN1xI5aO:CK2MiRCvZFq7nc817XAfY5zNsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772208782, "uuid": "2b4c77ef-67a3-4d9b-82ca-f305761d17d4", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772208782, "uuid": "7481e3a8-38c2-4e68-8593-24dfe3042b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208782, "uuid": "d4f58d91-9570-4795-8c6a-c3cc8d4c26b3", "value": "NOTEPAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c93eba-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216570, "uuid": "19d3a387-7455-426b-8a60-7613f2487cb6", "comment": "Malware payload", "value": "45cf075537717e1d4a80b40648179d03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216570, "uuid": "9303efa5-1f9a-4206-a7a4-cec9cb956eb7", "comment": "Malware payload", "value": "1dd57e1fd7f21f74a341b427f8056d43975a1d0114d6a602fa85f37cafcb9df9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216570, "uuid": "172f8a40-ae74-4fc3-b1c7-00f2d30a1108", "comment": "Malware payload", "value": "0093fc6e38c41b17bb624a9634b508a722a6d5f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216570, "uuid": "577a5d93-3352-4d3e-a1b3-243ecc55c8e6", "comment": "Malware payload", "value": "ee23e01cc53f9ee27abc46d08634c5e3a1150d5c8e30090757127f1d2498980aeed75995b48cd836b59949d0bac101bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216570, "uuid": "9ce65288-7673-4fb8-b277-cfeb278e4ce2", "value": "T1B6E329077AC2C9FFC4D7D1F44BEB95358932F82A1835715A67D0BE921F49EE02A1C260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216570, "uuid": "26745255-1ee1-49e5-a627-8d660ce49562", "value": "3072:Gaee/X6w0e1vrrv1l2gXJxkbeMkPoZjILu4FZ+q:3oGlg9V47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216570, "uuid": "8d3dd77c-28c9-4fa6-962d-f6f0124ee82a", "value": 144520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216570, "uuid": "1009bbd3-ee55-49fb-ae4b-5f420fcde9f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216570, "uuid": "be7cd4a1-3755-4cfc-a82b-d968d9385569", "value": "kirk.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef4284c-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772212241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212241, "uuid": "fa39fc14-5cbb-44a8-8d7c-f5468a032a14", "comment": "Malware payload (AsyncRAT)", "value": "7da951fc7eff3e8359b988e0d11a60ab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212241, "uuid": "0f4b91c6-cd18-4163-8e4a-9da215150885", "comment": "Malware payload (AsyncRAT)", "value": "1e05558a10316a1fde8e9d26da96ee0c57360e17cf4a79d18c477fd784ea2819", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212241, "uuid": "8435726e-aef7-4c43-843f-bf1ebfa269eb", "comment": "Malware payload (AsyncRAT)", "value": "b862070524c844e60de0a34317c31c9cc5436f60", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212241, "uuid": "672c31a7-4d1b-4b07-8615-19e65ef01f96", "comment": "Malware payload (AsyncRAT)", "value": "4503cc14052bbd7f6e30772d55d2b355cb680f16833a4145f71c656807c731eb54ea3e1bafd4d0464cb5a4001439dcb4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212241, "uuid": "eadccaba-db31-476f-8478-86251039013e", "value": "T18D3594584B370A8CE95D40AF9B21FDD14F3FC268EAD720766CE446DB98FAED5906C012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212241, "uuid": "65387e57-f71f-4d9f-89c9-e70353f37dcf", "value": "3072:XSAyoBQloRY8r1P3HL7+G3/qXjK+Xlfhbl+IGBcWet7+G17ioRYmgB++gkfxYSAx:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212241, "uuid": "59825dd4-cfe4-461a-b49b-91b9165a2344", "value": 1161581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212241, "uuid": "33fed591-daa8-41e7-bd48-fe24fc20dc7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212241, "uuid": "980f6f93-2754-40fb-b7a0-ad057114f0d7", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577b5980-139e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772170621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170621, "uuid": "87fa65c7-ec91-41c8-aa0f-28f6f49228e4", "comment": "Malware payload (AsyncRAT)", "value": "e8a1e32ecfa99c37dd88e468ca96f301", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170621, "uuid": "2b2ea353-86ae-4e9d-b6af-c01dd6610dea", "comment": "Malware payload (AsyncRAT)", "value": "1ed312146a83ff5751aaf5cc87a9c442fbf15c3ea2b20c18b26b47eb53bab3bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170621, "uuid": "d3e0915e-343f-4b40-bf6d-d0f98a5dcb89", "comment": "Malware payload (AsyncRAT)", "value": "de1f617c6d994837f7ed19116c9cd2195269a937", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170621, "uuid": "67558fac-618c-485b-8789-d78144683ed7", "comment": "Malware payload (AsyncRAT)", "value": "05e37920413970ee38c670d27dc359ed0519a14c7d511754af0dca1fee3ba9a97236c15285edf480e10489211d95199f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170621, "uuid": "87b59e14-2d91-4e98-b22e-f923645641dd", "value": "T1F1D24B09B3D88561E1FD57B94D7292048771EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170621, "uuid": "3315fa6f-6d30-4e40-b42b-e76d358ab6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170621, "uuid": "ab095a06-ef95-4c57-85b8-269e91b812d7", "value": "768:0wbRXxZb2uSEg/cIRGqom/Rb7fB/dTZ/+:vbRXvb2uSV1i4RbN/H/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772170621, "uuid": "3e87ea2a-a9b5-4b8f-9c65-35cb57df26e7", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772170621, "uuid": "23fa95ce-2350-48a9-b265-8b3cabfe82b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170621, "uuid": "7f91f6e7-f342-40d7-a0a2-c6a7bb5b7afb", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db91768d-1382-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772158817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158817, "uuid": "4c8e0abb-c981-49b4-bda5-d6fe3f95b971", "comment": "Malware payload (Mirai)", "value": "b9d397944038a0f04c2133a9a07a8c6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158817, "uuid": "6a336c8a-4290-4b8e-826a-a2838ef0236e", "comment": "Malware payload (Mirai)", "value": "1fb5455e76f075559d8bb914b486ea8e0b1b5ea3d0b68dd590f82285ac76848e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158817, "uuid": "b98eadad-a023-4faa-9563-53f92dd7d05b", "comment": "Malware payload (Mirai)", "value": "1bc743de6e20d0b5a7a62c6fcb0b930d0d9b993f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158817, "uuid": "d6740d63-8bdf-49df-9bc4-5a5318347464", "comment": "Malware payload (Mirai)", "value": "8b5784a33ed4b4c7b79999431770daf477944ce5276af10d227f814934325f9c96fe6a93508ec9f6bcfdcc3839ab6ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158817, "uuid": "99bbad8e-f727-4359-9623-5ecc76645ff7", "value": "T16EE31759FD819F05D5D126BAFB5E928A33231B7CE3EE7112DD205B25238A91B0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158817, "uuid": "330e06cf-9130-4bfc-90c4-1aa97aaf7b60", "value": "3072:tdJ4VSlLcTEZfbbikjaW6U3WrHKnygLffimW2DII7hE9Iuh/:+boBy8aWh3WrHKnNLf66Dd7hEWm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772158817, "uuid": "19e622aa-910e-4d50-b418-439017bab8cc", "value": 145260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772158817, "uuid": "9fe69dc0-ea09-4f82-8a80-4c6352e77e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158817, "uuid": "9fb91cc0-4761-4954-9cf0-bc32a035266e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbaeb47-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212962, "uuid": "5ed6666e-e1f1-4b11-86f0-2e9e96b87ca5", "comment": "Malware payload (Mirai)", "value": "8051f4d29c0ad38d5c72f63a82573b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212962, "uuid": "5ffbc064-2c09-4736-a669-17f459e884bd", "comment": "Malware payload (Mirai)", "value": "207b68228cfa2f053b0933489d2f315e993faddfc02f3152bc84482ac95328a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212962, "uuid": "191b5c95-5983-4e96-a0ed-2ae84dce5cb4", "comment": "Malware payload (Mirai)", "value": "022f5626eee8952c880da1fb46aa91f5e4144890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212962, "uuid": "cdc54081-790f-491f-ae63-75cd63953454", "comment": "Malware payload (Mirai)", "value": "43b0189a8f6c98c4fea7ee6331d0af812fdb3387eb3684b02a0f52d12ef39811d042dd9e2d4b7d82a9d036123a2a125d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212962, "uuid": "179b6388-31cf-4d74-93e2-47b5deeb04e2", "value": "T16633E15C81062869E028547ABBADCFB0AF330A666F17AD0D5A00D64658FE9F478D33CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212962, "uuid": "0f96afb7-5975-44c3-8f77-a1f1449c8f9d", "value": "768:+e+q02O2A4ESiCfFzRSSBhYCFxl71vwGBT8EKjs8x0CcUH0AUHxCBJgGlzDpbuRG:+V2O2A4ViCfFFqCFP7aG0joUUAUoVJu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212962, "uuid": "c75c2e7f-aef9-4955-b9cd-790491a79787", "value": 52864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212962, "uuid": "988f62cb-2eb2-483a-a0b4-8196f31b25f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212962, "uuid": "8b7fc9c2-d621-40e6-b7b6-8714b29002f0", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af59fb5-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179673, "uuid": "de66c3f7-f3e4-4d96-8bc7-c1fd2596769e", "comment": "Malware payload", "value": "5d60956bea461e5dcfd4f9e81226433e", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179673, "uuid": "7b7cb60f-ca63-4ee5-8802-71a80036c148", "comment": "Malware payload", "value": "219d9280b377b66b65b647e1e5cd62b96a8f58c75c50629adb5b249113c32764", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179673, "uuid": "76cd617d-a615-4f56-aa3e-e07ebc124839", "comment": "Malware payload", "value": "bbc312c46d4766ddc57b9a2c088e9b0382b9f7a2", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179673, "uuid": "19f1bea9-f2c8-447a-8ffb-c9dcaabb3ab4", "comment": "Malware payload", "value": "ef773e22803071abcb37afd63c76739c92a98773f1257e49da3cf56e71ff49aebe87af050b2655f4cf09e9c29f15dfc5", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179673, "uuid": "250c0b0b-2f7d-4592-a1ea-6d950faf4f0a", "value": "T1B7531A4677920AE2D5EE63F26877E2954236AC206F21A317E197D2090AF53C8E413FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179673, "uuid": "f564af0d-bcab-4e6b-9c06-b57a96db8c4a", "value": "ec069ebd72ac7b4ed1e77f372a9e69e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179673, "uuid": "da7eb95b-a72f-493f-adb4-752e81232a52", "value": "1536:yuaR1Ba8nLOKej2TO0Tz+7ztzvT0cyg6V83hpwM:auWg6UpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179673, "uuid": "998083bd-b7ad-44c0-be44-e3a9f5666f1d", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179673, "uuid": "99387e55-071a-4b1c-b189-9ca0d8b8c972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179673, "uuid": "63ee08c4-f4af-41e1-ba0f-5954dec4a79c", "value": "219d9280b377b66b65b647e1e5cd62b96a8f58c75c50629adb5b249113c32764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8b442c-1405-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772215061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215061, "uuid": "21a3c189-b2d7-46cc-b306-3c84f14d9a17", "comment": "Malware payload (LummaStealer)", "value": "cc4b92fae19c44f7115e7c8bda7cac70", "object_relation": "md5", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215061, "uuid": "7c929bf1-5ecc-47c1-a859-4e20eb56efd4", "comment": "Malware payload (LummaStealer)", "value": "21b19d07a414ad1ff7443c21c6530d1164c6c1eae56d3619a422d3f311b580b7", "object_relation": "sha256", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215061, "uuid": "324b912a-b3aa-4754-8682-c02bac2fb4fe", "comment": "Malware payload (LummaStealer)", "value": "2aa67cb6142373c7aec4d7278051d27c6cf3005f", "object_relation": "sha1", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215061, "uuid": "7d50bfa0-fe30-4152-b3d2-bf6d529dc991", "comment": "Malware payload (LummaStealer)", "value": "ca3f5a5a5f27b1b905b063e443e35c8b5eef3d89245960206e183bc5dae307f7f73676bf78bc5225efd6b3694bbcc3f4", "object_relation": "sha3-384", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215061, "uuid": "2164edb2-ae5f-48f3-b438-ff43588f5d1e", "value": "T152A66B41F98794F5EA03193155A7B32FA7346C028F36DBE7EB503F2AE8B72910936245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215061, "uuid": "92d792f2-5fe4-4ad9-a6c7-7213cfcd80da", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215061, "uuid": "273bd029-d8d7-4e60-9fe7-ded09f017524", "value": "98304:GU0HzdNWn749OJ8agmmSBJ4jivAEmKT8+leEXIwcTGFaMcNPTGTcl/eBGLW:aEnJ8amS3r5/TNXMGFaL7G+Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772215061, "uuid": "61020af6-c3e1-4937-bc8c-86275c812977", "value": 10378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772215061, "uuid": "e371ed47-ba50-416f-9389-4bddabb47c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215061, "uuid": "ea8b224c-2b37-4480-858e-7927a81159e8", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807367bc-1380-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772157805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157805, "uuid": "32422cd2-021b-4a6b-8cff-c094bc93148e", "comment": "Malware payload (SalatStealer)", "value": "f5a0da09d9e7d3b27363b5405e3c34c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157805, "uuid": "1bd8c570-aca9-4378-a3bd-c59a973aa55c", "comment": "Malware payload (SalatStealer)", "value": "21b449548aac1dbb684eab8c3dbe40da3ff9c6409a5405a3a46396fee5508bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157805, "uuid": "6cbbdd31-49e6-4d10-ac93-fffc8c50c522", "comment": "Malware payload (SalatStealer)", "value": "12c4c008525011240b4daa6d730e1adb439a67d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157805, "uuid": "7b470bd9-21ce-4c53-9066-b8f85254873e", "comment": "Malware payload (SalatStealer)", "value": "18208132031ae4a9af3ccec3357086caac9460ebaf52d7edf3aa4e0f6c44138a59f57188a6741a0d174ba9297536ff29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157805, "uuid": "a9f684f7-92c2-4312-b9ac-6e8170d8185e", "value": "T107C65A51FA8B68F5E9031831415BB23F63315E048B28DBDBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157805, "uuid": "4b3b6931-c643-4abc-b057-c97bcf257fc1", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157805, "uuid": "071ad8bd-c99f-48e1-9fe6-bbf894b20cfe", "value": "49152:lHVgzQb+WYSaZIogVhfUphwfueOVH0zwl8D+hap1yCNW+zZvDtQ5PBQkQkCjMmDx:JCzQbgZsiUp1m+zB/k1wZeXQ9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157805, "uuid": "30c42f53-5480-441f-b089-291991918259", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157805, "uuid": "1abc7400-c499-4fa7-8c2f-27a30fbb9548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157805, "uuid": "7633b4b9-cf28-4242-bb4d-2f3454e67f33", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27847335-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213061, "uuid": "8f4a858b-ddae-4cf1-b760-69220a9ff00a", "comment": "Malware payload (Mirai)", "value": "affcab0e8b2852d0a2cc8941b93971a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213061, "uuid": "677462ac-6997-4385-a018-d137640c22b3", "comment": "Malware payload (Mirai)", "value": "22324a4668a4ea501afe17ca77eacbdae52af598e1aade7774b1f89d272f6f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213061, "uuid": "e1a9c9c1-b928-4e05-915d-95ac19ab7834", "comment": "Malware payload (Mirai)", "value": "1eee916377b4e3c9f9d0509a7a0bbfa3e8e400ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213061, "uuid": "5b9b7712-a0d7-4c7c-8a45-ade9bd9a7569", "comment": "Malware payload (Mirai)", "value": "8164749e32cf7776cf64f1d1a83a1f081201e4adc582bd9bed2347c98a65bff4827a256a7bfb39895bc859a0cba89e44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213061, "uuid": "7e0ef53e-6951-4166-960a-34099bdf31e2", "value": "T1CBD3F746F8819B12D5C515BAFE1E124E37231B78E2DE73029D24AF31778A9BB0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213061, "uuid": "856d741a-f646-4c81-9ebd-55debd8ac183", "value": "3072:GNNde+YkGsIWQX6Ne5P50s4E/HpNa612szV:4de+Y9sMX55Pn4E/HpNa6RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213061, "uuid": "c622737a-029a-4468-a30e-5a3771bcbe99", "value": 142844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213061, "uuid": "6536c127-3065-4ca3-82a3-7006a59eb821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213061, "uuid": "c51b48b3-eaf4-453b-a4fe-8b08c3876e1e", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a4da2d-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223928, "uuid": "645d3d23-9d15-4950-8b3d-17e56ca324d6", "comment": "Malware payload (Mirai)", "value": "4c0527689a5d8167a6d7a71e30d72112", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223928, "uuid": "efcd3ee5-66b8-4663-b6d3-8af26edc2576", "comment": "Malware payload (Mirai)", "value": "2266c4ea514e9f185ebf7ddae4361e8183fc2c555f09584e348e26a1a4510fe1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223928, "uuid": "f2b4dd14-00c8-4490-90a5-c52c5c83dc4c", "comment": "Malware payload (Mirai)", "value": "45eb0ccc7c0106c05bc7ed52b7f3e88810b64db4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223928, "uuid": "aa44461b-3da6-4a1e-bcb0-5600d6b76a00", "comment": "Malware payload (Mirai)", "value": "338faa814adb6ff172eb0b198fe3b99ade7252551afd9f3e9c9606d36d49d2ee9aa51a1b9ec1d24d4a00cc7ef19dc964", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223928, "uuid": "c8b79216-9912-4a62-9b37-3a8f4aa8ba32", "value": "T1755197DB62A1093559627617FFB9CE3CB6C8409738EAAF04A4FC34B5568CDC87848A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223928, "uuid": "4bb9d522-188a-465c-9d82-a51e361b25e4", "value": "48:io7hmVoNnE7oQCX0oMePgoaZazvZSoafaFvjko9N39z4geDopjczoASvaLojZjzx:iKmV+E7EX0QPg1gzvZS1yFvjkWzz4ZDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223928, "uuid": "95010fbf-a9de-4de3-8080-dad97cc2d074", "value": 3034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223928, "uuid": "a16094bb-9aef-4715-9061-cdb6274ca042", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223928, "uuid": "dbd55b2f-16e8-4064-83a6-2e6fd7d4ee16", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2624341-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772224005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224005, "uuid": "36fb106f-70a5-4dee-89c2-5994af236acd", "comment": "Malware payload (Mirai)", "value": "791c2e2c3e5ef21ca3c0cfc5a34f91bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224005, "uuid": "3f08937f-3ba2-4ecb-ba6e-740c94218c17", "comment": "Malware payload (Mirai)", "value": "226a84e242a9f2ca2ad9a92576448ec87564da0c61e223e8b8681360b1e4099b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224005, "uuid": "aa9d38b6-bf46-4f2d-becc-6d4bfeae7908", "comment": "Malware payload (Mirai)", "value": "2f207be37ee203ae76bd734745d40e813e59597d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224005, "uuid": "4675ae09-2187-4405-bee1-2195c29b2de9", "comment": "Malware payload (Mirai)", "value": "87634944ee9554bb035284d28edc1ab101ea14dc1662ed8e885c431c61981c897b7ee894d323d626f98163ec6c18efb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224005, "uuid": "0c323003-e7eb-4495-9b93-4d50fcf8f448", "value": "T11AA3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224005, "uuid": "20b65425-4a88-4bb9-9a01-9600fbd08663", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwje2NY0:lZzTJa1rZ62yqPy/ULWzje2NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772224005, "uuid": "b874a04e-c056-4641-80e7-0f2e2d3e265b", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772224005, "uuid": "300018bc-9811-4671-99d6-dc5e27d58b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224005, "uuid": "d666f322-abfe-4c54-b064-f0c47f7d030e", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91071e3c-13b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772180596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180596, "uuid": "976401d8-a8b5-4fe3-a284-d4d77573b926", "comment": "Malware payload (Vidar)", "value": "318d7fef2e959476c5fe199716b97d9c", "object_relation": "md5", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180596, "uuid": "9314fdb6-6a3a-47dd-92ac-33427ff17f48", "comment": "Malware payload (Vidar)", "value": "22b165bcac09ae6033ad71038128a62b29ca787d5a51ebab926f016b7926f84e", "object_relation": "sha256", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180596, "uuid": "5941e15c-2c00-4229-a991-85e6ed4300e8", "comment": "Malware payload (Vidar)", "value": "86c06740e0b15aabfcbfaeaeee7b3493f0745e8d", "object_relation": "sha1", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180596, "uuid": "69dd3245-2c1d-4394-b51e-cb16f774d689", "comment": "Malware payload (Vidar)", "value": "32849a18b584f0d276b795f22a183dbf4682e6b227790479cbe9133790aeaf574f18fc99dd0328716e447b9254c9d950", "object_relation": "sha3-384", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180596, "uuid": "df5ce42a-b6ef-4a0b-9356-82f488db08dc", "value": "T182B633C4A3B897756F74B816C203FBE74745B2568A353C696357320613C39AA0CB1FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180596, "uuid": "bbb6f237-7f97-4a1c-84ce-52c49323c85d", "value": "196608:mvk3WpC+HInEgtOtXaeN11ouofyBbbMUcw+xfnZ1YiGNfxDKzkeQjDMo:m8mbHIEsOv1sUchxWiGNfpCkeQ3Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772180596, "uuid": "c27623df-aaf6-47a9-9b65-865e0ddb0999", "value": 11308266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772180596, "uuid": "8dd0e290-db02-4917-af55-22d71956c2fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180596, "uuid": "dcc769fc-9c5a-45b7-bc99-da6cabd5f714", "value": "Ev[3]-Bop0[t]2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51809914-1403-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213991, "uuid": "255d9057-2f68-4714-a0f5-0baf652d17f9", "comment": "Malware payload (Mirai)", "value": "5051e38fc1c0e9d439a68685cbe91c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213991, "uuid": "325d36d0-c670-442e-8b4c-0d63d01cf7ff", "comment": "Malware payload (Mirai)", "value": "22ee3747383e44a4061648f48fe955d3df0410db1ae90eec5c582cbda4a88c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213991, "uuid": "79939e94-7f23-4ea7-9385-65e3087152f9", "comment": "Malware payload (Mirai)", "value": "85fe564de21f9511ae8ffd626c8cdea3646bac69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213991, "uuid": "a5264abc-1b77-4ae4-a764-306c3e4c80b4", "comment": "Malware payload (Mirai)", "value": "95c610caccb2ddc4a7d795570c370462fd443891b58ca85e9e241c69c2631255215a049d424490e233600cc3e2cd07f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213991, "uuid": "8f23e91a-19b6-45e4-b611-60995c2401a5", "value": "T150E34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213991, "uuid": "dcbcbf1a-bd8c-407d-bc4a-8004cc3bdefa", "value": "3072:8NMcOPLZDozjYnfoHwreWu1gSa0lI7TEy6KuImkq:IOBozjYfoHWuOSa5F6K4kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213991, "uuid": "4ebb6b00-c9cc-42fe-b51f-65d7c343f6b9", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213991, "uuid": "0ecf288e-601e-44bd-a312-55c0b7d49cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213991, "uuid": "9931c002-4613-4ea8-9592-7d59587d65f9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7970fd3-137e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772157119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157119, "uuid": "dd6a75a2-a70e-4079-a361-f3cd2f726e5f", "comment": "Malware payload (Mirai)", "value": "3ca6781edd7644082f3b53ac696f8a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157119, "uuid": "a433a44b-2875-4d45-9e7e-bb9cd4a76b2b", "comment": "Malware payload (Mirai)", "value": "2365493d0b4a6284d5b638176a29e2f736e30a64053a9081ebb8e23877e85f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157119, "uuid": "57099e01-e525-46df-a99d-9d0d02fa6135", "comment": "Malware payload (Mirai)", "value": "06c167e68e68c5c1b73839c539fc4998c65df161", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157119, "uuid": "13c80662-6670-4625-bfa6-b7f5559e27e8", "comment": "Malware payload (Mirai)", "value": "094a66464f7af5699bf3566a5221aef36074d84fd0ee0681118e8bf5b12d9c323e3a8e0369777237a5ad0fc329108ea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157119, "uuid": "6970a3cf-f819-4e55-830f-e84694d6f277", "value": "T166D35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89651F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157119, "uuid": "8c5fcc3a-bed4-4e8f-bfdf-55895f2dba4c", "value": "3072:CV0zui1ZhMHJ6A+qrFP7OUK3y0uMg9FkUH:LP1YO857OUKC0uMg3kUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157119, "uuid": "d88aea76-d5a5-4cf9-bfec-c238b1dd999c", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157119, "uuid": "9444865a-d4c8-438d-bcf2-bf5b4815de7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157119, "uuid": "bf64a97c-50c8-45b6-8387-eeb88e8a1a0d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827bd71d-13e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772202476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202476, "uuid": "e07b5acc-b349-4112-94db-7e7237abfb6c", "comment": "Malware payload", "value": "50b3206339f7b3cbe2d6985184539778", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202476, "uuid": "4d09080b-643d-42ff-a774-5c872727f56b", "comment": "Malware payload", "value": "23748d838edf43ebf1312bcafd9ea7d616b651a9dc323fc5d5aba5ee3d494dc7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202476, "uuid": "dcd55b62-3e2c-446a-b4fc-6a0115a91d61", "comment": "Malware payload", "value": "661b9b99b157a3de68ce2f0527c0edaf70178631", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202476, "uuid": "e25c4ff0-722d-44de-bdec-86714af01733", "comment": "Malware payload", "value": "c32f1844d20407df5b5adc576597ea8b14b112869966401ac7f07c9d811a4af257b550b2a9d98eca81428c7755cce2d1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202476, "uuid": "c7dda99e-d8b1-445f-8ac1-b6e9279dd49d", "value": "T10EF1D16B21F08B71D3D421C9526656A54E71A74B992A08B8F4BF933ADF2C90334E3F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202476, "uuid": "32a5fb64-e7da-4854-aa36-4d53433b2be0", "value": "96:cCusB6n7sht+O+v1fsn+h4+tIicqbA/GsGqZ4BPqaF:cCuI6nC4hvZ5mzjHOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202476, "uuid": "34e2ad0b-6e59-4b53-b9cd-7dc3fd8138e7", "value": 7506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202476, "uuid": "9ad04677-3cb7-4c42-9342-7302af8147dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202476, "uuid": "2d389118-65ed-4582-aa82-daeaf4b19887", "value": "23748d838edf43ebf1312bcafd9ea7d616b651a9dc323fc5d5aba5ee3d494dc7.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28dd9bc5-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175268, "uuid": "dfa8a65f-c424-4fc0-a420-a93307ec5897", "comment": "Malware payload", "value": "9c40b2bfc2b7cfa85c773fa202c48676", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175268, "uuid": "db3344cc-324a-423f-9605-79b269bee578", "comment": "Malware payload", "value": "251ae8ada8f8224a371ca01a32b1f3cddcc143b800da3be065b88422097ccb93", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175268, "uuid": "cdae2ca6-2fac-4618-8b17-37a7060381a2", "comment": "Malware payload", "value": "291d0d287a442d3c84d4d6313312c0f4668529f0", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175268, "uuid": "a2d8f633-e670-43bb-9051-fc152da348f7", "comment": "Malware payload", "value": "7a5806af94758c970ac3031d95a17f7decb37d48d5b3d7b7f11d58c28dee7d199500d08ad01e707f39ec6f0fdbfb653b", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175268, "uuid": "12189698-9b2b-413a-89a6-7ec18c8cbb37", "value": "T145A633AFF253CBEA8444ADE247F403650EC74EE5F56BC47B0AAD017A19C708A9CB1749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175268, "uuid": "81a7a167-4608-4b99-84f2-2245a3976b86", "value": "196608:bL3SszDzHjUOVwriMw9PZ2AcweS6ARWh5Qy6oX/xOo6:bL3SGrjpVsiMePZn2WRWvtB/wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175268, "uuid": "eec8cd62-70af-48cb-bc0c-7246aabb99e7", "value": 9563408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175268, "uuid": "7388fe07-2ec3-4083-ab6b-05d8ded31b40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175268, "uuid": "62218cd3-a53c-4c80-8def-1faea38a6291", "value": "251ae8ada8f8224a371ca01a32b1f3cddcc143b800da3be065b88422097ccb93.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb5251c-13e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772200371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200371, "uuid": "763ae89e-0a09-4cae-a77f-2c84cd248431", "comment": "Malware payload (Mirai)", "value": "d1287edc497f8c1c4568b005fb9caf9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200371, "uuid": "3e15ea73-db69-4003-b6be-8f423c64570f", "comment": "Malware payload (Mirai)", "value": "259d6ea8fb8c69589f81f211712d4905fe7fa9ccc4f3d1b6f4f73e50a3bad2fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200371, "uuid": "f9abd834-75ba-4b0f-aa09-63741df141b1", "comment": "Malware payload (Mirai)", "value": "62d5b3060b66c8182f8912f34b1a2a193d144bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200371, "uuid": "ff5b3c58-c3d8-4124-9499-e2dc748bc843", "comment": "Malware payload (Mirai)", "value": "5e39a49aa1a11e3027192c2e6ca26ad0e6434636c643a305fffc657301e35d5cf932a641ced3a7b906ee4dd99168f04c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200371, "uuid": "2ac71312-f774-429c-af6d-73c02054d257", "value": "T1D6F329D7F801DEBDF80AE73A48570905B630B7E210825B372257797BED3A0991963EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200371, "uuid": "a98fd55e-b937-405d-be26-9ab03af9f62b", "value": "3072:XnyYMuKkHYHKqyDuj0ezT6wWol8t726Vxjbi6LepCWlrK:iYK9yDc0ezTpW372+L+lrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200371, "uuid": "7369ea78-4925-4d84-a182-ca9fd795fcaa", "value": 163616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200371, "uuid": "71dc8da2-1507-4a10-9a3b-e7178fd95897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200371, "uuid": "7a93f682-95f1-4fec-ba74-4bed372e4506", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1bdd27-139c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772169931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169931, "uuid": "9358018d-8233-4898-be78-7ce7146cadca", "comment": "Malware payload", "value": "71ffc45de1b20afa7ea805363fd6a875", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169931, "uuid": "44227ef6-c660-4ab3-8ca3-d5141d53325a", "comment": "Malware payload", "value": "273e1b62d3782e610890ad9ca69ab7afa99e108b63eb41b0e455bc23630f4b68", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169931, "uuid": "d69fb73b-bba6-40b1-af7e-80c77314553a", "comment": "Malware payload", "value": "a02b335ffe6c99454ae08de1dfdb38efec22c690", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169931, "uuid": "3a375029-f28c-42d1-bb22-9906410c09f0", "comment": "Malware payload", "value": "b059fc4cb38ad76458d145f77995f5aed0746ad4999107eb9aad6a3d64d3bd4d2e5ac98dc3b5226c4b8db91eb66ad312", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169931, "uuid": "2683caf9-4314-4c75-b5b2-4a63459d5f4a", "value": "T1C0B5335172F8C0FCF8681A3101459B622A3AAE111B3585C3FFAC3D9592B36D7D9363CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169931, "uuid": "16fba604-a684-4633-883e-b2acffd273a8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169931, "uuid": "3cba15a1-1ab5-4aad-b54e-5fdc9a7b789b", "value": "49152:IgwRSbll6MeivssIUvFoOere1vPlIulCJDnk5ihQIup2T:IgwRSbL6MeivsmiOse1UJQ58yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772169931, "uuid": "9bd98eb0-5040-4c08-9db7-8c4b6e696a40", "value": 2353737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772169931, "uuid": "49189af3-0feb-41eb-8dad-c62f298a1b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169931, "uuid": "f65aa1d4-81e5-4ef6-a45a-aa39943e2423", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e59d52-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213037, "uuid": "a1c89bed-135f-4c74-9a66-eb7c685d5b18", "comment": "Malware payload (Mirai)", "value": "955c13fb6d3dce1189e9ea1474ebdca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213037, "uuid": "fff1a29a-dedd-42f5-ac21-0cde3dca1985", "comment": "Malware payload (Mirai)", "value": "275293b2d3203e529b435087798b4c5f385da1ac8d3f7ec8f9a6b0ceae07ba57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213037, "uuid": "b27ce4e6-93c4-4341-9862-b0d152c645b7", "comment": "Malware payload (Mirai)", "value": "24b11c6560f01cf52609f38940b830e4271f9501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213037, "uuid": "8dda464a-f597-49c3-91ec-b2f483fb2184", "comment": "Malware payload (Mirai)", "value": "a1a9c6f8de11d88a6e7ddf200b643eb53ac27e1bf316d055b3a6920bdb90cd9db1cd999b5a6b056692b2b0bd26295ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213037, "uuid": "5d638571-39a8-4a3c-830e-e789c8cb3eab", "value": "T1C5A34985FA83C2F6D81704306062B73FC731CDA580B9DA5ADB9A5E35CA37541C7263B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213037, "uuid": "3a13fe85-6cdf-4350-86c7-7a3c8d028dfd", "value": "1536:/+xr9S54MRhZQ3jfHxRy36iZJvaAH4AWkSjIyIE:/+xrMmwQTHxc6iZJ94tjjIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213037, "uuid": "46697381-db07-489b-bd6a-5c6b84bf18bd", "value": 97768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213037, "uuid": "5f6e0d29-812c-4e11-beb6-e89fa4fbcb6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213037, "uuid": "da1d0ff9-2efc-4f20-bc6c-550c0874c989", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61db4195-13e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199415, "uuid": "dfce19b4-42d8-4560-8c4a-701d724cde64", "comment": "Malware payload", "value": "df2516bc442d559b89096fd5897c3663", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199415, "uuid": "134ce90b-33cf-406f-97e2-e5dda727a016", "comment": "Malware payload", "value": "27fd5db9838f020878d3bb243051f291cede135e8e83a4087216d8be2c0299f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199415, "uuid": "092f633f-631e-4180-98d4-0a4996ee5c2f", "comment": "Malware payload", "value": "96a7d728e4dba9efe77ad0851297da43ba6773be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199415, "uuid": "4fee0589-76b8-4492-8635-a8282551a7d0", "comment": "Malware payload", "value": "e4dee43c80896cfc0dd4b43f1b546c1025bec418a3f814ee3b8e251c4b8644b7fce696ad30e47d9d5cd556ff243fa657", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199415, "uuid": "cdcc6d0d-8e7c-4550-a484-b091c005c154", "value": "T11B12443B21F08732D3C410CA53A65A654E72A70B852614B5F4FEA33AAF2C90731E7B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199415, "uuid": "0814c325-69bc-4122-b495-0fe88d74f208", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvj2Cp+is:cCul4hvZ5m5FG4j4HKNpivu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199415, "uuid": "a61f822c-5801-47cc-b80d-114cf76faca2", "value": 9770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199415, "uuid": "b10b9783-23a4-4f64-a2d9-e62b07a64898", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199415, "uuid": "1bd26e91-d8f8-4398-bdfa-e686277047f6", "value": "27fd5db9838f020878d3bb243051f291cede135e8e83a4087216d8be2c0299f0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ee9311-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213240, "uuid": "fb77e2d9-6573-4c2b-b411-8a0db2951bbd", "comment": "Malware payload (Mirai)", "value": "a33af7289f28b71559d31b4df3501f47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213240, "uuid": "598a7817-2e25-4866-908f-ace687a346cc", "comment": "Malware payload (Mirai)", "value": "2807ea5cc6216798f5f2f9e3261297981ac44ca0fd964f9a9c242ac4e13cccd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213240, "uuid": "ac008861-d864-416d-b068-08532121ef02", "comment": "Malware payload (Mirai)", "value": "be6ed716a8af3e87be8f68bcb1852c605ddab16a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213240, "uuid": "47370cb2-6126-4556-9fb3-77364620bfdf", "comment": "Malware payload (Mirai)", "value": "c209f931e3b7594d58cca7312a84c7bbc68adae1c2c57c9f29c3d4695bc9c17f096929dda834e48b73df75734c035b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213240, "uuid": "d6a2c3e6-970f-43fa-b38e-a728b256d705", "value": "T14DE31A45F8505B23C6D612BBFB5E428D372A17E8D3EF720399216F25378686B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213240, "uuid": "3730b8d3-c1cc-4316-994f-69796bc34a51", "value": "3072:3ITEs7uvApUlWnF46r/b9l5n5CYp7G7Wz:3ITyvq66F46Tb9Hn5zNVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213240, "uuid": "befa57df-a59a-488b-aead-71da5d52960c", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213240, "uuid": "275c0cc4-3909-4cc2-99ea-66b88d5b5c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213240, "uuid": "6172b8e0-a65f-45af-b03f-c9d9ed58fc9d", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedf05b7-137c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772156219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156219, "uuid": "47d77d08-50a5-42f9-bcca-7e86a78d7e86", "comment": "Malware payload (Mirai)", "value": "d29b31a438680957e2a235b31316daff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156219, "uuid": "a3feeae4-1c98-4762-8cc7-14b2be67efc5", "comment": "Malware payload (Mirai)", "value": "285ea81bb79444e62b38fff9bd8b001f66228cf75f71b045543fc1df86beb490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156219, "uuid": "fa3fbc19-1b2b-4f3c-a37c-fdb2df2d7642", "comment": "Malware payload (Mirai)", "value": "7703d0ee63d1eb7bbe98ba145f395fb3774bf3ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156219, "uuid": "8f022236-6700-4924-962a-ec8aa4afcd5d", "comment": "Malware payload (Mirai)", "value": "6f24b7d30a4d30056fae7b953b39d6b0d451999a0152b11092cc1a6ed03815b6257b587d4ebf3b193bd3a178cd4b2704", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156219, "uuid": "2807061a-f85b-4e4d-be37-efdf0f8632dc", "value": "T197E35D96F802DE7EFC0BE5BE44670D19F931A3A13243072E529BFDA3AC311961D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156219, "uuid": "8442c859-b85c-4f70-9490-e141ecf27773", "value": "3072:tamyNhgeKdgPa1CTf2gnCx4iUb7d19THHHipu4:4qeKdgiWnsMd19zipu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772156219, "uuid": "e7fc0049-a028-44ee-b79e-1eea59a1d30d", "value": 146892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772156219, "uuid": "97f50e08-2411-4887-8252-635ce9881c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156219, "uuid": "b0769ed7-99fa-46ea-8fa0-4e86f54e8c34", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319836ff-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213078, "uuid": "bc54927c-3826-4a8a-bda8-533ebaf3c742", "comment": "Malware payload (Mirai)", "value": "1c433863fdaeca927125c8dc4e6a9f05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213078, "uuid": "469de227-c209-4f4d-aff7-137d17314434", "comment": "Malware payload (Mirai)", "value": "290b9a5b6e1e381f837c7a2f4cd573fd5babef8ca0e54871a90760174269e0a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213078, "uuid": "811fbe90-3d56-4d96-81ed-487d9acfbd26", "comment": "Malware payload (Mirai)", "value": "8cfbb470c50b3b922640cd45c75cee897d4446d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213078, "uuid": "b22783bf-70d5-4bb5-8b4e-7de3b7af2687", "comment": "Malware payload (Mirai)", "value": "6bfc2e503c9221907f00876e10a253f39c9bb2a345c60efa07bcb0fb6998d865395c273e5dcf0192476fbdbe57cc31f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213078, "uuid": "6be32d1b-1757-4633-95f3-0e179d495754", "value": "T174D33905734C0C47D2673EF4363F27D193AFDA8222A8EA41254F9A8E9172E731589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213078, "uuid": "fc8052e6-45a0-4b25-83c0-6c23c2296679", "value": "1536:qP6Sx2AJ3YxzKLdKy8KfGvAsgC5n7xaVhLJHOqpfWCXtkjh:qiSx2AJ3YxqK/KnsI/FDqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213078, "uuid": "f7306b01-f643-4764-af16-32d54c3efd3d", "value": 131380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213078, "uuid": "3a06686f-2401-456e-a4a7-70164d42356c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213078, "uuid": "fedc423e-c6cf-48eb-815d-e3c5def300a8", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442edaf5-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176172, "uuid": "5978720c-b168-48e7-940d-e2db6949f0a7", "comment": "Malware payload", "value": "fd3d187ca666bd3714587e714b37401d", "object_relation": "md5", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176172, "uuid": "57fdd06b-7da2-4763-a804-e200ef241a31", "comment": "Malware payload", "value": "29fa7d6eed8ebfe382c2fbb8941dc4d8a661712650f542981d047ee37f0e1aa6", "object_relation": "sha256", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176172, "uuid": "0ff42987-ce36-4c4e-a632-7a451b889689", "comment": "Malware payload", "value": "95c5df7b936d54ef16746e3caf76a64cc779a519", "object_relation": "sha1", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176172, "uuid": "8bb310c4-4d6e-43a9-88af-2883aa28951a", "comment": "Malware payload", "value": "b59a093337b4819c076d8e434fa960510f90994c5cf8a961afe867cd7e65a46693fcf1c79353e2137f3181b4786690d0", "object_relation": "sha3-384", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176172, "uuid": "eae5c9f3-6e79-4667-9732-443a0d747c15", "value": "T1273180004AF69214B2B35E04A9FF54D248277ABEAE76CB0C0045C14E17B3A44DCB7F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176172, "uuid": "3fcb218c-d180-4b46-bb66-638be90ca5b0", "value": "48:ZsAldNvuITb9//hPDJRWRrSkqdOgo15owzQNVL:ZsQPN1//hPDed4dexk3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176172, "uuid": "f4651f28-1e0e-44c9-9152-7012674f1060", "value": 1686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176172, "uuid": "229b56e2-76cf-45db-b7df-92c9ba9857e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176172, "uuid": "a0c61094-a1f2-46bc-b629-4a6843182996", "value": "rrkdp_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565a4e15-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176632, "uuid": "efd2e340-6fd0-4f8f-b98b-153903f9d293", "comment": "Malware payload", "value": "39c4822a380fcdfbd8f880c419045684", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176632, "uuid": "e9f7d11f-6bbc-4b88-aefb-6ce609cc3b83", "comment": "Malware payload", "value": "2a1820bdd74e28205ff6887cffdabdacfb231508ffab96c7d475376b31c334da", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176632, "uuid": "6719ff22-b4a8-4c24-9e82-0f71e98527c0", "comment": "Malware payload", "value": "52fd9eb51aef5b65aed8cf73ee582071d384c867", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176632, "uuid": "84912af4-a683-4144-aa56-194bd9027940", "comment": "Malware payload", "value": "ef47c17f743bf217c01e5f544327d44e3a278c1b0651ad3aeef5d895f88f74ac722e15ad7dd9ccd42bcf1092674c23a5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176632, "uuid": "bb40b905-3609-4f93-a867-747e69ded3ac", "value": "T1E0C1460057E99608B6F36F05AABFA055497BBE5EAE36DB0C0049C14E03F2A50C967F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176632, "uuid": "70570141-c29a-4e83-8380-75d976aaa93d", "value": "96:zyEBs5sZ5+fO5WAyFwFiODpAhsZ5FHAhmx1hoVxCR6hH3HA4+hJGxDDDFqsaTZCg:zye8f1qFicgmxzoVc6h+uVDB4x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176632, "uuid": "be602fd5-6145-4f53-9b8b-1bdca5f76a2d", "value": 5834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176632, "uuid": "98420338-4116-4abc-a67c-7a068e10a0f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176632, "uuid": "66f8951f-5195-4f9b-ad0e-575fec31f497", "value": "2a1820bdd74e28205ff6887cffdabdacfb231508ffab96c7d475376b31c334da.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71233ebb-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223922, "uuid": "41d29fc8-7072-42fc-a5d3-b02d0d208ab3", "comment": "Malware payload (Mirai)", "value": "0ff6a720486a14beaa49777dc7658bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223922, "uuid": "52e9e720-0c2c-4da8-8753-60b1832a9474", "comment": "Malware payload (Mirai)", "value": "2b4ac7e737a9c2e22c5d10e3d9773ae52fbe7e91dd4dddc793cacee9c2d97303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223922, "uuid": "584e0b30-ad91-4352-85f6-2df279771141", "comment": "Malware payload (Mirai)", "value": "13caae94f2ea447c660e04a7b9a2221a3581ce2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223922, "uuid": "a39c3e2e-4199-4fed-93d3-ab813f78e7f0", "comment": "Malware payload (Mirai)", "value": "54021d238004e982baf9e188eccd1fe530ddece5730d7eef57b257f062507625daa35d9a150018270b4c3c7a29bcd859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223922, "uuid": "2edb0961-ad53-49e4-8412-1d84ad5bff7c", "value": "T198F2F151E8EDDB41ED5E967A08EC7C051C20932C1FBED4FB9A88293C1EF1F463A19496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223922, "uuid": "39333daa-2b01-4a66-a1d2-4dcadd9a8bb3", "value": "768:49JFwkShNFPuB87BgQXD8X8YSpJrA+MAvReT0nmIqN4znbcuyD7UHQRjb:8wkQvDUn0rAywT0nmI4inouy8Hyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223922, "uuid": "8059e431-cc41-4187-88b5-44832e8786e3", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223922, "uuid": "d52afeba-911b-41cb-96a5-8c962c89b07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223922, "uuid": "d0d8d41a-4012-4b02-94bf-163a695dcac1", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7c80db-13b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772182176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182176, "uuid": "b327377c-8209-4606-84ba-28c70a7adc17", "comment": "Malware payload", "value": "f525bd11bce35aba7214286d34152335", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182176, "uuid": "391360fb-47e1-49ed-af32-74d1f568b3a2", "comment": "Malware payload", "value": "2b654efe975b48090dde223a41fa2f9ff2b09b80fcf700a2ef49b7aa6c5c48b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182176, "uuid": "e2e196dc-8ddf-4ab0-b991-0c4c6ad420b1", "comment": "Malware payload", "value": "ff5ac6097de58a796b2c524cc3c33af0a845616b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182176, "uuid": "6844e731-53f2-41c1-96f5-459a2e611ec6", "comment": "Malware payload", "value": "f92dd200ec1104403ab582eedb9570ef7b6154fe89b3d45ed34f763b07e60521d0915384185614f5e56f5a9cd717592f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182176, "uuid": "cf6f0f32-8e8b-4dd8-b9ef-532e1933ce75", "value": "T1A4925CB512896C79FBD1CE399F3C6F4DADE8C2C42124A3ACBA4F39205A1166DC70535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182176, "uuid": "3496c950-c682-40af-a8fe-5c7e802f62cf", "value": "384:R2cuQpWx+BL0SWL0g0zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:R28i+BL0SI0bzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182176, "uuid": "c3f08663-9ade-4ba6-b72d-83d0542c7984", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182176, "uuid": "ee188a9d-c6a8-4457-adc8-73b7b8ca24a3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182176, "uuid": "445526c2-322e-46a5-a71f-917ccb7483a8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2b91ac-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176617, "uuid": "549236f2-0e59-4d05-9726-5fcc0f9aa525", "comment": "Malware payload", "value": "987299f393e09387e961d854ba329ffb", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176617, "uuid": "5f1abea1-26ea-463e-b229-1486de68a81f", "comment": "Malware payload", "value": "2ba750f03d7abf45e1c1dfe44fda280f02eaa478041c7b9201a3234ce9760485", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176617, "uuid": "f63a5f82-6016-4526-8a50-ce06fef192ce", "comment": "Malware payload", "value": "48173847315eebc931b6f0ac95a6aee0407c4a86", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176617, "uuid": "eb90e2bc-87a3-4a8c-b675-8196b6bb90ba", "comment": "Malware payload", "value": "0f2ec1a4149de353aaab448e56068d7de00a77d076a9e495c97a864de91adec48b92b38eba33d5d51b71786f8585b2c0", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176617, "uuid": "951af29d-7e8b-4c48-9ed6-e4763eced19a", "value": "T1B9F2BC1A758E920870B34B8C57AF12754B6F7A5E0E7D408A42CDEACD8FE35019C967B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176617, "uuid": "36828aa5-b1a1-42f2-8ebd-58fd291e0e31", "value": "384:vj9p3wAnjWjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhj4jjcfYEdIa4QQPYcf:xp3wAJcfYEdp4QYYc+MHLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176617, "uuid": "a262996b-a0c2-48b9-ad40-74c6bb73a6e7", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176617, "uuid": "54a41fdb-0141-44c1-ab03-bfe8b1afe161", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176617, "uuid": "bbb9b26d-6eef-4cb0-bbb9-93d0462ef52b", "value": "2ba750f03d7abf45e1c1dfe44fda280f02eaa478041c7b9201a3234ce9760485.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a439152-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772210596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210596, "uuid": "9273549e-7d4a-4ae7-a73e-5f0d0b006fea", "comment": "Malware payload (GoToResolve)", "value": "1d27eeba4e06a175f5292ade1c00cba5", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210596, "uuid": "e042bd76-1df3-4e08-968d-7d3206db1f71", "comment": "Malware payload (GoToResolve)", "value": "2c223853deec24258e623a88c9fb3995e3cc6022683b1495477ee533cb3a5ff2", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210596, "uuid": "a89ef8a5-8d8a-43fa-acd7-316b5c0b4410", "comment": "Malware payload (GoToResolve)", "value": "5975601bca36a903b9f09c67c4274c9be562f8c7", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210596, "uuid": "fcc6b7e0-2a7f-41cf-8859-00c3cd2f085b", "comment": "Malware payload (GoToResolve)", "value": "f6c69bffe93e229259ba1d7f2020bd5a8c4cdb06ae0339caf59f76db8557763038905adce4594370932e117f233da42f", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210596, "uuid": "0b39c85c-4dc1-4117-aca1-68d61b417c48", "value": "T1F43733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210596, "uuid": "af7002a5-9a9e-4e84-9fe4-ca8298b3fd98", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210596, "uuid": "bb4440fe-2e53-4422-8342-1c1f2f2f701e", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210596, "uuid": "30cceb03-91aa-448b-8888-de8719dbe85a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210596, "uuid": "0b8af316-0bc6-4599-9074-e34933c3dd84", "value": "SSA_Statement_pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a648a0ca-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772212415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212415, "uuid": "8f19f4b1-d249-4cb8-ae45-28f2b0025f6b", "comment": "Malware payload (njrat)", "value": "de26a947074e2f8774bd2d6b4b709e49", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212415, "uuid": "c8207257-fd6c-4880-aa6f-50d2c0515aa8", "comment": "Malware payload (njrat)", "value": "2c3759ec7cb73677a3033b6974a57e4cd2757a56a28d6a8d0ea387cb6101d006", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212415, "uuid": "bcac29ae-e099-4170-a54d-c55b3a84114b", "comment": "Malware payload (njrat)", "value": "da90d548dd800171a43defeef013ec187a014cac", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212415, "uuid": "9873c5d5-8b36-4929-a870-f594d99b08b7", "comment": "Malware payload (njrat)", "value": "3f06076abcc2cfacb2e0a8103cb4caade84d08b0e7372217d8ee9c42c872585f69383c214c1c377f0f6c4b1bf8727c3a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212415, "uuid": "21cff265-ac1a-46a0-b35d-ba7635ee1581", "value": "T12DC46C483C883CD0AB3C0C5BB5255B8DB76447A6328A33A9FD1BED152BC37115B9E6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212415, "uuid": "c352f40b-2cc4-4bab-9ad3-ee78ace217fa", "value": "12288:SqegkMTxHd7xKAgztVofxLRUFghh0QtBkScM3Udhzele3TaCSS:SqegkM1d7Qqoghh0EHcM3UXzele3TaCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212415, "uuid": "14dfebd5-ab71-4a9e-9ba3-5985381cfdc9", "value": 548806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212415, "uuid": "476969da-4899-416f-a681-3d9c6a00e170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212415, "uuid": "e289fb9e-c06f-4bd5-8ec3-a596baa3a59d", "value": "ACCOUNT SOA JAN-FEB 2026.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095bff20-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209575, "uuid": "8db093c6-4a4c-4023-9241-158700a4e9f1", "comment": "Malware payload (Mirai)", "value": "9af261ec97f5c22e3f717b8d5b200154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209575, "uuid": "122c4259-4a11-4b74-91c5-6ec06eeb8ec9", "comment": "Malware payload (Mirai)", "value": "2dc7e93530172624227487f380cbb00841c45c609b1e6cc6c6444585f0907cad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209575, "uuid": "ea8a5448-d841-4952-910f-bee17ebd165a", "comment": "Malware payload (Mirai)", "value": "da0080bd7338617273ef2144217cef6e1881f868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209575, "uuid": "d1952334-b19d-44e0-9d36-c99a57d614b3", "comment": "Malware payload (Mirai)", "value": "4faaa524f537dcccd05e656edb9177de954a6e0464e148bd0753961e4073922875bc31872b60c3aba3c579ba233dfaab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209575, "uuid": "399f6a11-0008-4f5e-b852-b4f2f5b46fcb", "value": "T1DE14961E6E228F7DF668873447B78E25975C23D627E1D641E2ACC2105F6028E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209575, "uuid": "81a6df8e-1137-4b2f-9bca-09ed8fc549c8", "value": "3072:3c2nXadriWZ+2fLLTwMif6md0gM3eDBilA+OEuoz:s2XgZ/fsMo6eMSBp+OEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209575, "uuid": "45f0fbc3-1dfe-4ec8-af14-392638246a49", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209575, "uuid": "d9052abc-d5d8-469f-817c-9395962a5a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209575, "uuid": "2ea26e66-7fd8-41b5-95d4-9d6b07d7027b", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447cc14e-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176602, "uuid": "d009102d-348d-4966-8506-502f47ba9e70", "comment": "Malware payload", "value": "b1282a3eca06117f28c1135969d5adae", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176602, "uuid": "140f5057-85f8-44a8-b931-dfaa427bb3bf", "comment": "Malware payload", "value": "2df22c410a4517d699160ed70b9698f5ccd79b161a577b57a9c75ac651b2d91e", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176602, "uuid": "d4d2e6c9-7852-4d0b-903e-24fc86fc2035", "comment": "Malware payload", "value": "aa5741eb90c04ed36888119d7f12b4705d8d9621", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176602, "uuid": "4cabb2ad-4e6a-482d-b821-086bdf0716a6", "comment": "Malware payload", "value": "65f64aad49515a7ed65c5500f4a295940f49c0d73c0628af4d9129e06f042e8f8b29aca8d010a55cb2cb5724c2f5f373", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176602, "uuid": "292616c7-6b08-4067-afd7-1056469ba172", "value": "T110F2A116729E860870B3874A469F07354B6F7E6E1E3E819940CDEA8A8FD34149D4B3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176602, "uuid": "eca91b2c-a9d1-48ac-ad1b-96943b9068d3", "value": "384:rlX9p3WAHXIXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXuXd1iYEdIa4QauIwSt:rp3WAH1iYEdp4QzIwSM0CU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176602, "uuid": "1540d9ea-8144-4974-8149-ea2db9f32a66", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176602, "uuid": "da2bb364-1132-4d59-95b2-82cf25befb6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176602, "uuid": "8dfae1d5-e037-4294-ab9b-ae87c20bcdf5", "value": "2df22c410a4517d699160ed70b9698f5ccd79b161a577b57a9c75ac651b2d91e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7662c63f-13f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772205892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205892, "uuid": "7b9e2f94-856a-428e-aacc-a0990c7120f4", "comment": "Malware payload (Mirai)", "value": "28e9fb19929dd03046e1b139a4649be9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205892, "uuid": "baad6a23-aef4-48f0-a0ce-f2332b6c4573", "comment": "Malware payload (Mirai)", "value": "2e01be1aef977c22fb0f1a88d6ca90a1d7e6707bc5067deba0d7b0fc651b6841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205892, "uuid": "a9994cac-2ea0-4fae-8072-d62abd2ca138", "comment": "Malware payload (Mirai)", "value": "8ef47f3d53d187796a272f73419b9a9cbd458356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205892, "uuid": "a5be2794-d444-42be-a91b-48622f8491b4", "comment": "Malware payload (Mirai)", "value": "14b1ec936bc3155542fff8a0bc725f0756332dc4a76247a8e20987d47f6c9b70507b6bd9c8566e99d985c8e16f58db7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205892, "uuid": "e9d854b8-e55a-4174-963b-08d5f4a8713a", "value": "T163E31A45B8405B23C6D622BBFB5E42CD372A17E8D3EF720399216F21378695B0D3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205892, "uuid": "5f952639-db6b-4ef2-809e-32a7d6a61b3e", "value": "1536:e451+mp2YK6lmoTu9mbMAF3vWMf338uApPm4VKpraTWzqsN/OVCOk8q2lEWKr+g+:e451NtyEFOwn8ub4mG2qsN2zsWMBMLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772205892, "uuid": "f7ec31b0-daa9-45f8-b04d-58f202c43517", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772205892, "uuid": "615fef4e-31c5-4c24-a658-0cee8908948b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205892, "uuid": "f41d65fa-1c6e-4d10-b3dd-0df52dd96a93", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288cf566-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "982647af-54ae-4a1e-823b-625ef6f08cb6", "comment": "Malware payload", "value": "dd959bb9445d6dabc71d0c5518377c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "98cd5333-d782-4cef-8aaf-0544c3442c30", "comment": "Malware payload", "value": "2e568fc6ee57c5226bdefc6c08e60837b5f51e3525b807c3bb05512be510f973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "9bdb5282-fdf6-4fab-952d-d15277036a84", "comment": "Malware payload", "value": "981000d610789cd663d962eb634b5bb60047fde4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "e3b95130-6cd1-4c51-b0bf-6d539bb91bb1", "comment": "Malware payload", "value": "79138fdca590e05dcf191efdc53daf6abddda259cb1685c0f794e3990a4bd3e353dda249095e94e024b65a19dc059a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "4582fd50-cb89-45ec-850d-c938484c6f03", "value": "T101A5173EADA119E5C06A82B1DCA6C1717A37B949073E23F31E4275B46E727D2983F704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "6af68b15-b942-405f-8a63-9f26fe09fd5d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "52e88a09-c182-4a5c-ae80-6be864eca367", "value": "24576:obVbplyHhpBS8pHt34qoDrBJ5XEUOrB1rtP6Rb+/AFsO:obVdlyHhpBSW3SD9EUOrB1oiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210486, "uuid": "680a9679-dd55-4da6-944b-a005ef9c1957", "value": 2172416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210486, "uuid": "531363d5-bbd4-48ce-b532-fb52fa40b8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "10705e54-f1e9-4376-8146-51d7e39f9846", "value": "dd959bb9445d6dabc71d0c5518377c95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45858b3c-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772210534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210534, "uuid": "fa099800-dc61-421e-9d2c-530d09692e80", "comment": "Malware payload (GoToResolve)", "value": "24f01989bb4610c083f89cfc4ac4bd80", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210534, "uuid": "55a46d90-f53e-41db-a8e5-f8b3317e4ed7", "comment": "Malware payload (GoToResolve)", "value": "2e863949ec50b1bdef0eacbcacb8a8adddcf1b02b74c2f3f5e221bdd9b6a075a", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210534, "uuid": "5206af74-a7b4-4760-a4ba-cb1b6cc05560", "comment": "Malware payload (GoToResolve)", "value": "73f869077f9ee102df38308754fb601ed70ec857", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210534, "uuid": "78d7d201-85c1-4545-8682-93cec0f80016", "comment": "Malware payload (GoToResolve)", "value": "82b3dc41ff8fd11506c372b464a6b90fd55aaf740cf57c57820be6d751e1a5dcdaeb26ce9a2e080cb21c03b6f68d3dc1", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210534, "uuid": "913706f6-1ae0-40c0-9f38-bf05a1c932eb", "value": "T1C73733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210534, "uuid": "5851f1b7-e746-46e2-a6c4-6f232c8c697b", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210534, "uuid": "595ce172-cd84-4033-a21b-a4e53372a490", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210534, "uuid": "666c4300-ca97-47fd-9842-79d5547d7bce", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210534, "uuid": "cdd10709-37fa-4651-9372-4291d6d32a99", "value": "SSA ADMIN_STATEMENT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6b803f-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213073, "uuid": "4830bac8-d0a0-4862-a3cd-87c11cfd6f03", "comment": "Malware payload (Mirai)", "value": "74fe6c8a04812d885743c5f0d9c4a571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213073, "uuid": "4f25390b-c533-4993-a4a0-e0601ba36ccd", "comment": "Malware payload (Mirai)", "value": "2fa43bf865d19616a4935f13764fb8945ed42c5f2c6a00061f81a537045aa1b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213073, "uuid": "e2a751be-c13c-4980-8c5a-48dfae421754", "comment": "Malware payload (Mirai)", "value": "1c254a355aba350bf361659d7e82ead6c654e330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213073, "uuid": "5b46271d-30e5-43d2-8ec2-0c5ea47bd7c3", "comment": "Malware payload (Mirai)", "value": "7cfa7facf438410bb6dd76a858940795e15ce6c182a6ea2b374f6deefe4dbaee586e18009a78e7f536bcd0f57c193409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213073, "uuid": "b82c357c-cb30-4dbb-96a5-311e2479f33c", "value": "T1F5D31907B98080FDC8E9C1784BFEB136D932B5AD127CB10B2784BE366A5DE205F6D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213073, "uuid": "660bb61b-420e-4a0f-ade9-1d23a48c451c", "value": "3072:rYXHEf0qgdHT/pqCxhQJfxc0Zi2u0M3QMoF:rYnzJx+60u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213073, "uuid": "0495eb72-8184-4a5e-a479-073a3ce14a9e", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213073, "uuid": "45212fa9-7e4e-42f2-8779-297a311e14f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213073, "uuid": "2992c258-b757-4e21-9ee0-c7f237d027b1", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a7a05d-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179146, "uuid": "bf2980c4-ef4d-46d0-a953-2ea22d1b8a7d", "comment": "Malware payload", "value": "4d963241296a0b5ae8d59aac9b02cc00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179146, "uuid": "b9131c2a-4a7d-464d-93d2-2ad6c0216013", "comment": "Malware payload", "value": "30bde4508556de4942081b7e16f320c638a7744efe602ad160b700e3575f585b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179146, "uuid": "60d0e899-7372-4045-ad75-33283519e2ae", "comment": "Malware payload", "value": "ba6d7b8aa6f6d0847f65fcd5e512e785731c9c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179146, "uuid": "a9365c61-36c0-46db-87ab-db155a75c1a0", "comment": "Malware payload", "value": "e32cafddf1d365101fc295ced929a634f5648b310b0b51e9a6c3d597fa90495b4e412c2d94e36c6c7d32a8ce94ce85c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179146, "uuid": "f3cb1cb5-176d-4598-9244-540e1250b80d", "value": "T1419723D755E9B2F4C0C34A08A18E518E65C094FEC9FE5A5C1DCB8C031A55EAF4A8DBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179146, "uuid": "d5996cfd-0570-4d84-9906-15e4236a0221", "value": "935f401fbefe56e6277c13307758a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179146, "uuid": "97022dd7-6df6-4f05-8d04-e1b42b249c36", "value": "786432:eC1vTUSriZ9EXzunaMVXoLymeo5YA9pFgixoiCJky4snkrXF:nBUSmZ9EAaMuLymeo5TxoiQAGkDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179146, "uuid": "8d2e3976-8f3a-4c4f-b7d9-7a551a35c02a", "value": 39984640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179146, "uuid": "19179a64-4814-4f1e-abd2-3c70ef10ffc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179146, "uuid": "0d4fffa4-a028-4c95-9f7c-1e19eb8abc05", "value": "erto3e4rortoergn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7705ecce-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223932, "uuid": "5a47605c-fad7-43ab-ace1-2b0722317ddd", "comment": "Malware payload (Mirai)", "value": "95177445be877bd09bcbff1422064783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223932, "uuid": "8bccc1a9-f43a-4879-8548-d36a4d2bf8a5", "comment": "Malware payload (Mirai)", "value": "30fe8dbe6f822877e7285b66409c67c68d023869095250706384651f33849b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223932, "uuid": "1878e74e-23b9-4e74-828b-dc9687099726", "comment": "Malware payload (Mirai)", "value": "f17e5bf0fd106d01d09794979a988eb2b9df71cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223932, "uuid": "7ed1dbf3-a4e5-4bf0-b01d-faabb923cb44", "comment": "Malware payload (Mirai)", "value": "f824cb19d7fe77b1f665aeb79bd067e8c430efa42447fb62072c2890f400c64603a2133b1618b84d3d2417fb5f99f673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223932, "uuid": "618342db-1237-4f52-982d-f01039395938", "value": "T1F5F2E030F544288ADEAA9C391CC5D6C57BE19FB633482FE16BC14F05590EC2AE456ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223932, "uuid": "2c33fdc4-631e-4ea0-9390-02135517aaa4", "value": "768:a7160aX0xrq5uHZEUZxhIvTyWKeB/STQO4uVcqgw09m:a7160akRou5EoxqyChsR4u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223932, "uuid": "f78bd4ef-a5ca-43b7-bbc8-1cee6694c31c", "value": 35108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223932, "uuid": "7170650e-8aeb-43a2-980b-abcdeedfa505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223932, "uuid": "bcc20ecb-61fb-4464-a92f-f7c6b7d63272", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c303ad40-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772176815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176815, "uuid": "5e59fee5-74a6-4c9b-93e0-42d14153661d", "comment": "Malware payload (DCRat)", "value": "334f81f5c8ce81ddfca31e52c6d00dd2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176815, "uuid": "9768a763-927f-4d8b-8922-5b71bc2e40dc", "comment": "Malware payload (DCRat)", "value": "3186698e3af625ef3df72536eac6243530cef5c5481c94bfe6af138c42b1daee", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176815, "uuid": "0c231c1b-2e4d-4f04-8700-be6d5dc49805", "comment": "Malware payload (DCRat)", "value": "69390a898edfdfa33a6b44779e8edebf7956fce7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176815, "uuid": "0b7f7860-af25-4e81-9df5-50104303e203", "comment": "Malware payload (DCRat)", "value": "f1a93029b5d3ace46aac334335825c8923e488d8eb2c2116096c6a67bcfdbf3d23dfa791c1cc7124827af1076cb55d7c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176815, "uuid": "539ca66f-5ba4-4eff-8d53-9495ce83356f", "value": "T187758C017E44C912F0191633C2BF454847B9A9512BA6E32FBEB9376E59523E37C1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176815, "uuid": "41506d85-490f-4ce9-b5db-d3373f498033", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176815, "uuid": "37ccf3af-06de-47b0-8f41-4df3f8f844b8", "value": "24576:C2G/nvxW3WJvyF6aI1/+GBT69ME945WExrG5oihx0X2g3JQUTJfeJcQ1HO:CbA3Yn/JxEeh0U2mTTJg7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176815, "uuid": "1684d496-0ee5-4024-a95c-effd35af2b3a", "value": 1595548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176815, "uuid": "bc2a9bcd-7485-484e-aa2b-e2feaa0c315d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176815, "uuid": "944cd1cd-6c54-4463-bff5-1201cae8b2a9", "value": "334F81F5C8CE81DDFCA31E52C6D00DD2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44637040-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212251, "uuid": "0cda64c2-0e62-4c96-bc05-39d5ed93c268", "comment": "Malware payload", "value": "71fd3ac315d068ae633b5502bbf4deeb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212251, "uuid": "e47092a8-67df-419a-a731-dd585e38cd28", "comment": "Malware payload", "value": "319038845f65376dec8e0b3c7a01aa7a3c6fcd056443d27a30a2d3e89831c364", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212251, "uuid": "3332b3f5-a3ff-4a13-8c26-ed9fd71ba272", "comment": "Malware payload", "value": "07695f20480c866f5a921edec52f122ba5316794", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212251, "uuid": "0f7de84a-00b4-4c33-98a3-ae14eef66bfb", "comment": "Malware payload", "value": "71d20dbb7bf0673a8fe860457a21a9ec2a315459cf3f02b9fa8abba3a5195350e1a63543b4fe2d6342b782174dba56df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212251, "uuid": "8e35b938-280a-4c39-a320-ec623162b9bf", "value": "T180351762FAD14474D6318268A3EBF241FC70AE693B58E4CDFD9CC98BA640ECB465DD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212251, "uuid": "084d05fd-d2a8-4c5a-aaff-4ad8133f36e2", "value": "1536:gS5cuoiXrMB31M5r8rr5lgA7hXR9yRbsl3auE:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212251, "uuid": "9e5b7144-dde8-4bef-9ac2-686cfdf97f38", "value": 1160400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212251, "uuid": "d9404dec-03cb-4ee4-9430-5747909d612e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212251, "uuid": "e036add1-7dc0-47ba-aac7-faa7ef7d2918", "value": "71fd3ac315d068ae633b5502bbf4deeb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea7032e-13e7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772202014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202014, "uuid": "a526abc4-826c-4023-b123-c1e7a237e773", "comment": "Malware payload (AsyncRAT)", "value": "68f9ac2efdeb32296e7893e7a0434179", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202014, "uuid": "c85ef3bb-afcc-441f-99a0-2468ab40ff76", "comment": "Malware payload (AsyncRAT)", "value": "32eae37358a55c6b67ea3cc23a05b201d734bed442a90cd5c475eabbf1730255", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202014, "uuid": "bba4cbc8-0043-4c8b-bdb7-15b0dc561192", "comment": "Malware payload (AsyncRAT)", "value": "6ee2d66181b6fb1f1345be0d63a4fe5f3f3d2b01", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202014, "uuid": "cc95a321-58d7-42b7-abdc-bf1c67564531", "comment": "Malware payload (AsyncRAT)", "value": "28358929cbee7e230b11e75f2ce2124638115011e45da18465ee9cd2f8edf4b112d02f98afd5980383bb84dd02fef95a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202014, "uuid": "bf2f99e5-e1d3-4760-ba9a-f6876a6e1c8f", "value": "T12A132C003BEDD127F27D5BB859F2624586B9E6737603E64A2C8411D60A13BC6CB427FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202014, "uuid": "1a2b0d0f-8645-406f-99b5-318e03173edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202014, "uuid": "ffd5b20b-eb99-4d62-af44-6fd4d1bc76f4", "value": "768:OJ8R1g64bIaUAFlmGfITKKKjibH0XzM2rR5w4GladEFL26iuf+:fCF5f/40XzRzsadEUzuf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202014, "uuid": "7f2578e8-8559-48aa-8bd8-969b05eb100a", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202014, "uuid": "41a89b1e-00c4-407c-9d9f-bbb6a36ee152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202014, "uuid": "144d0f7d-2451-433e-be9a-ca0aa7393f81", "value": "fad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d367b50-13ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772203380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203380, "uuid": "1e35804c-7f91-4063-b756-d4e2dbfc3a93", "comment": "Malware payload (Mirai)", "value": "c46a81d52047c679cca99086e5e18976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203380, "uuid": "510c5f97-5611-44b6-84ae-d432cf10aab0", "comment": "Malware payload (Mirai)", "value": "32fa31787e5542daa134b8a3e14cc276a09f15750b3cc7db07968a179d5ae550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203380, "uuid": "0f36f6e2-8f53-453b-8c0b-fe5e8772f57f", "comment": "Malware payload (Mirai)", "value": "bd8767b38d0acb55b47080d794755ebe436faf10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203380, "uuid": "bbebdef6-5ec8-4d58-8d01-5733f4d26a84", "comment": "Malware payload (Mirai)", "value": "754d7ecc3c34a097535d829fa8b85558392f7f2a474474ee02be8cf96e7bb7bb205ef33c0e7f756a555faa7c7319637c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203380, "uuid": "9ed69c12-07f1-40ea-8ffa-e6b4f140f214", "value": "T156E35D96F802DE7EFC0BE5BE44670D19F931A3A13243072E529BFDA3AC711961D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203380, "uuid": "ed66dde2-4a4d-425a-a44f-a56f5cc3edc2", "value": "3072:tamyNhgeKdgPM1CTf2gnCx4iUb7d19THHHip24:4qeKdgUWnsMd19zip24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203380, "uuid": "4ca1e8c9-0349-4780-a614-4720aabc8f38", "value": 146892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203380, "uuid": "0117237c-caa4-4dc1-9e45-5af32e809d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203380, "uuid": "5272374a-7740-4891-849d-a30cc18f3f14", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da0d24e-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772211058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211058, "uuid": "39029510-c3cc-424d-9069-36ed6e2cf44f", "comment": "Malware payload", "value": "f9b3471716c91e9fbdf4e0beea66dfe7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211058, "uuid": "61e427dd-c310-4aef-bd55-b81e4d30710c", "comment": "Malware payload", "value": "3416630d9f1b395646e93fac23f25e727713404f49ef302697bbd1d70fb2838c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211058, "uuid": "d2e65ba1-f9e7-4a6e-bdf3-7e46c2bc7269", "comment": "Malware payload", "value": "06049dc4dc67038ce3856b68fb4ada5f452294c5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211058, "uuid": "0663d3ce-ac2d-4d3c-8700-6f4a542e56ec", "comment": "Malware payload", "value": "ba50f04f8a9022d34aa0690c2ef8e53f7320cd9488373eedd28ce10b53523927b1a695498ae3c6bd6f0dc26dab677e6d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211058, "uuid": "d8a9f95f-fc19-459f-8e58-84c6271e8751", "value": "T1E1D502FB98B2A9435A504663EB0F2C1A339B29D53754D306EA11909C7F3B1D38E92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211058, "uuid": "5148d684-64a5-4f7a-8b42-4007cf201dea", "value": "49152:5Oc2yD4lTP3MWOxHGImqrHTvlPn38qroHu1FGpg6rAmxuFUYCYxRIl+Abk:5oyEFP318cqp/3DAu18g6ryFUPYGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211058, "uuid": "267190cb-70f7-45d4-9b20-bd6650876ac4", "value": 2972156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211058, "uuid": "3a4c4de6-9a23-4cce-93be-ad76bbac6c31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211058, "uuid": "155ab25a-1394-4142-b7f2-295dffd5729c", "value": "Purchase Order Bulk TJX 775210.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0bbfea-13bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772184722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772184722, "uuid": "63dbf6f4-df32-48ca-88f1-4c2f3a101536", "comment": "Malware payload", "value": "d2d1cd2f323fba58d98107ac4d998939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772184722, "uuid": "4e21ddba-185a-4770-a791-226d6939537a", "comment": "Malware payload", "value": "34a3a030d178596f4c711d0f0a1318f00508e5602d625a38aee12a52cdfb9d29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772184722, "uuid": "5b494bf6-52b2-484b-86af-80062adb07da", "comment": "Malware payload", "value": "7972c46219d78e58418d74efae000dcf1326e86d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772184722, "uuid": "c391b992-829b-45d7-a00f-fd5180e033c6", "comment": "Malware payload", "value": "daf2db51a89cba9fdb6909e5c84d71719f69b33d909998a55a57f436593cfafcf0da516bc9330633ac0f9c07e647e3d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772184722, "uuid": "aa4e26b7-e30f-4f99-9980-520a74b53559", "value": "T184A7BF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772184722, "uuid": "af1de914-4130-44b9-9850-a6172d125471", "value": "f0486e7e054aa57188c99b0f71783b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772184722, "uuid": "b43e4820-5cfe-4590-b993-6eb477e84deb", "value": "786432:R3on1HvSzxAMNLFZArYsXLEfpPv9B7OZyf5KI8:RYn1HvSpNLXmXLENz/H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772184722, "uuid": "dd80901b-725f-4877-ae10-91486d4b9a4d", "value": 44980472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772184722, "uuid": "04702f84-b2f3-41e2-ba20-ec6b468e8871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772184722, "uuid": "7d6864b9-73f4-4c0e-97c9-a8ec6a5de989", "value": "Xtc Sab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c9ec2d-13a8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772174934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174934, "uuid": "df2d46ba-6fa2-48b6-912c-868d79d17a6e", "comment": "Malware payload (RemcosRAT)", "value": "d4ee87e780ce7e6e5d536377be12c810", "object_relation": "md5", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174934, "uuid": "c22e301c-a33a-4fc0-a875-ae7401bed86f", "comment": "Malware payload (RemcosRAT)", "value": "34c8bb04d2cc46bb1d88dc701487801546392fbc9c37908fd09d8ca6cb426c4c", "object_relation": "sha256", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174934, "uuid": "a15915ea-e4e5-45eb-bb65-f19854b64053", "comment": "Malware payload (RemcosRAT)", "value": "4dfd5ef0291b34f5a801ff6cd97d59d5f81085a9", "object_relation": "sha1", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174934, "uuid": "71dfeb30-3385-4491-8c60-466bb73fc4da", "comment": "Malware payload (RemcosRAT)", "value": "65fce48d9c40789c3622310094d2f07aab490da6664f5755e5ed6272caef9b2cb867f70e79ec4f555c1d83ffab3a5cfd", "object_relation": "sha3-384", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174934, "uuid": "89c513b2-4803-4bb5-80f6-0579726f598b", "value": "T15CF20D197643241E5BEF5572E37D2849BAEAB942DA0494FE55FC1FCCCD9EB2702A3008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174934, "uuid": "c9a7d4f4-5164-4272-9bad-513e9a72503a", "value": "384:7uPJFc77smNxX+MLpb3aFSqNskMMvEoyadX54GSSog6O7:KPJFcNc1OjNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772174934, "uuid": "250293c1-4e5d-41f1-882c-3a204e0540ed", "value": 34419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772174934, "uuid": "e5f67da7-91f0-44b7-82c1-690bd193b651", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174934, "uuid": "5fad5064-8575-4f38-9536-b0aec2b5938e", "value": "SOSTENER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b463bb48-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772211150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211150, "uuid": "6b3fe569-ff07-46b2-a4b1-ac307fc286bc", "comment": "Malware payload (Formbook)", "value": "1e7dab72d509f79416412dc3a5c6582a", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211150, "uuid": "376cd777-ee0f-4662-997c-547523093c95", "comment": "Malware payload (Formbook)", "value": "3573fe242daee1830e59a88e35db104d4568151ac54febaabe7246db0c6b189b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211150, "uuid": "b5e22190-b4f8-4551-b398-4233f1030140", "comment": "Malware payload (Formbook)", "value": "2fdf6b03b33dff67a01afb0dfb83a44fa9d62b49", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211150, "uuid": "475cda69-893f-467c-b0b9-f69772256574", "comment": "Malware payload (Formbook)", "value": "e074fc02a8493c78efd4c2b42d52cfc34b5e4c9692ef433ca7c7f532d29950c7a1e5df58adac8426910c70238753a292", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211150, "uuid": "fc5b4ac0-d232-4b77-b856-3f79f4206330", "value": "T143D4223B1AD03E3EE42D46B7A6433DB0B5468D07C2B0346516171BCC9C6A92F9A592FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211150, "uuid": "54456cde-7295-4034-b428-a33449ab1115", "value": "12288:Hktl/NXlQBkUK1DvgdjqVVHDQJJZKKOoIUDZyvOJFu8LZGpm1/aYQStIdum2gPAz:ix6k71D4hkVHMBKKZDIvs5Mim2gPuWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211150, "uuid": "799af0ce-04b5-4e46-8da0-cecd15250c30", "value": 634837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211150, "uuid": "2845010d-0fa2-413b-8212-e57e340b7b96", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211150, "uuid": "3427aad8-8a46-447a-9e3f-ad9f441354a9", "value": "AR Invoice 7480803.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8647c721-13e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201194, "uuid": "2fc298a4-4754-4652-b567-d8326bedbb44", "comment": "Malware payload", "value": "f9d37ff23362e38a484df813a1d83f69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201194, "uuid": "9b43bc8d-e358-4933-868b-ce34c252e7d6", "comment": "Malware payload", "value": "35d90455526e0bd9326933f0c907a38d6780727ddcbd4516e29253d66d08abbf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201194, "uuid": "146b1aa1-cf2b-4f23-a9a6-b31705bfb6b8", "comment": "Malware payload", "value": "306eb5e302e992fa64c79fb6f9023471cebd3a3c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201194, "uuid": "d772ea69-4ad4-477d-aaaf-78e8d77e95ac", "comment": "Malware payload", "value": "f03ea75bc6702bfac65c1a5af51c51fbfe45e80a135eac2be1329de2d3a8d76a12e352b153a6a2e052b0540f51ba8f30", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201194, "uuid": "69bf3f08-6c59-4c37-b1b7-fcdb18e8777b", "value": "T148626C7621F04A335B9065C4A33717915FB2A61744A720E8F4FE1E359F5AB03B0FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201194, "uuid": "cd941954-24fa-402c-8973-e169bca411e9", "value": "192:cCu/K6nC4hvZ5mzj7V7jiDDDM79E44+TUO:+C4hvZ5mzjB7joDg79E4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201194, "uuid": "b6c022dc-8e73-4028-8d76-3c92383e4225", "value": 14688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201194, "uuid": "c25857d0-c179-405e-afaa-a1a3753e0611", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201194, "uuid": "21e7f4ad-14cc-4323-8bde-2ab74c9d0c42", "value": "35d90455526e0bd9326933f0c907a38d6780727ddcbd4516e29253d66d08abbf.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269dd8e6-13c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772188149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188149, "uuid": "dc8ca2e6-2b4e-4765-8118-6bbbb4ec3da3", "comment": "Malware payload", "value": "690d7c8018b8dc14efc22f52f3c3d0ae", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188149, "uuid": "71911a46-8a76-46ec-adb5-f50f81e39209", "comment": "Malware payload", "value": "365d1b01cd5e605f6e7d39b192aaf56040176f2bce6eaec0fc11584850793a83", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188149, "uuid": "45cee6f8-610a-47aa-ab06-75710b090a90", "comment": "Malware payload", "value": "b8ed0237a3938c4722a4f725e7a80d54b9246a27", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188149, "uuid": "91725955-b1ce-468f-af93-8f6bb0c929ce", "comment": "Malware payload", "value": "07d8c4357bd42e175b33721b42ceaf876f9e644eaba74c9571e7a8572c4567c175f046fee489fbaa62ede0d0c2d46db4", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188149, "uuid": "40b9da16-51a8-4cc7-998e-f69d2a664022", "value": "T176B423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188149, "uuid": "b47292af-e301-4dec-88d1-ca85b5422522", "value": "12288:7GRl4nbDDGIabs/7iiEVwYg2l3/2NHyy+wK8K:DTabs/7iiWw0KtxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772188149, "uuid": "2a3b066f-65a7-499e-bfd4-39ea49469f20", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772188149, "uuid": "7dc92897-a156-4113-b460-5f3c7936aab0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188149, "uuid": "b259613c-de53-4564-a37d-4d9f0e2a45a5", "value": "cracked-annotator-webpage-extension-2.1-beta.4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdcd17f-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223940, "uuid": "0b376065-f6b3-4781-9d18-a2157dfd875e", "comment": "Malware payload (Mirai)", "value": "3e8d9ecf95b1817e8fe4ccececee27cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223940, "uuid": "11ac61ea-edc9-4cfd-83fc-f79b242680ec", "comment": "Malware payload (Mirai)", "value": "385adb28f2f541476f4f91b70afb58f9b32744c560a932b23fb1f9b1822d752d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223940, "uuid": "f6e9c39b-93bb-491d-8db0-6f6f8e139e68", "comment": "Malware payload (Mirai)", "value": "509a87d5df9229b823a31d6ba2605676c194a8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223940, "uuid": "b70c4e3b-8693-4de1-b50a-e73f559e213a", "comment": "Malware payload (Mirai)", "value": "88ae44e2045304e5a2608fe908572e4505ec0e0c7d4e7dd3a2d9cfce237d9a712ad917fcf4e63fa525fa2528e9b605e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223940, "uuid": "4d3a1511-761d-479e-80b0-d7d18d1b8c6a", "value": "T1C983198BF801DD7EF80FD6B74463490EB930E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223940, "uuid": "f944ce70-1d73-42e0-bc01-fb6a218d5467", "value": "1536:XQOjxmw2V2xAYV8aSlslcjYAht8f489k0rTUhrIpu1HT7ot4O9I/nPahD:XQO4QEpdht8fsnrCupQ9I/PahD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223940, "uuid": "40adf086-f83e-4d6a-a4be-5c1c4f736756", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223940, "uuid": "8d0b4a5b-400c-4365-a5a7-7ca6b99dc2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223940, "uuid": "37b98d76-7b9a-4d2c-b475-0b16deea8cf9", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8a2207-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216745, "uuid": "1749d07d-8848-40eb-a797-1e16aaa2f679", "comment": "Malware payload", "value": "eac0a9db902fad163ac49bfe9f608423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216745, "uuid": "6f0bff0c-36cb-4cb5-aea2-fc94e564bda8", "comment": "Malware payload", "value": "38ca0b41a0444c83aaee5d5be55b3087bbf06bec139effe17d9f998ec8c14a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216745, "uuid": "bd21e683-19e0-4cd3-a5be-3b83714781a0", "comment": "Malware payload", "value": "cf030bc7fab2663fcb9ca35cdffb7a1ab8b33729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216745, "uuid": "dc7f67c6-9fc4-492e-af6e-b6a2d4607c79", "comment": "Malware payload", "value": "f14d8eb017be8cfeb003a762edbaecd7f742fe23778030432c978645177efdf3d3b8025536ea84b53cbaca61c04d2537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216745, "uuid": "c73038c6-8c84-4a43-ba95-578803fdb18a", "value": "T1A6B58C0BBDD448E5D46E937688B722827B31FC580B3223D31A847A792E737E46D76718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216745, "uuid": "4b692f49-d744-48dd-b282-1ee3d656c0c3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216745, "uuid": "7919d23b-4ef6-4e5b-b209-862019143281", "value": "49152:EYfA8ga5ag/fppevzFx8UFLdt3/5owT7gOU0gBjqxj1TeOXKg7v:EYhvtrwoh0gCjN1Kg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216745, "uuid": "e7e7a8ae-4fea-48d4-b177-6b68b8592b80", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216745, "uuid": "346ae8c3-e2f4-45d9-8486-111b8c6585a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216745, "uuid": "a121c838-4234-4395-87c9-9deaacdf4677", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c455d5ef-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772211177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211177, "uuid": "de4358a1-e17b-41c8-bbb6-e117dd757b5c", "comment": "Malware payload (PhantomStealer)", "value": "7f067ad1315e23e3b3aceac611c685fc", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211177, "uuid": "0b4ecb49-f274-4f35-8557-a75680276511", "comment": "Malware payload (PhantomStealer)", "value": "38f366e43abee96fc39b1729ce6e8f56ef8da449eec5ab65c25feb2242a0b1e7", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211177, "uuid": "1365f483-2500-41a2-9858-ce5f9c0deb12", "comment": "Malware payload (PhantomStealer)", "value": "6754f758d31d7877e9ce7c645afbae625cfaae9b", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211177, "uuid": "b172b1aa-b0e7-4bbe-ac1f-0eef3f8a6f8d", "comment": "Malware payload (PhantomStealer)", "value": "538807d6d56643513f91853a74ed7f347c56a82a469edbe0ddecba240b9da819e11816e68a1fb6d1ee719c13ae587a96", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211177, "uuid": "5a458755-f1ce-4ef3-ac29-a8dadd5a8074", "value": "T14B267DC4C10ADB0B42CC674481FD6B3986F48AE5918BAB5B6FE17A4F0EFC6C452D52E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211177, "uuid": "fd459a45-8ad3-4171-b3ee-46779dc96ade", "value": "49152:gnYCBZ3JnKpybPWuhCGItT8oOFq7xe7AAXLlSwwm7/NeSMza0pESgq1BvnlbnS4p:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211177, "uuid": "ab2df2ba-3d18-4499-987d-b8d039a03b9d", "value": 4605900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211177, "uuid": "2af0d1e7-f0cd-4f74-9e86-38cef09c8f38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211177, "uuid": "3bee5f09-de50-4bc0-9d5c-631e9def0d90", "value": "Payment REF# 002729BL-HSBC1370012AB0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e9c8a3-13b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772180032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180032, "uuid": "a54fb713-363e-42c4-8d0d-aaa9d5cbd5f0", "comment": "Malware payload", "value": "a617b203a440783a987f454738327e00", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180032, "uuid": "d2962908-49cf-45e9-9140-78e45a14aaa4", "comment": "Malware payload", "value": "39468454e511df8ffe159a0282f1c8e726efb4db92c5c00a6145ec01ec65f4fc", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180032, "uuid": "004a9361-ba9f-4b65-b6ff-0b7828ddbab5", "comment": "Malware payload", "value": "eaee74d388305811cc65a9624fa382ac77ce6d4e", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180032, "uuid": "6c3a5430-487f-4ba0-89a6-2c0041ff9311", "comment": "Malware payload", "value": "c2a227c019c67ba0f1c19c570404006eca236fdf4e1a84c8a39464179b1ced1b4ac7e4327328a056527704e88b3d562c", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180032, "uuid": "5fc21cc4-a8bf-4782-aeff-e511d0645b8f", "value": "T18C416D0867EE9B28F3758A365C68D2290533FC80F9B2431A2554CADC3C2B3418939F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180032, "uuid": "b78ef823-94f0-4136-8707-abe16e58540f", "value": "24:8vL+f432sTYWXEdsoubg2o5EgOYY+i8YZvyD11ev/MRhtDd/5S:8732gYWvg2SEg/IvyD11ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772180032, "uuid": "9c8223ab-ae6f-453e-a613-a8daae5373b6", "value": 2084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772180032, "uuid": "356a01f6-8981-46d1-9344-6217ce2c03c8", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180032, "uuid": "f59764fd-1453-451b-9ee1-7679248f27cf", "value": "39468454e511df8ffe159a0282f1c8e726efb4db92c5c00a6145ec01ec65f4fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c75d906-13e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201043, "uuid": "59fe2ce0-945e-46c3-9e7f-de3787bcb5bf", "comment": "Malware payload", "value": "21ad3a893f37a05139213bac67e247b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201043, "uuid": "820efc34-c2f8-4771-a774-b6c15a29e449", "comment": "Malware payload", "value": "39c18af4cc725f4b9afdbfe468fe821e42a946cecb0955c613e45c0aec7e8333", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201043, "uuid": "e7fbd2ea-2a1f-464e-be55-b2e85da9afe7", "comment": "Malware payload", "value": "25233e33c61c80221c1a1316bb9c97192456bb9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201043, "uuid": "12bc1961-cf81-4215-851b-08ae1bad0a4d", "comment": "Malware payload", "value": "61dd67467a241376b26351c2b4c1e66f36102caa22e27d312c4d51fd231b5a7e56325ed067af956214877a47c3075ec3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201043, "uuid": "65595911-9028-45a1-b868-d70f5ab07c68", "value": "T12642673B21F08B3297C461C962A71BA14F72970B456614F8F4FE57269F2DA0371EBB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201043, "uuid": "3430c05f-3a6b-4b7d-9211-ddbb06687f82", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvj1XioV7+d+C6IB9IBCE:cCuYK6p4hvZ5m5FoKNpivdVGOy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201043, "uuid": "450ce83e-2cd3-485c-b541-f3961bc358e4", "value": 12318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201043, "uuid": "14848682-b678-4a54-ac1d-9d6354b10c69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201043, "uuid": "dc19decf-8309-4b57-ac91-4d5ccac5a5f6", "value": "39c18af4cc725f4b9afdbfe468fe821e42a946cecb0955c613e45c0aec7e8333.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30790540-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772212217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212217, "uuid": "dcf7596c-abb6-496e-b69f-2c30ebe9e2ab", "comment": "Malware payload (GoToResolve)", "value": "8c749cba140a867e643ecf231e2381e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212217, "uuid": "ed4a5083-d62b-4b46-8c76-ce9af9289746", "comment": "Malware payload (GoToResolve)", "value": "3a6638b22a50459ac9aadf6029dc9411a8dd87f334b8c4298ade2bfd9b177e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212217, "uuid": "d2075c0e-cccc-4471-9a2b-beb0c66c3645", "comment": "Malware payload (GoToResolve)", "value": "6dea4256028fc9755234e7bf836087d218d77b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212217, "uuid": "c97912b8-2c8c-4dbd-b988-b24a23d388f2", "comment": "Malware payload (GoToResolve)", "value": "3437e407913e165eba77c9cc7d1f8dbd0f1000bc58499ebe26d131f63bbf1ffdb9ee2c2b21b72578b254bd1feca7fca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212217, "uuid": "4d9f060c-8b09-4d2a-b7c5-329151f83e02", "value": "T10337333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212217, "uuid": "cdb2ded7-6277-4049-9d64-9980f41b74d5", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212217, "uuid": "553b69ed-e92e-4127-b906-89db1cc0f4de", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp8:q9WtLzgOTbjZvk/ekS/mcp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212217, "uuid": "a7e8c8c4-7501-4527-8781-f6b8af5e38d6", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212217, "uuid": "b5df9af2-10c4-42d9-a815-1922fd1e9e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212217, "uuid": "8ed8c48f-bac4-4d8e-842d-0e19ec53cc77", "value": "Reservation Card.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1c70e6-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176647, "uuid": "acca55bd-53e4-4043-ba96-b0458cb94234", "comment": "Malware payload", "value": "8cd639706c3390fad0279ebf578f41e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176647, "uuid": "764b2b93-e849-4831-9395-275ad7573bac", "comment": "Malware payload", "value": "3b3b6c49f70f1143dd815fce330be0152c231f1683a4a15c59558ad9d9d9cf69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176647, "uuid": "bad965e8-3cd3-43cc-90f4-5ad372aa386a", "comment": "Malware payload", "value": "a1ba14f79e9b147f20b167866bdacd285b11ff30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176647, "uuid": "9485be6e-9a7d-4304-9322-9b6c9eaf9bf9", "comment": "Malware payload", "value": "04affe023d6595708c169e730d8d19249847332a9dbe8ffb928617551a3140fc8e0a93865354d24e55d676fee1c9d136", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176647, "uuid": "bc8a7cfc-efdc-4f85-b276-1fa5cca77101", "value": "T1B0F29C16728E920870B347885AAF06B54B7F7A5F1E7D408941CDEB8E8FE3512CC567A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176647, "uuid": "0d9ad82e-eb3a-496e-bb48-0522fa57e75b", "value": "384:lj9p3RAdjWjHjHjHjHjHjHjHjHjHjHjHjHjHjHjHjHjHjHjqj7BBfP+L5yc7YEdv:rp3RAZHkYEdp4Q048eM7AyxYco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176647, "uuid": "d487a9fc-a8a0-4f52-8683-90e4783412a3", "value": 37222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176647, "uuid": "92a279b7-0c38-4bee-b9bd-a346ebf45298", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176647, "uuid": "cb282378-bb66-4e9c-8493-c2ca6afcad96", "value": "3b3b6c49f70f1143dd815fce330be0152c231f1683a4a15c59558ad9d9d9cf69.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee5b2a0-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210658, "uuid": "b8a4df10-aa82-4627-a623-8f1af693aeed", "comment": "Malware payload", "value": "7c8f41ca24e08dc5a404048d9c24bdf9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210658, "uuid": "972cd859-c731-4349-94f4-c3224b18a85e", "comment": "Malware payload", "value": "3babb4d31a283fd0e8d5ed706a145074e3fa6a1bde3e7db803e29761df9c8f89", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210658, "uuid": "401e798b-d4bf-4509-880d-e45b7ca5c967", "comment": "Malware payload", "value": "0a10e094e8bc3ff0dc884aa07f31269415fab431", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210658, "uuid": "64639252-e852-440f-925e-cd31c7355f0d", "comment": "Malware payload", "value": "5f10d5379cba6e40704bdb41692880d45a143d115f676c50894e678d41c404cf419deaeb5b71265c660c981171916c11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210658, "uuid": "e6af89fa-37f7-4bcc-a6e9-9383d2d2a33a", "value": "T183C4C9DC2EC1F19D0F82A933F20AF06DE4F888F0535A5C69A0DC6C48F8956D5ED69639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210658, "uuid": "d05b4737-fe99-4b44-82e2-21554afdac34", "value": "6144:jtNsUX35TzJeQEFx+Iop2B6bheZS4+13I4e6WVGsmsHya:jt5X3V1LEEpMKhec4s44e+sFSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210658, "uuid": "12b283ae-0534-4ff7-8d3a-ad12cbcc17a7", "value": 548935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210658, "uuid": "073d00ab-5627-41c7-9b29-f2476c28aa9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210658, "uuid": "a8bc44c0-5a3b-41f3-96ac-60d042966e5c", "value": "EI2022-5002 .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad29b278-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772210708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210708, "uuid": "706bced6-a440-47a6-8c50-53a0747a9ccf", "comment": "Malware payload (njrat)", "value": "3ad01ec1cb405242ad51015fb2a03a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210708, "uuid": "72279740-80c1-433d-824a-26ff7da24da2", "comment": "Malware payload (njrat)", "value": "3d274658a5e335879fd6b3529183941eb75b882b4980383229491132b454dbfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210708, "uuid": "1007e077-9777-4d3d-8ddf-280737608305", "comment": "Malware payload (njrat)", "value": "b20415378d6e2c78ee0289ce016358c0dc8c2917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210708, "uuid": "12f4d2a6-d9f0-48c4-818c-2b8d4853e9f0", "comment": "Malware payload (njrat)", "value": "633a4f5d603865964eaaf0191e49c26c81be42dcc04a743fcbcd77c772f8b4bc82068317d127a1c4acbc41c14fc8ff18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210708, "uuid": "82210c00-55c5-4e99-b77c-3ef180de9201", "value": "T19C05024C1758D803CAB92B7A59B1F27807BD6EEAB410D31B4FECACDB7962B511808357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210708, "uuid": "ee9efcb6-6977-4e3c-a223-ad08d95c08ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210708, "uuid": "fbb168b9-81c2-4bb3-ac4f-da5aceb10282", "value": "24576:SI5aO/QBOlS2B4x2BYMZgVyjSG1Uj0HTifC:DUAS2B+6/ZgVyjSGij0zkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210708, "uuid": "0cdf47e0-b96a-4511-a1a6-1a17ebc986c7", "value": 865288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210708, "uuid": "3b028cc6-fd94-449d-881b-9ffcc5b29eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210708, "uuid": "b2dbb4cb-6761-415b-a35e-d227f5a809e3", "value": "POWERPOINT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbbdf0c-13d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772192993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192993, "uuid": "5da3271d-c864-489b-9fe8-735e23bdc755", "comment": "Malware payload", "value": "f2dba868d3e19a619d5bb283eb0f9710", "object_relation": "md5", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192993, "uuid": "98d5feb3-06be-4113-b8d3-5bd1491f3908", "comment": "Malware payload", "value": "3d345d56967d4027ee9d2b297f2f9be9a4d0c0fdf2e82239f40b3250af41066d", "object_relation": "sha256", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192993, "uuid": "6d573886-b7a5-4ccf-a2ce-f7c6f131efe2", "comment": "Malware payload", "value": "a178685c9dd9b823dd379c8dd8492a8689da47b8", "object_relation": "sha1", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192993, "uuid": "d853528a-2156-4bb9-b9d5-5d2001a30780", "comment": "Malware payload", "value": "e66154332e1d5dded74721513366597fd7f020b5a088027f4f07a2407e94531630610a170a156faa53c16041a58453fd", "object_relation": "sha3-384", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192993, "uuid": "9195bcc0-8575-4f7f-840e-3dfcfab8bb4f", "value": "T1076533BFFA57EDABAC531E3B32486A78DE14C963F853A8C5D610874606F14427D2F092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192993, "uuid": "fd7dc5f3-d78f-4cf8-b649-e2c7160b067e", "value": "24576:vDrNH3EohBJZkY4BOzgttL1qePQyPNKJfZi/IyIHnK1CCy8GmKSRk+X6GcDLH0:vD5XEyJetOzgXCUNKd4/8HnYzESRki6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192993, "uuid": "f2c4562f-69b9-437b-9f6e-559502dfb41f", "value": 1455243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192993, "uuid": "ba67b509-fd35-483c-a1d8-7f2aa18dadd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192993, "uuid": "f2b47d76-b2a4-4d12-9b08-113f34e1b6f5", "value": "3d345d56967d4027ee9d2b297f2f9be9a4d0c0fdf2e82239f40b3250af41066d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08977d0c-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190675, "uuid": "94bac1a9-1433-40dd-96f4-1a9dd9b4b298", "comment": "Malware payload (Mirai)", "value": "caee6a2fa392d7f22e3bb94e795cc3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190675, "uuid": "45f0b59e-6ea0-4902-8c11-ddfe50256c12", "comment": "Malware payload (Mirai)", "value": "3db4bf876aedfa44d27192a7cadbe2a97b573174e1054f972953c6d9121a1287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190675, "uuid": "f1291639-b396-4613-b94a-42c5a526414f", "comment": "Malware payload (Mirai)", "value": "95363e7568d12e1d477d5028df2de8aec0ef6e27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190675, "uuid": "864d26da-e07f-4127-81ee-909780fbd0f3", "comment": "Malware payload (Mirai)", "value": "705d6e20b0ed32da7225be4f4a90ce626f49cfb8633661318e7b937f143af54fe991d0edd2f17ecca6f9d16c8463eb19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190675, "uuid": "e3856cb1-37e5-43aa-9416-f97c06e9a415", "value": "T190262907F89191A5C0EAD130C6669293BA707C895B3423D33B90FBB92B76BD46F79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190675, "uuid": "469b60e8-3fc3-4b63-a6fe-93027549bac3", "value": "49152:RJZxurfH6rb/T4vO90d7HjmAFd4A64nsfJNpeeQmDLYIROrkKlAr0CSJ5EVVHjkv:RkepgdErqaoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190675, "uuid": "27d609fd-3114-425e-8872-69287662d5bb", "value": 4820992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190675, "uuid": "7bf1b7f0-1abe-42f8-88d0-012da6740e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190675, "uuid": "ba29abd1-3840-4f1d-b64f-72ed980715e5", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab896f44-137d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772156589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156589, "uuid": "a8801652-efb2-4cdd-a8bd-1fb58d8506ab", "comment": "Malware payload (Mirai)", "value": "56469ae597aef5449c903ea661e6bc88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156589, "uuid": "7d9f2e01-d3e8-4516-a6ab-bb6009d345bf", "comment": "Malware payload (Mirai)", "value": "3e362b0ff7ecf47596ae6022321bd49eefdc8f13e97c55a1eef07d9e7c82a49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156589, "uuid": "967190b4-c34c-4948-b765-d85da6e0aad0", "comment": "Malware payload (Mirai)", "value": "58b6ac52787529e4b939a5bf97c20707e29a6db6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156589, "uuid": "7967ec76-0bc6-44e8-86de-51383b68c85a", "comment": "Malware payload (Mirai)", "value": "1e52890389d2babf8cc90d65424a00f7eb5af57657e724e2685e5581f7c75b27fc70551a3f4cc5afad093d2fc5e225a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156589, "uuid": "f0aea752-7876-4cf0-af6a-2a48b1395efd", "value": "T1DFF3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156589, "uuid": "69193be2-87e4-4c93-920f-a9a282e7d6fd", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwX:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772156589, "uuid": "2aa21bb1-31d0-441d-84d0-3fd461734f83", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772156589, "uuid": "c186cd57-8373-42f8-a74d-cb84cf2c8b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156589, "uuid": "5b852f3f-519e-4060-94bb-28da539a7add", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147b0371-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190695, "uuid": "92afc672-ee6d-4eee-82c9-8e60c603a3f0", "comment": "Malware payload (Mirai)", "value": "a85282d6a7e9412a6aca62aacd219abf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190695, "uuid": "7ee6282f-b763-4ff8-a490-4a87fced99f4", "comment": "Malware payload (Mirai)", "value": "3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190695, "uuid": "597d1893-8291-48b1-be5d-f112b4c6d167", "comment": "Malware payload (Mirai)", "value": "ae6d08f1b0273737e5672d5e727b3181b6af4d50", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190695, "uuid": "cad3a8fd-f000-47dd-9d28-eacee43c7bca", "comment": "Malware payload (Mirai)", "value": "38502e29888ae77ffb5f97d9bae04ce7014e16375d0fd878b3c657ded67dc43fbb47722870331aa1920b2669ef1513ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190695, "uuid": "69aed563-b7bb-41df-a271-00f8f64cc807", "value": "T15741D49B327149F3C70ADE45F79490D0E9FE46C3A5E2CBB8B0EE44A26068058F592E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190695, "uuid": "71a42663-3826-4979-9082-8a803d94853b", "value": "24:mOJmvIBYCVBy/NInNI7KPdKPyM2vR2vCwtHoWY:3mzCXylKPdKPyM2vR2vxHoWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190695, "uuid": "a2946664-c719-418c-b66e-2853dd0b6822", "value": 2286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190695, "uuid": "a094f2aa-d4a0-4984-8c59-e5308b2f2adb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190695, "uuid": "4018c6a5-43ea-4bee-a765-22e3679ddfe1", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1185fff8-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190690, "uuid": "d44caa5d-2a5f-4ff0-b5c1-2137dc7ca18e", "comment": "Malware payload (Mirai)", "value": "be1f6a578193890da71f26f9ce8f3675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190690, "uuid": "9057eddd-621b-4d12-a545-948926041471", "comment": "Malware payload (Mirai)", "value": "3f09238ee563f9a990a1184909ef1bbf3b3e26c23b3bf0edb3b5952466db0baa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190690, "uuid": "ed543b15-fff0-431c-98bc-0070de8423d3", "comment": "Malware payload (Mirai)", "value": "0f5ca3fb250be1ed2791cf394d389c4432480bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190690, "uuid": "652ca672-3d1c-4067-8315-888d3f9fd34c", "comment": "Malware payload (Mirai)", "value": "4655b0fd2057ebd314248ae69d4b5c0bd86fd454370807863d68e0340cdc64036d539c24b59f50009db8d21e83e9ba5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190690, "uuid": "ed7132ed-5922-447e-bc56-2c3297719a26", "value": "T1C9261A87B8928642C4E43677ACBDC1C433636EB99B9B12576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190690, "uuid": "4a613c55-ce89-4bdd-9537-3538f433b70b", "value": "24576:DtraSxNoDcmWm6km9M0YecXlm13WsPDFPuxXpgQUyYqBg63v4hfN3DEW8JX8Ofdn:5+8Ktd4B4fTHS3zdrb3TJmPSY93PUh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190690, "uuid": "c86648a7-2610-47d1-bcd2-c6a35f7a665f", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190690, "uuid": "acc97a0c-bba1-4ccd-b77b-4275e40c99d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190690, "uuid": "ed8186c1-71aa-4f31-841e-79037be701b1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994b33c2-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199938, "uuid": "cc7db2b7-7762-4b1f-9628-c19c99154e0d", "comment": "Malware payload", "value": "3749d57b840f865a7590b6b3de63c6c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199938, "uuid": "4c4a8da1-821b-4c56-84df-c4c93ef888e6", "comment": "Malware payload", "value": "3f545682955d876b5a5ed6ef9e2b5ebd0eba3573a5bed86928eba8ec1c1f26e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199938, "uuid": "6b5ac1ad-45fd-4797-91b4-ffd1c8af9cb0", "comment": "Malware payload", "value": "e2c21e6f1e9dfd37e0a5c4833979d3b7fcdc72c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199938, "uuid": "80227197-bbd2-494f-a63e-6be7c69ac9ba", "comment": "Malware payload", "value": "b3b741aa9626b40dd3928b5c52f39530f4505f560d616d3a7849982e15d7da280e3cd92949556e7a6daa41550898cbec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199938, "uuid": "ce0ad65d-a414-4083-8856-3fa36b1f8a7a", "value": "T10D84AE02F6B080B5C28D0130691A6F7AB9FDBC548EE2DF83E785DD4D5D37E81962621E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199938, "uuid": "1ba73d35-e8b1-4c73-88dd-f7e3c71f1933", "value": "be1a714b58a8e6a0da759b4725245c89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199938, "uuid": "031ef7a7-2389-4535-86a3-a461175091af", "value": "6144:1mzX09ttLFgLvuSlJfsN/kOmHGu84lusf4p+KmIPOt:1oXottLFGvu47FtlusfnOOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199938, "uuid": "7ade837c-cca2-4db2-b062-c83d0202a872", "value": 395016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199938, "uuid": "c126fced-9077-4b41-807b-3c6e3a6a0358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199938, "uuid": "e36526f7-ce00-476b-a28a-f242bda18b38", "value": "70c93d4a95eccb5822334fac8eb8fec51e43ed2477893dee9e033f4adbb14ef3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd7d221-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179890, "uuid": "c9480bd3-14df-4bd4-bedb-189036491f17", "comment": "Malware payload", "value": "230123de473affe5609ad4b1b67675d0", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179890, "uuid": "e1d69822-d193-49bc-b2c5-d1bd3bd07480", "comment": "Malware payload", "value": "3fbabd18ff4104e24fab6e43c59a1118c4b8fd23d22de9b131c1bf066184f8f8", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179890, "uuid": "72c355ef-23f4-4090-8698-88d61a1986a9", "comment": "Malware payload", "value": "9158966fc6a4a60e087043604a32ceacf7a2a609", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179890, "uuid": "cdb79f72-f2e9-49c6-94ff-432ff4ccf30e", "comment": "Malware payload", "value": "abe757fd6791e17d99e9bb6af4d82fa03d1cc674a952b3e0a0e7d048ed59707ddfe674a5bf8e0d6eeba7033e8667891d", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179890, "uuid": "a86bb3ab-c3af-4940-992f-4d8118e0d1cf", "value": "T16C45BF079D498A97E42C87F4FD138EAD2E193B0CE9823AFF41224ECB3E642155D4D56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179890, "uuid": "69d7ce9e-929b-4367-bf1b-2a0d67e3cfb8", "value": "24576:ygh4nDCZtjkawj8tnZl+CTTBhpGSq0x+D1SEcR:ygh2aNkRj8tZlVTTBo0Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179890, "uuid": "c67c5c1b-194a-4967-98c8-469a22032174", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179890, "uuid": "04345797-2727-4272-b3a0-7905910e9be5", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179890, "uuid": "11bb1dda-43af-41a3-b5b7-709e09e4e518", "value": "567b8616-fa94-4e96-a28d-d0d5b198c98e.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe00341-140b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772217424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217424, "uuid": "140ce585-9a35-4ef4-9d5a-e624ab8c7136", "comment": "Malware payload (DarkTortilla)", "value": "15ff76d8ed74706b818e37284905ed89", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217424, "uuid": "95663b22-7a3a-45e2-8527-24b8d828f4e2", "comment": "Malware payload (DarkTortilla)", "value": "3fedec832e464055478f1f221aa42fe894b227f168c59bb5ba9e8f2eefdd53cb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217424, "uuid": "c3c34bdd-2f7d-4dbb-b912-dc463ba81507", "comment": "Malware payload (DarkTortilla)", "value": "737a948b67788ad912e6cbc624cbd1a01db9e18f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217424, "uuid": "c5f89109-d5f5-4e48-aac0-b57e076fe327", "comment": "Malware payload (DarkTortilla)", "value": "06b8aa344e94dd875f5c7b292f202e285ebd3dd12390d1be0b0022ee4c4cad59c097f6f39e755de8fe3531be757e4df3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217424, "uuid": "4b8722bf-dbe2-4f83-8207-6d523502af21", "value": "T17635E0065DC36B94E2594B7CC26600E863F0D9575212F76F2FED42F0EEA7F4ACA06462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217424, "uuid": "015866cf-8948-4ab0-a9ea-249d2ae6d380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217424, "uuid": "aaaa6801-5119-47fb-b724-e044e1819d48", "value": "24576:40zqoNOYwMWrkU5dhO5He9ae1KObKr3a:40WoPWrzdE+kgC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772217424, "uuid": "afb4993a-4745-40c8-bd9c-d9cca3213508", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772217424, "uuid": "32eb631d-32f7-4b22-a15f-635048dc3495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217424, "uuid": "bf1e9636-6601-4ebe-8393-4862d93b2da1", "value": "SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.14629.9065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d36b7e5-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212373, "uuid": "7a40182a-4a69-4143-beb8-80f4106ce578", "comment": "Malware payload (PhantomStealer)", "value": "d512775383e6c190ab736cfea6439bba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212373, "uuid": "ff9dd5d3-8ef8-4ecb-8074-681ae5f11844", "comment": "Malware payload (PhantomStealer)", "value": "400313a280a3d16c4d562b90c9eb496e4f68fe84e461364b6c95f46ae5fdc185", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212373, "uuid": "6aa4cfd8-4c3f-4513-9761-a70ff166cda8", "comment": "Malware payload (PhantomStealer)", "value": "f6a8272756c871a1fcebbd7c95592ba63a3f6ecc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212373, "uuid": "77590c29-8c6a-4342-917d-8eaf4d0ace83", "comment": "Malware payload (PhantomStealer)", "value": "6dc181c8cb59d23266d4597278fa2d651dbc50c9e217e5278ab8eabcb63605720072d07a996d889c7c6aec017300d43e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212373, "uuid": "6af4d8d2-68cc-43fa-a361-a2e822424c12", "value": "T1D326BF1DDE461FE41BEB1E2480D75E0DC3B156EC9146BA1F1323E689CABBB00592B58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212373, "uuid": "9c1be44b-9acb-4296-abd0-b525f13f2275", "value": "49152:LrHFqoiN/9hS7cG1/uIuK7tJpZZVbfpDTFWvrMpFpNaJ:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212373, "uuid": "67a3321c-e042-4e4f-8520-8c8ec4b006b5", "value": 4645043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212373, "uuid": "3bc16569-e80d-481b-a723-3486e49028db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212373, "uuid": "245de9a0-7451-4494-b5d6-d9c40b72c408", "value": "d512775383e6c190ab736cfea6439bba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f156a8-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212973, "uuid": "874c8fb4-fb5b-4c32-bdcf-a06059cb768e", "comment": "Malware payload (Mirai)", "value": "7ec3b82a74cb1c2111ecc3447fab1328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212973, "uuid": "343850ca-0da9-4b33-aa6d-1164eb685e1b", "comment": "Malware payload (Mirai)", "value": "40691214338b33bd46c9c480372b8ed71b00bf1227cfb8b63a9ec21808bb0902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212973, "uuid": "a522690e-f72f-42a5-b9f2-40c1223d5be1", "comment": "Malware payload (Mirai)", "value": "a7318fa6d6e1e680ccbdc3a9c81425eab51cc1a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212973, "uuid": "2c68b7e7-066c-40d5-864c-a96a3176022a", "comment": "Malware payload (Mirai)", "value": "8f73d799edd8357307a5be5c024cf916036564a954159096021fc2cd87586c9fb1ccc149127c48e5657764f31832e0be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212973, "uuid": "6c658806-6d99-4a5b-a75a-2c1c3a0141b8", "value": "T1E843029EC2146ED34FB4467E2AB14547F910A87D81CFFF3664804B866AA7188AB36319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212973, "uuid": "bbe71b78-6cd2-4c4f-8250-d8550a36fc43", "value": "1536:Y0lj115MBmXjkYY1C+OE0oX/9LEGD0YLbte6LhA4TYO:Ysj11rYk+10ov9LEh0bV9AEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212973, "uuid": "ce973dca-36df-4ed7-b4c5-7e2fb797f5cc", "value": 60576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212973, "uuid": "281cb18f-220a-4a3c-bee5-9263e9313245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212973, "uuid": "c441ded4-2831-480b-b4ff-14ba622ed218", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a08d2b9-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216582, "uuid": "aa8f6c8f-5e2d-4193-b66a-1a62583319e4", "comment": "Malware payload", "value": "b82ea1ec0de4dfe6b791d4ae1b38bad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216582, "uuid": "79a64754-5720-4c95-861b-c25eda3d1328", "comment": "Malware payload", "value": "409077118a6d2e2654c98d38cd456dc2246ab230d350e54bf1fd5058e892c90c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216582, "uuid": "33e282e4-3b23-4095-a25d-43d99e390bb1", "comment": "Malware payload", "value": "c1a4ee33e8fbbdcbe7558003be26a6ab058ef6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216582, "uuid": "f52e4ad9-3bbf-48c5-8578-76bc2224c03a", "comment": "Malware payload", "value": "849d167d744f4276bfd3ff61bd27b980bfe5dea6e631cae64f1c7f050921e54ff41b604159cacb87b6d76faa2324d764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216582, "uuid": "e051eb5c-36d7-4483-9699-585f059866d1", "value": "T15704E80AAF520FBBC86FDD3302E50A1539CCA81716B93B757234E924F64A58B49D3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216582, "uuid": "59d2734e-5567-460b-9a96-14f5e37bad18", "value": "3072:NWNTxSiLGuyTIOpeqync03ivPsa2e/H5H91s6UGwqMi:NWNEi85PMeR9PUfqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216582, "uuid": "86d1b08b-cb4d-4d77-baaa-cdbe7601623f", "value": 182584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216582, "uuid": "12be4f69-4516-4124-96d8-be9c4b223405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216582, "uuid": "e66af9e0-f8be-44ec-a8c4-3c5a02fe5bea", "value": "kirk.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c63db-1395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772166898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166898, "uuid": "fd387827-5dce-4d77-a7d1-dcfb3aeb3148", "comment": "Malware payload", "value": "e2ed2b6fad984dd4cbec5609333fd858", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166898, "uuid": "87e3bb9a-f0a0-4b27-b0bb-390af44ed6e6", "comment": "Malware payload", "value": "40ab6ef889ad36883c5a4f1cc94693d51d716335c0851cf1057103d19d5412ab", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166898, "uuid": "f1d93735-2ef5-4e3d-a6a0-406883892486", "comment": "Malware payload", "value": "b99aa6f3dc0478d769e9e28e8e5d1432a521120a", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166898, "uuid": "943588c4-9913-43ae-afc1-250f08529211", "comment": "Malware payload", "value": "77050b5947bc6feae0046e0acf7be5cf3754c406211d3907f100387b6e10741240904dc927b33a29f811b30462ee437c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166898, "uuid": "8db75fdc-8762-4de2-9256-1f764dfa5ebe", "value": "T1A6D533546A0AF0382E65F0506AB5F81278E7473B41E2DDF0AB4AE7ED837F34968DB150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166898, "uuid": "9b255d60-10e6-4f8a-9c50-a5734f7b45c6", "value": "49152:nI4SjiBZVj3HdsesjxN/Lri4bZAl2aOE8+poRyY3bxcdxQxfO+ALkVS+xzbbi7cZ:XSjiB/j3aTjxN/Ilj96Rx3NYxMVq0lVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772166898, "uuid": "1dbb67d3-f113-497e-a1ca-8fadc210f92e", "value": 2938276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772166898, "uuid": "23e7fbb2-c090-471e-9ecf-6063253825ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166898, "uuid": "3905fe34-20db-4bfe-b16d-d9a75f95a3c4", "value": "gitlab-runner-01_1771942130_elf_sol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39ecd8e-1413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772221027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772221027, "uuid": "8113165a-b31c-4fbc-8ff8-1805428c9218", "comment": "Malware payload", "value": "6771bcc6074217feda819dbe38bb8172", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772221027, "uuid": "56d84bcf-1ec2-44aa-9ef7-bc6cbc8f3b80", "comment": "Malware payload", "value": "41e431ef87dff25a12d61b4fde865cb39385326e197c15e501bf4b46a9c8f996", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772221027, "uuid": "227f11a1-f24c-4c92-bc95-60cf2dda53d7", "comment": "Malware payload", "value": "bbe0158e61de017723c7e668b17fb6e6044f22e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772221027, "uuid": "3b8d85e4-23b4-43c3-83a9-c57e0c2e0055", "comment": "Malware payload", "value": "55d8e0ac79d65bff6b357f89c87ffd8282943fc3befcc90d3d3328bf78a4de7656d70ffbadc84df087b0d1da16e33511", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772221027, "uuid": "cbd5140f-edcb-478d-bfe8-aa70981d8046", "value": "T14BE0C097413108B57F10105B7377EEC0F44C3072D444EE4C20DDD2D44A8C64C3243A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772221027, "uuid": "925fc0a2-65a7-4e0d-b7b5-4107861f0ba7", "value": "6:hrC1mAHE0y6dzErbeiOnFfljMbBSfW+1TJ7Ld+1T858/AqFxFXw9d:ZCBH1y6dzEEUs++PLd+Y8bFrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772221027, "uuid": "91ac4ff5-732f-451a-86a8-f15e3ac7a2a0", "value": 346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772221027, "uuid": "a11412f2-64e8-42c4-ab19-8d2fe0878350", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772221027, "uuid": "9d0f6aa4-772f-4c8b-8811-cdc06256544a", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1a60ea-13b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772180857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180857, "uuid": "92a37bb7-89b7-41fc-be16-e78782d91f21", "comment": "Malware payload (Mirai)", "value": "e4899eb1c37c74d231b1a0cd910c10ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180857, "uuid": "4205bc1a-c8ad-49b5-824b-e126c8c9e18e", "comment": "Malware payload (Mirai)", "value": "42285dd1d38c2f960524e2c968555d3dedf202092c32d0ac77cfd0e0abb8237a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180857, "uuid": "d44fda9b-0e09-4494-b07e-d61919541395", "comment": "Malware payload (Mirai)", "value": "e3499b96d380206f79aa232bfa402351281fe2b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180857, "uuid": "e53ee192-3192-492a-8c4a-b44f41409a1e", "comment": "Malware payload (Mirai)", "value": "5ab3ed21b6044a0bae9dde477c557cb12b3e52898fc70e0bd8eecb8472f6f858772e6c5aa796efb47f803e6281d69886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180857, "uuid": "121a4fc3-c907-48e5-896c-54c6d8b3c456", "value": "T11DE31945F8405B23C6D612BBFB5E428D3B2A17E8D3EF720399216F25378695B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180857, "uuid": "c21609fb-4493-4564-ad88-1eb1bee7bbe4", "value": "1536:AXXQB9roLvTOC/aXamb+uENviszue38MAxztJ4VCiBaTn0iWwGvVCOgSqjQjUtKO:AXXFjUy6tI8M64dE4iWwWBStMit+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772180857, "uuid": "0e1ee99d-2b4d-4982-91e0-1f7ed16e7277", "value": 146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772180857, "uuid": "09a3c53a-3c91-4022-b8ac-3166e5f9a4e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180857, "uuid": "a6340051-aecf-4b86-b2bc-0ab02bf21727", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637328c9-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179661, "uuid": "30af9b35-91eb-4b21-a3d3-eca4771c778f", "comment": "Malware payload", "value": "81a83f28a91d92dc3620b71509185585", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179661, "uuid": "8507a09f-d7ba-44e5-82cb-51bea78168b7", "comment": "Malware payload", "value": "42ad86d2a9777aea2669edd053ea75469c6693540074d0ebd9578b5aa8d36e76", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179661, "uuid": "6e5d2cd0-94d5-485d-82a2-10a9e04845eb", "comment": "Malware payload", "value": "16dc562175c604c94268e91d83ba6c74c2f446b0", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179661, "uuid": "e0a89bd3-412c-4a8e-9ac0-da9d84a10c30", "comment": "Malware payload", "value": "883a4e47af1ff065240fcb11f4e8e12f219db9e5ef911a29b79568f7c06c4f814872015c672154034b9337caab1cd4a1", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179661, "uuid": "4d6c1dfb-612d-4121-99c2-96c9868eafef", "value": "T18AB32B2A37A1047FE4AC9FB15827F3D0017F67496A931F0BB1C25A935C973858A18BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179661, "uuid": "4894ef6c-f383-4cbd-9a77-92eb01c18e1d", "value": "3ef10934d629fc28c006784a1ca1e57e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179661, "uuid": "a09464b6-6d11-4dc2-87db-d0dd7e8b1f41", "value": "3072:JgIyG2iaezC/uuCuu0cbw4VLDUwnh0zR6j3VBv+r:6GNaekuuCuua4VLQwnhoR6j3VZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179661, "uuid": "ce1e5ab2-b565-4275-96b1-ff46fc740e3c", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179661, "uuid": "27311f51-a572-4511-b610-e43056c17864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179661, "uuid": "72b3f477-2337-4e4d-843f-78bc8e06f03e", "value": "42ad86d2a9777aea2669edd053ea75469c6693540074d0ebd9578b5aa8d36e76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f1f499-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223923, "uuid": "0f586297-5c9a-41b2-a7e5-65efe9430430", "comment": "Malware payload (Mirai)", "value": "00e8721f11842a0dd22553018a1d52a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223923, "uuid": "9f0ebd06-6d78-4ddf-a5e2-fa15a0b855e2", "comment": "Malware payload (Mirai)", "value": "434c2c56aad4e047a0ab6ff156660869640c79f1ad6b576cbc949370fff43b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223923, "uuid": "19e886a0-cf31-41c8-a2cc-70663c096c94", "comment": "Malware payload (Mirai)", "value": "55c7782975b7e23c4b2468b8cb4b11a3417be8dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223923, "uuid": "4aaa4606-9e3e-4840-b7ad-27a09e62bbca", "comment": "Malware payload (Mirai)", "value": "70334a5284c741fece59bff329d2842ff548a88ff84dbc06e2600c73bda8f2b009e18ed84d6654dea42ee99a3d8dee78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223923, "uuid": "86f3ff6e-f9fb-495b-bbe8-c1dcf7d564a2", "value": "T13003E0D86AD324A8CF980DF550BE06B20F5030DDAE717BCD371A1C8C763659BBA584B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223923, "uuid": "0ab63e6a-c90c-47cd-9a86-d772175ebf8a", "value": "768:qhpGLq2YEQh5q10MxYWt/y/1tgPUcDpSJzBMWj:+pD2Ynjq10Qt/U89kV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223923, "uuid": "0269bb42-13d8-421a-bd04-c2103d139d70", "value": 38696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223923, "uuid": "4239ceed-7bec-4a6c-89b5-72f4e9b7f152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223923, "uuid": "75380cd2-6bd1-4f0e-b8c0-6265aa02f67c", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b22d25-140a-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772217049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217049, "uuid": "2cac5b20-4a52-4c8f-a141-d1c0667e3f47", "comment": "Malware payload (Efimer)", "value": "37d9b1144801553920d5bf06e33e7311", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217049, "uuid": "f8e06e78-5f3d-4164-8ec6-f47d0391437f", "comment": "Malware payload (Efimer)", "value": "438186b5168f39b94835a5ba70a357c3012c224f89fee61e19ceb29793d62d57", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217049, "uuid": "f78e7b6b-c2a9-40ae-92ac-1adf06111760", "comment": "Malware payload (Efimer)", "value": "499454f339f20c854b58ae29dbce16976516c7d5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217049, "uuid": "18ca2524-550f-4e0a-aca6-e0b69283a5d1", "comment": "Malware payload (Efimer)", "value": "5053861c98fa551ac3f74eb22b8e276af2fe06fc9be93fcf6e11070d16ce402b14a972d82d6fd7de73cb8ed34afe0f44", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217049, "uuid": "ffc4cd48-590d-4757-b359-b3d04786350d", "value": "T164C6330895E360DDC7F3A0B4FAD22BF0E4A978A51237CD2E6718C372AD4B3A4955D847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217049, "uuid": "97c00908-795d-45b0-9c45-5d89b0c766ff", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217049, "uuid": "433971e6-9528-4885-9146-fa9b8cacc3f9", "value": "393216:6Zj12+badPmwYmKJAXMCHWUjXDcuI3/PGTAI:6y+byO/AXMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772217049, "uuid": "c939eef7-3f07-41b2-abaf-962df9a8ff65", "value": 12607683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772217049, "uuid": "cd4b49c3-dd14-4cc2-8dab-b872b3bbba82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217049, "uuid": "e75c4ecc-847c-4e6c-94f2-ddb1faa14857", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af03fbc-13b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772181338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181338, "uuid": "09fd92a4-6720-446a-96b4-fc74afa1f7d0", "comment": "Malware payload", "value": "998ce5fc2252662a2f1734543324f362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181338, "uuid": "9b468589-bc7a-49fc-98c6-f3a0dccd6273", "comment": "Malware payload", "value": "43ff8aa8c47bb704f1e3bc667fbec609a6e2294c78d583ce721b691b5a1d4645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181338, "uuid": "bd6e48e4-3450-490f-8e91-837d7b9d9115", "comment": "Malware payload", "value": "d049674b8d89959d2d47ca7959f562c56f7485ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181338, "uuid": "89032c41-a892-46d9-a531-f5a9de4e18d7", "comment": "Malware payload", "value": "f9831d3da8db6706a17ae86b044a28ef4b2837883408bd58177485616bc396dbfd2e5e3e0efcddda0d7b37d2a5139082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181338, "uuid": "dddc334a-4450-43c6-982e-1e2356c2b495", "value": "T10E2302DF9035421EEA00620D6CCD4A55F92ADD8707B527391C8A3D1D218BF93A2F8EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181338, "uuid": "9f14558b-464a-412e-9e74-81838c21d008", "value": "1536:GZKz8BCZ/2KY+A2rDV51fTQO+xjHSfCri:GZKgB8EGrp5hT/4zVri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772181338, "uuid": "d60ee7db-0cba-4208-813f-85e3e588b110", "value": 49868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772181338, "uuid": "4076b679-146d-486c-a545-8a3110229a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181338, "uuid": "fc04d48f-72fe-4d73-9240-fa6f7070a25d", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d97538-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "18e8ecd0-1186-4faf-ad9a-6afd551882ab", "comment": "Malware payload", "value": "3fd6605fed3837c7fb37f1b3009d8ba4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "ef35d275-ee5c-4e9a-b9ca-fd3b0d247715", "comment": "Malware payload", "value": "451193819bc4abc0aa2f134f4eb4e1ebe5a12de449be9861fbae186f1e5fc31e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "bbe69c85-1cd7-4562-8617-b500500a2baf", "comment": "Malware payload", "value": "82805c0f008e207e7674611d6bab1fe032a17266", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "1c451fd9-ebab-48e5-a7f9-142ece60e770", "comment": "Malware payload", "value": "4f6228259c1ddd1328d0f35e7ca34893632cf7b25db3d9b2900c1b3d7a48991b3abcdb2687718628884ab01a1b97d409", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "762bbb26-3125-4095-9976-10689094424e", "value": "T16A81A4B035F04C732E616A80F3372BA6ABB6991345A3318C35DD2E395F96B12A5FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "e5343e41-f3e8-4b86-81db-4b441d883b49", "value": "48:cniRxuGRy/+DdvnSfr7lwnYJ/dl/B4Tilwn8Gs7wnizLI7wnE/+ol3+L+ol3Mt+u:cWu47kQMaXv+R1mhm/IBRIBGcbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199881, "uuid": "a964bc40-974c-4b30-9bee-116b347c5ead", "value": 4023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199881, "uuid": "5bf09428-38ac-4882-b27a-c55d476662bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "b0546aac-8e87-44d9-ab40-58ed10e38af9", "value": "451193819bc4abc0aa2f134f4eb4e1ebe5a12de449be9861fbae186f1e5fc31e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40c9105-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772212545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212545, "uuid": "5b05baea-5fc8-413e-b01d-21061ac3cec2", "comment": "Malware payload (ConnectWise)", "value": "ff074d06a5fc5d35c10b75bd0d0e1727", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212545, "uuid": "cd32fb91-e112-4f88-8276-e1552fb1b8e1", "comment": "Malware payload (ConnectWise)", "value": "4584cda0dc309310d1d01c5b70530430d6796f129ccbe7b916c2b0379c04b2a3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212545, "uuid": "1cf1e66d-ca72-4797-a644-618aaad68d3b", "comment": "Malware payload (ConnectWise)", "value": "01f9f665e714d29a7a6aec3e607ca1cf1bf8c364", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212545, "uuid": "bae1b4bb-90a2-43da-b3df-2718967d678b", "comment": "Malware payload (ConnectWise)", "value": "a04ee0f45aa649cee3e8e1d7ee5cdc8143cf114a9158e724d42f881ca6c4f6ed42dbedac70b937e48d0155fabc214f0b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212545, "uuid": "92abc7e1-8b01-439d-b338-5b1577f7b4a8", "value": "T18E917086678D0BA9BA4848D64258A90780F3D47D3A6521CCFBF17603F43DAB6FC68770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212545, "uuid": "42cd1dd0-858c-44dd-9471-f47729ef28ab", "value": "96:nFelFI4mQV7N0/2aiWA7VUiSfONTS+UH0ddeirAx2:nCu4mQV7Nyit2ihPd82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212545, "uuid": "9886abec-f247-40e0-8a67-61d58ab22482", "value": 4421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212545, "uuid": "c9817643-3649-47cd-91e9-b07c0c9ddb77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212545, "uuid": "f56e47c2-fc0a-43dd-9ef5-126ad82a44b2", "value": "RevisedAgreement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f25bdaa-13a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772171601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772171601, "uuid": "285eaedd-2ed3-4b01-83b5-a21eec927278", "comment": "Malware payload (Mirai)", "value": "a510b902731a5ffacf46268b9c30cb79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772171601, "uuid": "b40a3d61-92de-411d-afed-ec5fff13774e", "comment": "Malware payload (Mirai)", "value": "4584e14474a004cf9068b75880b39585c3e70797ae157017d8851618b398c0c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772171601, "uuid": "a1e3669e-fc91-4b39-817c-b60343d697c3", "comment": "Malware payload (Mirai)", "value": "0f4016b2b1bf10b9b390d427205bdd50ba0b8d8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772171601, "uuid": "53342d41-9573-4b7d-9514-54c87ceff1f8", "comment": "Malware payload (Mirai)", "value": "1a4d100bb746032cc535419021c6f2e1405722a7c17f1c0b8db10311befae4abe40ab66dc0a68b511a57302a08b22e75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772171601, "uuid": "ec6e755d-c6eb-4486-85ae-fc2606f59083", "value": "T10EF2F29113612B4CC325EBB53DAD701DC53C211B32A90E402AD3A68EEE4FB255876EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772171601, "uuid": "bdd7f7a3-6bf0-408a-8548-dda9087f086f", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OE:87vbq1lGAXSEYQjbChaAU2yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772171601, "uuid": "86ff3162-d3ec-4b71-8e5d-174e082c8e0b", "value": 35250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772171601, "uuid": "c90e4c90-c8c3-49f7-8ece-a6b061ff4f30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772171601, "uuid": "22654f82-05a3-43a3-aadb-58683844b804", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b79eeda-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "a600583d-e59a-4a92-9c35-11c27fe16b7f", "comment": "Malware payload (Mirai)", "value": "545580c3da7a24af80af972a8dad3240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "e22ffc72-2cf1-44a9-91b9-184b530dfc9b", "comment": "Malware payload (Mirai)", "value": "46f06b69732803209bd09414d6ad736c43bcfa3f3981141d65322ace539f87a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "b32b79a1-8f33-45f3-8aae-0ef3456a2001", "comment": "Malware payload (Mirai)", "value": "dcfb9d54132247b26138f4a84881100b4da29fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223939, "uuid": "cac410e5-108a-455e-8799-bcc80dfd4498", "comment": "Malware payload (Mirai)", "value": "900cd36567fabee47cf99c6face57f5a1bc9c5c9642976930714d8bf1adf2653622859a96a956d994ef8ccdc68372437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "a0de0bf1-63b5-426c-ad6b-3c18522ee90b", "value": "T1A7733985F987C6F2C4474830416BFB3FCB32D9A511A1DB0DDF5A9F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "8e508962-1a08-492c-945d-cad6b17b769c", "value": "1536:Wt6dVFeGBV9ah2tYeQmP7uW2wORzBbkivom3aJeLdLNn:WtSjBnah2tYe3PrXORzBbVvHLdLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223939, "uuid": "da0c2e62-ebbe-4af1-86d6-236249ef3ec6", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223939, "uuid": "c2e7437c-026b-44c5-87dd-c346949d549b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223939, "uuid": "5263f534-3f79-4986-a863-96fcc4acd27f", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf53d70-13ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772203378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203378, "uuid": "3e6dfa4b-62a9-4f96-9f78-eeeb9bfc5f70", "comment": "Malware payload", "value": "5d26f3c6fcfe3519080358aba11d97d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203378, "uuid": "343ecbce-be1f-4994-8921-b6fc242ee4e1", "comment": "Malware payload", "value": "47afdcadd568df2d24c8a6ce332efc871b5429d36f304f722b7f800609f1038c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203378, "uuid": "10e3ce85-1424-46d5-b99e-4ea4e6a2b905", "comment": "Malware payload", "value": "be502d539fcf2b9f00823ef543aad8dc34e8295b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203378, "uuid": "6818a986-f470-412c-baa4-e1d252fcf3eb", "comment": "Malware payload", "value": "a37e2c0a8780fc2e46e0934fb00b89bbea503786bdcbca6595c4a47c1144683115138acbbc29520625489f44b865f7c6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203378, "uuid": "b8f4ccab-c35e-4cd6-bff2-19a02b6129ca", "value": "T17632B37125F14C332A206984B3772BA6ABB6D95385E7318C35DE2E265F86F12B0BF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203378, "uuid": "94500c24-d361-49bc-8e47-ea493e1b9b28", "value": "96:cCu7B6zJQOlexE+fkxaSN/oSoSogcm6mM+W+pIBBIBwIBVIBAXDDF069x0:cCul6zIFD/7zRiK7yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203378, "uuid": "05b96bfc-c998-45cb-a6e6-629ab48f206d", "value": 11675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203378, "uuid": "5d6f4cf1-c6b2-477d-9bad-98139c712fdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203378, "uuid": "39cd3c53-ff61-4596-b698-a2e115e5f8a7", "value": "47afdcadd568df2d24c8a6ce332efc871b5429d36f304f722b7f800609f1038c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55409706-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236331, "uuid": "60eddab3-f7a3-428a-9480-4a06181f6af7", "comment": "Malware payload (Mirai)", "value": "dc0f3e4c55c82a871869e7415b944c58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236331, "uuid": "e1011560-fc75-47ed-bec8-a9fe0e3211ea", "comment": "Malware payload (Mirai)", "value": "47e07c67b8ddf60e32e77ff58681261b42636a2c3d66eb27a21cb1f484ec13d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236331, "uuid": "23cb364d-66b2-4a3e-9204-faf0b97650c0", "comment": "Malware payload (Mirai)", "value": "6936a2957913fd25209ee17dab09e0712eee0bf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236331, "uuid": "b1dc0fed-da1f-49f1-9bf8-26bbb4415336", "comment": "Malware payload (Mirai)", "value": "d367b9ca45e86761bdc6701a9b304845892593e0fd70689f19544a4669f4b3484ee51d195b356d0f2cbf523f70ca2393", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236331, "uuid": "abd05ffb-41f5-4b85-8327-14d8497cb80d", "value": "T10A73AE76E424A966C086033474F0DF390B63AAD9A6571E77769006B25407EDCF60EFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236331, "uuid": "ee8126ae-1ffa-4d3a-97b1-e83b1f2b5041", "value": "1536:9aEwgtmHjwfvY7tkYYqKsle+PHcbiCQKC9l60qka10WCh:9rojavTSZUsHcbiCQKaay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236331, "uuid": "86adf252-6327-4882-b7cb-66641227a5ea", "value": 80476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236331, "uuid": "31873f2a-c2ee-4a31-a8f4-2dc1a6363553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236331, "uuid": "41a36576-c37c-438e-9c69-a8e885c28ac7", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bc2541-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772211412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211412, "uuid": "b2a1a4b4-fd0f-4dbf-a1c3-3485f097016e", "comment": "Malware payload (Mirai)", "value": "1e13b3425b933260d751e6e48e610501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211412, "uuid": "1576ef53-9bfe-41b9-95e8-74520e99bf8b", "comment": "Malware payload (Mirai)", "value": "492883c85d22334f56c4d41e66d3999bca6180238db5062d0b7e0a85960c8497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211412, "uuid": "65747216-d319-46b3-b1d3-59eeeb76b595", "comment": "Malware payload (Mirai)", "value": "3467092a8bef54309de46140371956e6d2f9e0f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211412, "uuid": "283f79dc-de8f-438d-8d3e-8761d24326de", "comment": "Malware payload (Mirai)", "value": "4d6fc32df1c5ace1b7ec9f079d5f9f99e717f8925efa1f9e26f2b41d64b522d16aa3283361bcee23e809ba9fc96f20be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211412, "uuid": "bdb7a6de-f779-4f3b-ad53-8189b3909e13", "value": "T16DC32902F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AF123D4AE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211412, "uuid": "83e4f318-e437-4db5-9d51-e363b39bd719", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BgwGoTgzQLAdojgaR/y:eH3TghM/1weZbcnITeyosFAIxnJdhgJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211412, "uuid": "a779b2d9-257d-424c-8914-a00c84d19e8e", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211412, "uuid": "8c5547a8-2372-444e-892c-0603e775e40d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211412, "uuid": "2a1f750c-fffb-44a3-908a-494264ff0ccc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bb5750-13f7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772208812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208812, "uuid": "c6085130-ba7d-48cd-9516-3a228e3612c3", "comment": "Malware payload (RemcosRAT)", "value": "2031aacee38009589610873654d6df58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208812, "uuid": "68543643-f7c6-4ac3-a476-c5f1b9ed632c", "comment": "Malware payload (RemcosRAT)", "value": "497f6567111906fb0822f0a1ff60e8a459f480bbb123cd4d1f310346fe1566a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208812, "uuid": "14641278-536c-4217-86c1-5262c11b3537", "comment": "Malware payload (RemcosRAT)", "value": "4482f130a3360df488b368787b40bf7bb5bb25de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208812, "uuid": "663dd1be-c516-4c81-bc5c-5edd32499f4c", "comment": "Malware payload (RemcosRAT)", "value": "2bfa3d92a7f9185dcf6a0b15184dd74e86304225fd416a4c07e65a6c5337de1a44d91f1b07ff1fd631dffbabbdee015b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208812, "uuid": "39a6dda7-e945-4c7b-b93a-2dee95bc7110", "value": "T1C1B4B001B6D1C0B2DAB714300825E7F5DFBCBD201835993BABDA1D97FD705909A39BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208812, "uuid": "28240753-c8e1-4d2c-b5a9-91514f15fb33", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208812, "uuid": "758c4f0f-fe12-440e-8242-a6ea8ca34ee7", "value": "12288:scDFjdRG0DGvLVfiBNCweUS7N+kjsPZvOT:scDFxRND+zweN/mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772208812, "uuid": "b408e97a-77e0-44c6-9c8c-601238765f3f", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772208812, "uuid": "f320bda0-b703-40ae-9e40-a1eb97139a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208812, "uuid": "6b8b9114-7e30-4d6d-8da2-718fdfcfa4a7", "value": "2031aacee38009589610873654d6df58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d50f7d-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212974, "uuid": "ac4ec848-436b-47cf-b63d-1e183016af96", "comment": "Malware payload (Mirai)", "value": "b8ad2fde5569a91d0662be246bf09139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212974, "uuid": "71b900f8-6faf-4974-9cbc-d5b6477c851d", "comment": "Malware payload (Mirai)", "value": "4a0a518021d5dc31d6cf7c5297dcfe301769d5385045ed9939a99d473e71c259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212974, "uuid": "f4eaee99-5638-4413-a147-e581d4f03996", "comment": "Malware payload (Mirai)", "value": "8f3ecfc283fd3e29e3c697bc049834596d61767f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212974, "uuid": "92e42a89-9dbd-45de-aa8d-72844829a554", "comment": "Malware payload (Mirai)", "value": "60e4200090f6054e75c9d10c2e70ae23d568fa699c98871509558ccc7577f4305b417641274afd8a5b5e2c9f93426c5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212974, "uuid": "6f00dd15-57d5-4ecc-8a53-350f02916483", "value": "T15123F174CA0A7AB6EA7E8C354D5292E163FA1EEF33D688D367611E835343C50530DAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212974, "uuid": "200fd367-f4e8-4eb3-9614-307d80be99a6", "value": "768:wPMGs44aRcWZJPR9UK2jGlMeEhG4p6niYcI4P6Og9C0A/qUuavHjau4jhlv4uVch:wPRCCLR9hl5Es4p6nbT4QC0A/qUuavHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212974, "uuid": "1b92dc02-f7a3-4364-9f89-16e68e27d91e", "value": 48140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212974, "uuid": "83c54a78-299f-42e0-a430-ca8bde73fc10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212974, "uuid": "8a68168e-2623-43ca-a98a-afa682b1aa59", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6780bc5a-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176661, "uuid": "8a4c3dc7-e558-461f-9b58-9b82f964b239", "comment": "Malware payload", "value": "36215a997ac1b43de052cade7bcdb1d3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176661, "uuid": "5b999824-ee99-4b64-9e13-fe7d6ae10021", "comment": "Malware payload", "value": "4acbd371ca63069fef957bae146c71881d85d84b82ce8c0890193e3229fcc351", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176661, "uuid": "a207a84e-160d-4a68-9e8b-c7f0a90e1d13", "comment": "Malware payload", "value": "25146a8e082f62435a637e0fa15d35c9b24e6997", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176661, "uuid": "209111f8-27a4-4452-b84d-de113fc4250c", "comment": "Malware payload", "value": "7fcc4cfeb858d06b4a2656083efda31698ce4255a74540f455b95cb86f61c2a2ab1156c1ddf8486c46eeb3f53c544983", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176661, "uuid": "2f07a34e-1d29-4052-bec7-a244d20fb610", "value": "T15383361ABAEF0109B1725F569EA3A1BB5A7B7D25287C84C804CC26090BD7D41DC91FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176661, "uuid": "5d27601f-506a-4a67-885e-05c05218313d", "value": "768:488888888ea3a3a3a3a3a3a3aXabr5mEYpeGa300q6zO+GALa3a3a3a3a3a3a3aN:wgtq1q6KAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176661, "uuid": "08454a63-f437-4425-8e9d-1a0f0ddc0f1d", "value": 85146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176661, "uuid": "5120fb92-55c4-462c-be85-60c4117d52bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176661, "uuid": "d00d66e9-e750-49f0-b092-fd011a6ec7af", "value": "4acbd371ca63069fef957bae146c71881d85d84b82ce8c0890193e3229fcc351.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f9e506-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1772209914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209914, "uuid": "a2257670-d8eb-4fe9-8ea7-34549367d6db", "comment": "Malware payload (RatonRAT)", "value": "ec74d7bc0fda47832e4da44efc15b164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209914, "uuid": "48971901-ccc9-424a-b55e-2c9e3d53f0b0", "comment": "Malware payload (RatonRAT)", "value": "4acc911e1a9e5a306731a98f01ab2f28e5d8368d4ee2db60d37b89e9362b0425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209914, "uuid": "6922f65f-98d4-4c4a-8848-b33587e1a4d1", "comment": "Malware payload (RatonRAT)", "value": "acd5f79576a4eb08afa32fad0946b9ad6db7f52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209914, "uuid": "cda1a7dc-862c-4d00-b8aa-99ce0a2ea37b", "comment": "Malware payload (RatonRAT)", "value": "06ba4ad7151d11f764f4b3e179af0ead97551c3502ab7a68fabb62a7532218872da3ff42e0c61054a9cedaf26e887001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209914, "uuid": "719b15e0-fb27-4b46-b42d-4811fc84ddc7", "value": "T1C9936C0073FC611AF7FE8F7DADB620014A727A17AD71E64D4C42919D09B2B81AA24F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209914, "uuid": "36cf66b6-e806-4e96-bf26-56bec4006640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209914, "uuid": "a4a630b1-8f58-4dce-8791-6c59d5d88816", "value": "1536:Pr/cmZkGaYEUrNbYgJZoTsqa4tsi5bTbG2lb/KRCvmsYq:PDcIxEACAX4tnhW2lb/KMvmVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209914, "uuid": "ec2cb362-1874-471f-95e2-fbb99afd781e", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209914, "uuid": "40bbfe81-375e-4d34-af68-57d023b5473a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209914, "uuid": "89845640-aa88-4a51-9523-0e819778c0b0", "value": "hujmioserfvthisdfg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0878bc62-139e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772170489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170489, "uuid": "901747e8-0560-4773-a49c-c1b159ccd7c8", "comment": "Malware payload (AsyncRAT)", "value": "1380de46b9c7dc0f88988e6df16b6d4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170489, "uuid": "f78baac8-650c-4c40-beb0-0da132b942e7", "comment": "Malware payload (AsyncRAT)", "value": "4beb51043b9b7176ec01b918f1e5dee68a7be7ebeac74806965ce920531f3ebd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170489, "uuid": "38d9732b-9231-477e-a8d5-1bddb034b867", "comment": "Malware payload (AsyncRAT)", "value": "61e93f8503da05ca455061a4a17d66fd86cd5c3b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170489, "uuid": "8f0ef997-207e-428d-88bd-2e75ca3c8755", "comment": "Malware payload (AsyncRAT)", "value": "a716d6c37633ce4599b726cdfb85b7509d39daad0ee01e84c850362f0444b2be2a72e68d6ba9ba789344fe6e75796e95", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170489, "uuid": "c57e2e3e-192a-4783-b8f2-18df6676f6a7", "value": "T1E0D24A08B3D88561E1FD56B94D7292048775EE4B9973DB9E1FC440AE2623B88CF25BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170489, "uuid": "ce83348e-eb16-48cf-9f91-6c6ad29732a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170489, "uuid": "e59a86ee-6031-42f8-a6a5-9618bb3a0773", "value": "768:RMARXV643iqBkgg/cIRGqoW/Rb7fB/dTV/+:yARXT3iqBk51ioRbN/D/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772170489, "uuid": "cd70509c-830e-49b4-8388-8e2c05e9efc7", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772170489, "uuid": "7b17711a-4aa2-4e78-b85e-040c87906264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170489, "uuid": "b7acdd42-a570-4c7a-9633-868e67ca8e0e", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d53b527-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772212319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212319, "uuid": "cea15469-9209-4dd1-9f76-66c8bc9112c5", "comment": "Malware payload (VIPKeylogger)", "value": "bb18e2948ad36e5c37c51b70ea555046", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212319, "uuid": "3095bee7-c5b5-413b-ae84-0c0c6cda213a", "comment": "Malware payload (VIPKeylogger)", "value": "4c2624a9a8d4f182f0509d3c6e26140a64d95f21e4834025373b67e509986465", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212319, "uuid": "ddfd221d-873b-4299-a969-1bfc42251b36", "comment": "Malware payload (VIPKeylogger)", "value": "5e6b902d3dc7376b9327ac537315aae73dd10108", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212319, "uuid": "eae0d08d-0d47-49e2-8a25-6872abec1bf8", "comment": "Malware payload (VIPKeylogger)", "value": "3d567875af946199866bf823abafb8387d32e0373e78a043cd106dafadaef967b892400ef995626f228c0ef1c1936e31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212319, "uuid": "a53c679a-61b4-45ee-b5e2-b7ac4808a8df", "value": "T1C635164A4D734851C89DB990F413B8C05D4CCBC6A90B49ECB539EDDB984BE760D2AE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212319, "uuid": "f73a8c6d-52ad-486d-adcc-71fee3c7a21b", "value": "384:0QemiUWOWLlhucoWYV7tUbEJO2T8MjpHMwGk0j7PJqbJ:Zqrfs5UIJO2T8+pHMwGk0vJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212319, "uuid": "a76d2cfe-bbd6-4818-9fd7-f2e40a62d7ab", "value": 1158235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212319, "uuid": "0b16c334-99c5-40c0-a7e6-685be4e2ca32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212319, "uuid": "38f8e263-d0f3-44aa-9132-a38f18f60fc3", "value": "bb18e2948ad36e5c37c51b70ea555046.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48ee3c9-1388-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772161409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161409, "uuid": "b5fcdc5c-d659-40bb-b1ae-9f665fcf4987", "comment": "Malware payload", "value": "918c860d9a57281e52e968b862f8e84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161409, "uuid": "a834eb17-ec82-4bd4-bf12-dbcb849233d8", "comment": "Malware payload", "value": "4d4d5b5d5fec54523a8725ddfcfcfa38ab6887ecdbc693e5cd41e7f6b088c917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161409, "uuid": "3fee480e-4a1c-4460-9622-7d743fa1aa7a", "comment": "Malware payload", "value": "0e83095e51d0a73abde08934ec03113ad9da66a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161409, "uuid": "82cea1fd-cd94-4f57-852e-70d1d76e78b7", "comment": "Malware payload", "value": "88b864c1aa901a8eadc23f0e5ac63a2357380f8dd399cd93353e01ded4a84752fc4f801e82f71ee4e6bad390138640e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161409, "uuid": "8a0bd5b5-5454-4bed-9c8a-bc664df32363", "value": "T152F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161409, "uuid": "4dbf4107-dddc-4594-949e-a7b2229efd06", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161409, "uuid": "932a78be-5d54-4d24-8a7f-e8cfea9a6249", "value": "393216:Yn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:Y1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772161409, "uuid": "d4f3897f-c174-4814-986c-3d0f7e8a4a30", "value": 71462912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772161409, "uuid": "aac39a95-4023-41d0-b31d-ca24bd1b3311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161409, "uuid": "bbb018cd-26d5-44b5-9d70-7d62a352bd88", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8f86d5-13e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772200369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200369, "uuid": "929fa6c1-94b9-4ab0-a8df-bbcd59ce29d2", "comment": "Malware payload", "value": "51a34a59f7c54f06fba5d24aad41267a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200369, "uuid": "f75dee08-079b-4ca0-bb78-c20f96bee681", "comment": "Malware payload", "value": "4d91ffd1013a8a494e36e8862729d0ed60ffa97b4cbb99122560df8904e6423e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200369, "uuid": "02c1222c-cab1-4a11-90e0-d7b9506c4ebd", "comment": "Malware payload", "value": "3f287066206f46e8c7848ddc63d017fe14b25b6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200369, "uuid": "923e48a5-88c3-4140-a4cc-f1ed1a6322e4", "comment": "Malware payload", "value": "35bedbe42d02bc90a7cab434692793782aee11e8951f6288c05a5702fcfc27122d7d9d426b78acfe8ff0d0288f743ac3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200369, "uuid": "0cfdb858-4de4-4429-8c49-6bb2af4d6c27", "value": "T1EC32567B21F08B32D7D410C963B61A614E72A70B496614B9F4FE5739AF2DA0370E7B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200369, "uuid": "7444d8d8-d9c8-4ab1-ba16-074c2d061b81", "value": "96:cCuolB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjKlWXaEXHArCAr8yIok:cCua6p4hvZ5mN9oKNpivAwRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200369, "uuid": "f5db9401-dd7f-4de4-bf39-9bd5508f3d75", "value": 11969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200369, "uuid": "b70f6e33-ff40-4419-b397-cfcae0e69af4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200369, "uuid": "83ac9e8b-6998-40de-a4ef-087d6926b286", "value": "4d91ffd1013a8a494e36e8862729d0ed60ffa97b4cbb99122560df8904e6423e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceb3f40-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223995, "uuid": "c45fd8b2-0e20-45c8-8aed-19e454f92303", "comment": "Malware payload (Mirai)", "value": "a6d553ceba838a7675dfb774ed3c04b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223995, "uuid": "2a804f6f-36f1-49d6-be33-34a69138386c", "comment": "Malware payload (Mirai)", "value": "4d97754f8813acfe7f86d6df6dbea2cf3e2023912396f2b65ccedc2be822e560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223995, "uuid": "c65a5763-f6d1-4141-afc3-4b56d1b2814a", "comment": "Malware payload (Mirai)", "value": "68ef4c16fb2bebe567d2d97f62bf1bd48841b2b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223995, "uuid": "2f741685-aee3-49cd-898f-9da5244f9225", "comment": "Malware payload (Mirai)", "value": "53659851a89450c33af32c7407e364f4366cb9c102ceb9776b605b11edc8f74a1b191570211ae7b71d17d18e5b1d2de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223995, "uuid": "ff39ec43-ec78-4696-aa2a-69fdc9bf7c4c", "value": "T174733B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223995, "uuid": "c2e10cc8-ad8e-4bce-8912-2357559623ab", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vN2:uB/VBBpCO72RDRZN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223995, "uuid": "ce8afcc6-eeef-4105-bdb9-ee0118815f86", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223995, "uuid": "c2ccdacc-7452-4776-9d4f-e3702a217383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223995, "uuid": "ed4b3c39-34c6-4646-ba22-bab7049aa74c", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebd5fd4-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236320, "uuid": "1f9e96ad-182b-4e79-9f80-350147bbe10a", "comment": "Malware payload (Mirai)", "value": "76a5fbb2f4296e2b1d2322fef70c49ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236320, "uuid": "24f4e2ff-5b94-494c-a46f-fa8eeb85149a", "comment": "Malware payload (Mirai)", "value": "4e0ca3aff2f300ec286db6387653c23b81462dc18afcd9d014951f66f83af4b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236320, "uuid": "dd0e4950-0739-4767-b255-01c342328221", "comment": "Malware payload (Mirai)", "value": "0ab992e229130698a6d26afca862366c4c6051f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236320, "uuid": "344a1de7-0542-4950-ba7f-7204b41825db", "comment": "Malware payload (Mirai)", "value": "365abcd055bfc787df3e3af63384975f782e7e8bc55823ae6df83115c12bdbff0a7f2e3e5be93920b9947a6e63c88e74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236320, "uuid": "80be4e50-94d2-4cfe-b66b-317c74b67204", "value": "T15AD3AEA7F64B05A1C85306F80BC75BCD2E6322A1AF1BC9E37C5E253B1CB80DB5506B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236320, "uuid": "2a493036-0143-4d59-b45a-9d8ef9edc608", "value": "3072:JsUhkJ/0AyY71XXYqmtUPF9qz5Y4agpgqql:6eiYqmG99wD3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236320, "uuid": "194504af-44e1-49ab-badf-756384a0aec6", "value": 134004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236320, "uuid": "636de125-b310-457c-89c7-612688df6786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236320, "uuid": "4392008f-8d96-4a46-ae5e-1cd2f9df8fb2", "value": "bin.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f22fd6e-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772211517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211517, "uuid": "4761496a-36ef-41cc-b9f9-d35ae0226961", "comment": "Malware payload", "value": "3b542ed80450705a0d33d71f1c2c2e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211517, "uuid": "8f081033-3316-4396-b68c-5dc5dd9acbaa", "comment": "Malware payload", "value": "4f67383bf43d2b94c7fb51f57815d135e7f8b2d648065d0f67bd582d86fd43b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211517, "uuid": "e1239b58-7082-49c2-8912-690e784864ea", "comment": "Malware payload", "value": "dcfab249b5eb884de35470f3d1f702b694ce8f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211517, "uuid": "c915160b-e247-4e07-ac91-6c6f1220fda1", "comment": "Malware payload", "value": "003ea0134b5a377237732e21d2ec497c83a51da4357cdf05f628f952b5bc5c095233d8ce3f7f2afbad42cea695333823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211517, "uuid": "707143b1-8fe7-4546-a8e5-db919dc34549", "value": "T1CBF6331D269F2FB7E7A7E73277FA41320FACA21B54D1C93724A81641C79398D3682D84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211517, "uuid": "d67fab02-b577-4d14-a260-6ebb5ea15379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211517, "uuid": "572dcb25-1584-4b91-b088-188c028eab7d", "value": "393216:9pTR0ECKZ9qZ5Ok9zhJztgYiRpReRHwGmRD/0DJR8RpF94tE+y0J:e/y9qZgk9zbWYkpReMMVWFnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211517, "uuid": "d08585b9-129c-4b6c-99a3-cb57adbe9c9e", "value": 16673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211517, "uuid": "424e78d6-c28d-4a15-b999-41e6d61042fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211517, "uuid": "64b0815f-7c19-4740-a2e2-da53f276d872", "value": "FRPWrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94ed25c-141b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772224499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224499, "uuid": "91d9adf9-fdcc-4cd9-b5cb-67691c649ccc", "comment": "Malware payload", "value": "991da97bca518df7f1f3bec116667fa0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224499, "uuid": "98fc1348-3f1c-43c6-984c-8d7c6027e1a0", "comment": "Malware payload", "value": "4f89cfa16d3848961bcd55d3dba7693e942f8cc41acebd1569b2cd9e25b4eb6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224499, "uuid": "f49a3e62-d3f3-4710-b694-bb3f6c9c8641", "comment": "Malware payload", "value": "d1ad6de31a50f3d3b097a04f64ef355eba654ced", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224499, "uuid": "7aad2447-44b1-4889-937d-f749cc5cd8e9", "comment": "Malware payload", "value": "f317a955bdddea1f475e31ad4acb12cfb9851f46ffeca0f9c967d1d45794c55fee85a7e1dc8b34a1cfab58629da94752", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224499, "uuid": "1710cd4f-9543-43fe-b6f4-2658d9418b53", "value": "T1F9924BA916496C79BBC0DE7D9F3C7F0CADE4C1C02119A3ACBA4F39718A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224499, "uuid": "c86ae64b-4870-4816-a16d-74284af82f72", "value": "384:of0M3vgRjGlsaq7rzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:oLmjf/zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772224499, "uuid": "cf1598a1-dfdb-4d96-9fbe-563c62e21530", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772224499, "uuid": "da847539-13bf-4cca-bfd0-676eb9343323", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224499, "uuid": "f4241700-d921-4b86-8ec4-cda76031a695", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a700e22-13d1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772192638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192638, "uuid": "27c32d5e-c792-4d48-9bb9-004a0aea6c7c", "comment": "Malware payload (SalatStealer)", "value": "ec9edb4d4360c7c06c99331da333a738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192638, "uuid": "1efc98a7-48a0-4515-b363-861bc7a927dc", "comment": "Malware payload (SalatStealer)", "value": "4fb55a214b5bd752e351a18e6fcf33ff36d87305b1cec8f0cf69a41bd060e314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192638, "uuid": "99849b9e-db92-41da-b2f6-4c39a7501d8e", "comment": "Malware payload (SalatStealer)", "value": "0df3e8c7ddfb084cf8af78239de24a743614a1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192638, "uuid": "94a05f43-0ed6-44c0-9068-401977bab299", "comment": "Malware payload (SalatStealer)", "value": "0d2920cb77b703c6f604b842e3fde893b3a909e4117812e2626a650f93a937d83d19ef7c2c42c67bd3f845186964d12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192638, "uuid": "05562eb4-0eb1-4465-be57-5842da1b8657", "value": "T1808633197DCBD4BEE1529075924B87267EB5F8CB5F72A47F05F940A81F6C8F0AB28090", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192638, "uuid": "1a3d7ed6-0164-4f6e-a09a-1a04e0d972d9", "value": "ff0716081048e86357074048f26b0458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192638, "uuid": "0e8cda45-25e1-4e22-9a79-a356cc0963a4", "value": "196608:sv6tn/WgVzHYN7LgDqH+Uvu6ErWUdbmGIprQ:865/WgN41gImbd5IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192638, "uuid": "6f014e08-c586-4b82-ba09-2be785098f7e", "value": 8233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192638, "uuid": "38f28a26-020e-4dfa-8df1-0cf6472d9b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192638, "uuid": "8751e208-5047-4231-a428-d9a9736238ff", "value": "ZcaLoader 3.0.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05edacdb-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772209569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209569, "uuid": "617d54ab-b943-4418-858a-da5e7d9d1722", "comment": "Malware payload", "value": "a0d61569ec8a7229ae99eba0e736b32c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209569, "uuid": "688e2fb0-6c21-4648-9a45-d34c0f7392f6", "comment": "Malware payload", "value": "50097efb04f5840ff053ba4cb7c37ae33ba09badd113c8ed52ec31727698eccd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209569, "uuid": "4738b0d7-3a18-4d5e-9e44-c22501257467", "comment": "Malware payload", "value": "8c0b778d701a801a2ca46dfbaafc97d43a0ebbcd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209569, "uuid": "f8e25a3a-d7a4-4770-b98b-a0665c88bb20", "comment": "Malware payload", "value": "72376d17d066b95c21264dad97e5a05ed911e86b5238cf843e665410fdac6f7bf98ea0b5ad3c44a7e8c87518a826aa55", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209569, "uuid": "1e65d303-46f9-43dd-99bc-f24448b6d3a3", "value": "T14F924B7916496C79BBC0DE7D9F3C7F0CADE881C02218A39CBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209569, "uuid": "6b61839a-3f0e-4ca9-b3f6-3e6bbdce9d2e", "value": "384:A/0M3vgRjGlsaq7bzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Armjf/zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209569, "uuid": "c95baf1c-ee97-48ac-9396-fd75f398bbbd", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209569, "uuid": "be3b6ee1-0e1b-42c7-a6a9-43b04651f968", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209569, "uuid": "e5f52c4a-cdf9-4f69-aacc-e188072d0db6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3236a8bc-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175283, "uuid": "ebb81859-8b65-4689-b20a-6064aa35d623", "comment": "Malware payload", "value": "ddd6ad41dbc0992c7b4d8cf609213c31", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175283, "uuid": "ce535b5c-62f4-4bbf-b209-0c4b51c0245c", "comment": "Malware payload", "value": "50e8f85878234db719b27099ed389426f0c25e78bcce9814226c3b3d55ec99fa", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175283, "uuid": "8be5c807-b7da-4912-a0ea-4cc4a7efdaee", "comment": "Malware payload", "value": "231dd870dcac0816601c2210a63a5d9f0f45ba82", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175283, "uuid": "3112aeed-4bcc-41ec-a8b9-99ec6c2a61ab", "comment": "Malware payload", "value": "c218332e961506a3533940c6e71ce59eb526c33fa9f763c5cd1fb0b872256724a29ce7e67ca07a72bcad07deea3dca8b", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175283, "uuid": "5ef73a4b-a02f-44ec-945b-9f2029d55c54", "value": "T140A633A856F5CCE9EDB7897ECAE6820EE275B9311F35CB8387A450911F337C81D66600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175283, "uuid": "b3139354-5fdb-435d-89f6-2037d915051e", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175283, "uuid": "9d107830-c974-4740-975a-a816e50e2d2e", "value": "196608:Vckqh7O/c31W903eV4QRItpDjIIAcwDxp9RPuvvk9wIiFy:6nh7FFW+eGQRg9joxp9vBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175283, "uuid": "b11a743c-f8ea-462e-ae14-75c2c90429b1", "value": 9709748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175283, "uuid": "21dec29e-cee4-4049-ba7b-ebca0a0e9c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175283, "uuid": "671819a3-9ab8-49f4-9731-3038e3eaf16e", "value": "50e8f85878234db719b27099ed389426f0c25e78bcce9814226c3b3d55ec99fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed32677-139b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772169426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169426, "uuid": "e6df388b-b83a-480b-aebb-ff6198c9fdf1", "comment": "Malware payload (AsyncRAT)", "value": "75128da49aa260ffecdbc797347ea0ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169426, "uuid": "9bebac61-5240-4648-8b4f-efb6f949beed", "comment": "Malware payload (AsyncRAT)", "value": "526997b4cd3ae1f931034709af9a787bdec83dcbf541fbcd898922b0b56f15c3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169426, "uuid": "7435b25c-d3aa-4d66-8bb1-9d901958d30b", "comment": "Malware payload (AsyncRAT)", "value": "7148f625d533228125b93bd1066f02ef978d8417", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169426, "uuid": "b78bb10a-72e8-4621-893d-18e461feb1f2", "comment": "Malware payload (AsyncRAT)", "value": "4c024ed1033774ea97f17980196af08255c2498049f9147476803a40dda197d953b07f1d19b0bc03c840c9de0b56246e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169426, "uuid": "3d3bbf94-56ac-4b79-8514-fa57b308d4f8", "value": "T148E23A0573E49816E1FD4B799C3292009336BA879933DB9D1EC854AE6A23788CF14FF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169426, "uuid": "b5c77e1f-4e2e-45ce-8d59-0111d0a55590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169426, "uuid": "5b99654c-a42a-4a7e-bc4e-ae573820db3f", "value": "384:Xee+ysro7ww0heDU936QLIeDfYN+oQ793bayse3QxnC7M+WJgIuucCcrmj5EQ+:Xee+20heDojUe0YjRbJABWWeg2Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772169426, "uuid": "804a9512-ad3e-4bc5-a3da-f2343d3ae5df", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772169426, "uuid": "8fec8eb6-d93e-4016-8516-bdc7963e93d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169426, "uuid": "839d0609-468b-47e9-852c-4cb19b7945bd", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ffbe9e-139d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772170349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170349, "uuid": "cd801c1f-5aed-4685-9cdb-e21ab2970143", "comment": "Malware payload (AsyncRAT)", "value": "f4414f4af63329bb96925becbae85796", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170349, "uuid": "d4015c0b-2c25-4a85-ab33-b37baa89cba0", "comment": "Malware payload (AsyncRAT)", "value": "5281d5661a641e922d5ab6285dc31ed758ae4b7767f78907bdeda7326838ab5e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170349, "uuid": "53019372-f189-4dd4-94dc-3652352a1321", "comment": "Malware payload (AsyncRAT)", "value": "abfdf6d6e19cf24f57a72c9723835ba5dc16b2eb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170349, "uuid": "158e9d35-2764-43da-a66b-f63c501e7511", "comment": "Malware payload (AsyncRAT)", "value": "08048b922ad909ebb0eb21793a657e1dccfa052a3ddfc19b1c13997b9891b0922d575710bddbf7f74a72ec95f5df4b23", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170349, "uuid": "c9cca02b-73fd-4391-8b4a-a7926190442b", "value": "T10CD24A08B3D88561E1FD57B94D7293048771EA5BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170349, "uuid": "5c630822-5c39-4205-8b51-e0f32b0e827e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170349, "uuid": "dcd69699-b8f1-44d3-a185-ac5ce79ec62b", "value": "768:/AMRXpZrm+iUg/cIRGqoW/Rb7fB/dTh/+:4MRXHrm+iF1ioRbN/T/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772170349, "uuid": "fea2ff38-fac0-4432-ba57-fd12c6da85e4", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772170349, "uuid": "d8176ebd-be97-41eb-bdcd-25e74a313d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170349, "uuid": "c7c457cb-f32a-429c-9306-ba1925dd5609", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0f2ef7-1427-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772229683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229683, "uuid": "cf9a0df5-1e2f-4844-8ad5-be6a3c61dd80", "comment": "Malware payload", "value": "8d334ed6f0e6602176422e661f26f800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229683, "uuid": "523ac34d-1bad-4ce9-8294-375777dfa6ed", "comment": "Malware payload", "value": "52ad513eb1e7681527174646c6769695896933b086b959062a3cbf585eb38d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229683, "uuid": "de2652d7-e04f-494b-89d4-9f3c8e295e62", "comment": "Malware payload", "value": "c418c233b15bf282d09fb18275a91c9d0be03db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229683, "uuid": "9f8ab22e-5f1d-4756-9f7d-cb3576caa222", "comment": "Malware payload", "value": "8386e195217cc01a4dcc32da5453249fac6b9c042133a635d806d9e76cac4c49dce17ce256ba2bef244c6d4198f36022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229683, "uuid": "56036e50-6486-43d7-bb6a-c23ec156c93a", "value": "T17FD7338889FED17BC4019FF891806E7087D94E3A4B190C271D9DBBAD35BF680B86D917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229683, "uuid": "95c280a5-2de7-464b-a58e-ac8fc2770531", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229683, "uuid": "a7b46392-b953-4d6f-9a89-f9912d838933", "value": "1572864:KRpWznspPQSG3BRcYzZGgUFpjrgyBDYFTQQAOT56Ge:+pWzgQ933Ug8ZrghMQAOTEGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772229683, "uuid": "0f0d4330-b857-4c3b-946b-55a1ad3172c9", "value": 62210720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772229683, "uuid": "534df398-4ab2-4099-b032-9abe6e4a27b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229683, "uuid": "ef9da363-c8ab-4444-b23a-f7f148b14526", "value": "IRS_pnXkel6pr1CAn44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f96570-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212149, "uuid": "3f40384c-e728-46b1-a8e7-b87b3a497207", "comment": "Malware payload (Mirai)", "value": "41060323b6ece7be8fed3cbf09bf5c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212149, "uuid": "fe121ee8-b04d-4f1a-aa09-a4e6ad3f0ea5", "comment": "Malware payload (Mirai)", "value": "5307e9f904db8954f0914f2032aa8a49f8a7e42f69cba1a3f507834519f8c6eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212149, "uuid": "8e526e8d-e8c9-4b08-843a-60f4749c4068", "comment": "Malware payload (Mirai)", "value": "5808bdfbb02a2ab4a34cf683d6db5dc6fddcbc1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212149, "uuid": "6886588c-e369-49db-96bb-42b296edc796", "comment": "Malware payload (Mirai)", "value": "665a0960e24542d986a39fec5b039081425102e723906b3600dc85ab9d5b9ee164f276e83daa989e247f27cdff43984f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212149, "uuid": "429c123e-fc5a-45e3-b636-df9f5563dd00", "value": "T14DD35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212149, "uuid": "16e606ce-4158-4da5-844a-29edcb3087bc", "value": "3072:CV0zui1ZhMHJ8A+qrFP7OUK3y0uMg9FkcH:LP1YM857OUKC0uMg3kcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212149, "uuid": "188e4d66-96b0-4796-83ba-a81ebc80f36c", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212149, "uuid": "9c56dce8-6308-46e6-bfeb-09b4583ff729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212149, "uuid": "4fb06a71-efaa-423a-9aba-28ec479565a1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0ad41b-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212287, "uuid": "0a2daa29-b0fb-4114-b2c6-772c9de65bdf", "comment": "Malware payload", "value": "22191597493978406587ea20107af3e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212287, "uuid": "d6668fdb-c809-4877-95f2-fb36735dead4", "comment": "Malware payload", "value": "5522ea0fc68d4058235ce9d68fd79ad76a39f84e874882a24faca3e9730e3858", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212287, "uuid": "582c3e4e-2f2b-4149-a478-b550369746df", "comment": "Malware payload", "value": "658d253c56f5231080c3e03482216054718816a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212287, "uuid": "6bea2806-e66e-42d7-ace6-ffacd98138d9", "comment": "Malware payload", "value": "f9494fb21806b27937aab2a5c56da099c457a93d964f46e6cae4b305b7323a723cfe9cb507bac17fdab9519b38ed6360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212287, "uuid": "ef3c07a7-5260-428c-a0a5-7703b5dee0b6", "value": "T18FC4EBDD2EC1F15D0F829933F20AF06EE4F598F0936A5C69A0DC6C48F8A16D4ED19639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212287, "uuid": "5f79399a-0a75-45a3-9942-63896d175a7e", "value": "6144:3DOOfrx3Wogs0JYKtAEWMrQ96jEfTapcfExN0yRfg5s:3SS0MMrcu+apTxN0yRoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212287, "uuid": "2bef813a-9a7d-481b-852c-dd465237a2ca", "value": 554103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212287, "uuid": "7b55e6be-64bd-4733-9c8e-fc209555d16b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212287, "uuid": "b468ae18-c641-4378-b76b-fe0645aca110", "value": "22191597493978406587ea20107af3e1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b850f8-13ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177079, "uuid": "9cd6a2f3-c0ef-4706-b6bb-7b00643d5cfa", "comment": "Malware payload", "value": "70476e70d5355f590abc0ad5383f8414", "object_relation": "md5", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177079, "uuid": "88613fe4-9ddb-45f5-a538-7ee835024c89", "comment": "Malware payload", "value": "55ae12e61dc96a1a8446fffdec6e6eefb5fda8b261cde801689ec344d422edb2", "object_relation": "sha256", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177079, "uuid": "5b70891a-9a20-43f7-b409-6e7467b45205", "comment": "Malware payload", "value": "a433712a0f66a7b5e04362bcd31c4df50af44cec", "object_relation": "sha1", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177079, "uuid": "6e98fe8c-120e-4b71-97d5-418d35ce41d0", "comment": "Malware payload", "value": "6713141b90d677d358b924a9eb2035793fc038b017b412bf5e53b73dd211a7ee8f4e98a3888f8de09cdbadc059189c12", "object_relation": "sha3-384", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177079, "uuid": "c5c21f36-d10d-4cf6-ad77-96e06f248626", "value": "T104A16D30055441A9D996DCF6827C67C6AF9F4ABA9253C0C0F18B812790EAFC0671DDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177079, "uuid": "4a84af02-466a-4653-aa12-77188ab4102a", "value": "96:VnCNDBkZCNfOIZTDecoFdRH9jaU5e5oB1GPKoBsHUUPgqSEoeEUHwL3XqKXXjIuO:VCNDB1NfdnQdjh5ek1EbUPgqtEq01nUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177079, "uuid": "d355545e-c1a6-4bb3-886d-bcaf9a51517e", "value": 4778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177079, "uuid": "049b1087-289c-461d-be7c-97f47b755b19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177079, "uuid": "70f97fca-e5bf-48ba-80fe-ea6789c595e6", "value": "bff892cb89cbc5cd75ed80be990d5dae428e4d158bda8202da6a5e6543a8eab9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c551f5-13af-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772178140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178140, "uuid": "0589af99-fc24-4726-a4ac-4fa87bd77332", "comment": "Malware payload (AsyncRAT)", "value": "ab8d667009819e40ed8076df4daca3f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178140, "uuid": "eee96825-318d-47db-b608-e20c79684015", "comment": "Malware payload (AsyncRAT)", "value": "55bbb15df2cc4bf59420fd6df7e9164e11c4ab8c8604a3fe000f0ac6c4b25836", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178140, "uuid": "3a40a477-6fa9-4674-91c2-c4930b091898", "comment": "Malware payload (AsyncRAT)", "value": "c61fa9fe147175b27dc29a4783b50c8118bafe54", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178140, "uuid": "964e357e-6c5b-48d0-81e5-2f755e33e1b1", "comment": "Malware payload (AsyncRAT)", "value": "c5a28a148a841b406fcee1f3bcfe0b9385eac4a6a31ef24a31f53030460ad4deb4293b0ccc4cc6fd55257b14bd456779", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178140, "uuid": "b5d5e1f6-1a6b-4c13-82af-51da6362c244", "value": "T14BB423C8D286D41669D115F660B5BDD06CB54EF83C661A37AB2D0015FFE4D2B3A1E0E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178140, "uuid": "b2c577d7-45ff-48db-93ba-fc8ce34d444a", "value": "12288:Y+sC5bOXw14yBP1N8M0XWV6Amhg+Lai+vo6CohCu:TTyXdSIM0XWV6AmhgIai+hVIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178140, "uuid": "327d2992-ceaf-4405-9f78-4ffb52166c21", "value": 522234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178140, "uuid": "065124e7-8bd3-46ab-bc94-cb08d1fa0f5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178140, "uuid": "82bf87c5-2b10-4ae7-b108-731db48e6c88", "value": "FreeFortniteCheat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be42058f-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772212455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212455, "uuid": "eb66e34d-9915-4e53-b6e5-83200a3c08f0", "comment": "Malware payload (QuasarRAT)", "value": "7d3429c94fba92e0427b842ecc36e5c7", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212455, "uuid": "1f909a8e-06b6-40ea-be86-0fefa0260092", "comment": "Malware payload (QuasarRAT)", "value": "561dea3827ffaaf208ace7cb3390725bff4f6c1dcb5fc83ce1efc00fe18f8ae8", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212455, "uuid": "b8e87eeb-b596-4b12-a8f0-90413a68ad58", "comment": "Malware payload (QuasarRAT)", "value": "784a2de3e2bdffff8a902dddfa3655f19e758a93", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212455, "uuid": "b82df94f-89e4-4b20-a099-85bcdad345ee", "comment": "Malware payload (QuasarRAT)", "value": "397ae458ee75c5ebb0f35c2c5d81384b91a460a445f2213fd8a878acdb4934707ff219f8e08332d669897c9d3fbdf416", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212455, "uuid": "1e76ff61-f3a3-46a6-ad6b-79955c40ef83", "value": "T18E751272070F7DBE0EBC2F1C905A3E551DEC2A87404C6552EFC8A8FBA2B55448E5EE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212455, "uuid": "dd92b66a-6f31-4ff4-9d86-5d207639e4a5", "value": "24576:0f36fcDPYscrUaAc6V5DGuLJwgsVZEOEnfcIrrOSnBFtCWu64493cKek:0f34yicJOMEDOmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212455, "uuid": "a024d429-d017-4352-a60e-a4fc953826d4", "value": 1560613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212455, "uuid": "0230e03b-671d-467d-a19a-065a2ff0ed76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212455, "uuid": "cbfb0aa1-3827-479c-a962-636a1bcef13c", "value": "7d3429c94fba92e0427b842ecc36e5c7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011de669-13db-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772196676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196676, "uuid": "49fb928e-fa77-4e56-8980-71be05d1ea13", "comment": "Malware payload (MassLogger)", "value": "b46bd92d16fadd2ad8f49de4195431b0", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196676, "uuid": "76bc5b33-bf6c-4702-8265-c0160e137473", "comment": "Malware payload (MassLogger)", "value": "56dc4cbfdebdb1c32f8331c34a2046abb4944e2a86be04582ea158644df76a00", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196676, "uuid": "fec829a9-7320-4e7d-aeb0-008cea9db546", "comment": "Malware payload (MassLogger)", "value": "215fde9c4cabe58af7d06605407285dfd53fbfd1", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196676, "uuid": "93106147-2c80-423d-b4f7-c2f8ce5b9020", "comment": "Malware payload (MassLogger)", "value": "bf9c57e996239a9eb02e402ccd1987e1128284bd12296bdaf0887cee4673ad5219be74e52cbd1553279912e6ee602b52", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196676, "uuid": "8fc7fe6e-0d3f-4768-a762-8f8ce737dea3", "value": "T1D762851A8C05DFF00A7D3291B55B781AA9100366B4782D8D7D9FC9AE3F3AA10CFD05E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196676, "uuid": "eb3c354f-04c8-4787-8d3d-78eb0c3a0258", "value": "384:K6Bnx1/RyPCoClLc0LBUYPFAzChFfdbMPTsgDSBMqjr:KYv/4OrSHzYVdbMPTsgDSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772196676, "uuid": "e8894260-d4ef-40b2-bc31-3da9cba6b36b", "value": 15374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772196676, "uuid": "9522a23a-acc8-4348-abb8-6a3bf29e8214", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196676, "uuid": "c7b70183-3684-40de-b6a8-526b2d78e103", "value": "e-dekont.html.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84e9fc5-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772179347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179347, "uuid": "6d479494-608a-449a-8e21-d368e75c7d71", "comment": "Malware payload (STRRAT)", "value": "40022f794f3c8e822519c73498ec92b5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179347, "uuid": "030c20e9-8d9a-4b60-bf34-be61cdd6ddfe", "comment": "Malware payload (STRRAT)", "value": "58e760ac5e689c48fddfef56e98e088d95b19838c0d6a783777b3fcb0698cc01", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179347, "uuid": "1c4e7cfd-4234-45e3-b320-0659ee11ce3c", "comment": "Malware payload (STRRAT)", "value": "ac5669bba03079a4699305312b35cb09faf29c1c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179347, "uuid": "688cd76f-9a3f-45fc-96ef-54860627554f", "comment": "Malware payload (STRRAT)", "value": "e397e12dd678b5d18b3dc4ef07f12f9b377b1f7d9426eeade4960025b8595531f2691d1606f90eed5baa25f2f2db6e57", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179347, "uuid": "ec982767-a3de-4cc5-91ca-09b0e9cb336b", "value": "T1DEA3F7547A44D07AEB63F1730958922BB974ECEF926469870FF0BC9DDCA98800F627C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179347, "uuid": "477c0636-56b6-4bfc-a713-c2f68e07a3af", "value": "1536:9B6y3vI8QZzUj+FRGeu7OZJJsKvGwrWXqeUoGKWx:9M6IfljgJ7uJNr23vGKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179347, "uuid": "7037c537-3c0d-4d4b-b9ea-2eb00e361be7", "value": 98458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179347, "uuid": "eabe0f29-61e6-4ddc-bbb1-d04b177104c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179347, "uuid": "5377fa89-c38d-4956-b18d-2e8d90ca2fb3", "value": "Teklif-Talebi.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b02b51-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772190699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190699, "uuid": "94fd1795-8d04-47d0-92b1-6eb69bc0dabd", "comment": "Malware payload", "value": "6a5afcf7a000d9083739914dd7b0809b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190699, "uuid": "4623ce1d-ad52-4d17-a9c5-57ea4a3263cb", "comment": "Malware payload", "value": "5908b45a76803c900ba2b3d307c4b9b0a51b5dc4af5c809f730fa778a3867f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190699, "uuid": "360f47d4-c93e-4a82-843a-659c1dcb231c", "comment": "Malware payload", "value": "ba23c5f2604786d7bf821ae3b240b91c4126e20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190699, "uuid": "6b639cf2-f245-4528-8ff7-5c2f2593cb2d", "comment": "Malware payload", "value": "dfd1345d8c3033ad9dda724ffd64f006c9bc6cf5e415bb092f23303d2c73b4044c519acdfb87652010ff2acb68c0a233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190699, "uuid": "f85651c3-a49d-4f13-bb5f-c84b9ffc54af", "value": "T15A363B43F89185E9C0ADD134C666D292BA707C885B3427D32B50FBB92B36BD4AF79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190699, "uuid": "cb940c7e-9770-4d77-a700-79da60c21d6b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190699, "uuid": "f8eee026-3c6d-4431-803e-492a555aa3a6", "value": "49152:4v4voD8CJADsrb/TEvO90d7HjmAFd4A64nsfJ8HQnPrUQjYdEBrILDel8Y7Tw5EA:wJADChHRaWOElC4Qmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190699, "uuid": "1df798cf-5f40-4db5-8290-6f64900ef3af", "value": 4933120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190699, "uuid": "d286d8f5-0984-4f27-a815-e5ea34df8d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190699, "uuid": "9b703a62-e993-4591-a1f1-e5af510db452", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785698ed-13ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177119, "uuid": "31a9cddc-b6a6-4eb8-9202-fe8d099f7a4b", "comment": "Malware payload", "value": "fb78680067d5fec230b789665c8ea8cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177119, "uuid": "0fb5c007-a59b-4d7a-bf92-7cc492b16942", "comment": "Malware payload", "value": "5990f979cf3a9162a5940eb3b76aec42cba8ab4a1868a7f8f779264c3e99fbaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177119, "uuid": "e240d2c9-a065-44e3-bc27-9da5066533b0", "comment": "Malware payload", "value": "bbc3a7c352bdc4ac9b81860f650e93f94a0294cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177119, "uuid": "69d8b3b6-0958-4005-8657-d6b2f41a97af", "comment": "Malware payload", "value": "ac1d234020c90f33f1b2fb42570571a6fa244c3f16ffaf099347a1ac1756e889d2539c32acfb75aedde27fe60945cd4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177119, "uuid": "4b86b163-6158-42fc-bd6f-6997e5fc10a6", "value": "T19AD3921653AE4248F5F7474E81AB023053AFFC76293F419D9661A2494FFAB049DA83F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177119, "uuid": "b7704a9a-58ad-4fc2-914f-b659c81525a0", "value": "1536:e60lVlVlVlVlVlDZe8pDHIvGJGamqlVlVlVlVlVlVlD:e60lVlVlVlVlVlHlVlVlVlVlVlVlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177119, "uuid": "800dbe6c-aee0-43b0-ad1b-876e04296aec", "value": 140764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177119, "uuid": "6d8c775b-8027-47b3-9ad4-4382a9ed98f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177119, "uuid": "3b305de4-644d-4d4e-8910-7e1f8109dcd9", "value": "PYT0021002025001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba78a8c-13ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772203136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203136, "uuid": "60df0f8d-b376-4cce-bc8a-f17290f28882", "comment": "Malware payload (Mirai)", "value": "911c94a1bba0a1f46fab63c09502dcf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203136, "uuid": "991f7208-423c-4b7c-a09c-178df4dcc57e", "comment": "Malware payload (Mirai)", "value": "5991d6fc024bad1cef61bb56db96122b0d9ca1809e7f3c8471dcb835449ab8ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203136, "uuid": "f3cb6265-9128-4e50-bfc4-212c736b7bfe", "comment": "Malware payload (Mirai)", "value": "93e1f1d001aab5333ed0b5115bc778bd2e851df2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203136, "uuid": "420b2604-904d-4a3d-958f-ee39fdac8be7", "comment": "Malware payload (Mirai)", "value": "ce0fa21827e03eaa62d745c19c855da1c68e7323a2d4d0dc444f81b0e7efda2cc95c0f7a64825a545c8c8f7ce068c865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203136, "uuid": "bb95eef4-9a3b-48e7-9147-9e534d918c40", "value": "T184141A45AA414F13C0D627BAF6DF42453333ABA493E773069528AFB43F8679E4E13A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203136, "uuid": "2bcb5e8d-4448-4abf-a261-500fd8f344ee", "value": "6144:16eRi44/ZaLl5buuuFnLLmOJC9M/RBxRQ:ce34/ZaB5buuudLCG/fxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203136, "uuid": "47e0732c-5192-4a7b-ac1a-0bf4175648a6", "value": 197753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203136, "uuid": "476ec066-74ba-4949-9f89-d89d1455c8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203136, "uuid": "9bfe6ace-9e38-414b-be95-f0173a9a3f1d", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3d8ca8-13ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772203382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203382, "uuid": "c031daf2-39bd-45f3-9da5-8534bb30892a", "comment": "Malware payload", "value": "68d685a443496548f4995f28631b0bae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203382, "uuid": "6a8f75ac-3ead-48bd-82a6-00c11d1d7225", "comment": "Malware payload", "value": "59a7742bbccbd1d4bb11ff3ccf9145c823b29befbf7b17862cc9882c5d67aa66", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203382, "uuid": "3334ec40-d997-4f77-9176-849c386e774f", "comment": "Malware payload", "value": "a2524daa37d77d90731cd2197e45324ab5fe9a72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203382, "uuid": "82236be5-b03f-4c0d-8fd3-551d63e5b022", "comment": "Malware payload", "value": "4288286e680fa1aecde1543a7da1ced0d958df125b6d2093c02e0735d573caf1eab4fdf64e36094a449a9d9e29679f40", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203382, "uuid": "9b411b9d-bfd9-424d-98fd-20fccc266188", "value": "T1D042387621F08A3397D025C4A37717A15F72E60B44A724BCF4BE1A399F59B0370EBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203382, "uuid": "2e20cbe9-572d-4179-97ed-f2b50dc74d83", "value": "96:cCu/mB6n7sht+O+v1fsn+h4+tIicqbA/GsGqNz2rJO11IB4IBq5rC2OJyJpJDDA7:cCu/K6nC4hvZ5mzjE+f1miM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203382, "uuid": "e1f753fb-132a-4c70-be58-8eac9c3af00e", "value": 12732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203382, "uuid": "0a61e613-38d4-41a1-9e00-2641fe15695a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203382, "uuid": "55b09887-1381-4d98-9af4-ed85f4eb4a8e", "value": "59a7742bbccbd1d4bb11ff3ccf9145c823b29befbf7b17862cc9882c5d67aa66.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d8fcae-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772179526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179526, "uuid": "7829f468-48f4-4ed9-9a5a-da1fb1f81393", "comment": "Malware payload (Formbook)", "value": "01128688126c361fc9ff77c07170f952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179526, "uuid": "3dbc0303-325f-49fe-afa3-a9b58700bc4b", "comment": "Malware payload (Formbook)", "value": "59db173fbff74cdab24995a0d3669dabf6b09f7332a0128d4faa68ae2526d39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179526, "uuid": "c7bd10d4-a684-4327-9067-4c2b6fdf641f", "comment": "Malware payload (Formbook)", "value": "b824a92f5be8c88bdafbb974cc42d2d35d5447f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179526, "uuid": "a5c63e99-46ef-4496-b1a8-96d9fe88c6c9", "comment": "Malware payload (Formbook)", "value": "57c7284561cb9113a339cfd1b372f00aebb42f0e78d042704c029a3cc57aeb96cf43941fac63e899256e313aafbc0db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179526, "uuid": "4f884735-0bfb-4b82-887f-c82c669de141", "value": "T1B6B4E00A765964FDD55BC5B8C6831562AA737CCA4B31AAEF0B980E756E236F44F3C300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179526, "uuid": "28ed0833-6f10-41b7-9f6d-8dade322d9d5", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179526, "uuid": "786370c8-929f-45cf-84af-8c6cd2c3b6ef", "value": "6144:LzDb9Qi3uO5hjk3F1Xly5XJsBolZX+EoQNzC+HkuQSyu1JhhqHfbg8FbqKhc:twO/jk3vDErNzmSy+cfvvhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179526, "uuid": "e566cb42-8976-438f-8d04-6e024569693a", "value": 495582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179526, "uuid": "1f2cf8cb-1c04-4720-8489-4f4281f81d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179526, "uuid": "306c46fe-0c9d-4d33-abc7-46a5e28047b1", "value": "INVOICE_SOA-JAN2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5367c84c-1405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214853, "uuid": "4f48f894-0d49-4995-848d-38df35aac5e8", "comment": "Malware payload", "value": "fce0f5cbc02c6a64819eb29c8329d512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214853, "uuid": "d50a37e5-6b29-4e09-9b14-1876eab8d5dc", "comment": "Malware payload", "value": "5a535c935bfd0dd1a702999594d38317c50bbee197915e151d4b3cf8b6388df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214853, "uuid": "684717a7-827b-4dc1-9a23-32e193be4392", "comment": "Malware payload", "value": "10d2939f3e8dce36364eb1e3751e4d55e6eb704d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214853, "uuid": "6b765093-4d4b-453c-89ca-7abbaad2b719", "comment": "Malware payload", "value": "b9c982faf6bf97c1e2d46d3725a7f27e32411391680c2a5343d52773db525915bcfe1571d0afc9a9f8876913b8d34639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214853, "uuid": "7aedb7a7-f3a5-44bb-bbf3-dffaabef5a1f", "value": "T1CDB64B05BCC42BAAC46C4E7494FACA5122B05E144AF1466A6165FFECBCB73797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214853, "uuid": "df1e162d-0784-41c9-a062-82406d6f6457", "value": "98304:wfCDV7MuE+JPW0ZGOeLQptPlOyGQcIGCX4Zcxc:OClML+JPW08OeL8lOczJX4Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214853, "uuid": "29aa906b-6ffc-47a2-bb16-a0f08efbf7d8", "value": 10897553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214853, "uuid": "b2e9d3a2-cc25-43d9-90aa-304a40127efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214853, "uuid": "169fe29e-43cd-4724-9240-8bdd3581dd73", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50faea64-13f7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772208836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208836, "uuid": "4b585e67-f8d0-4a1c-b776-4c9f5639f036", "comment": "Malware payload (RemcosRAT)", "value": "159cc5cd2508f397e5ac9db39cc8b975", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208836, "uuid": "ece6f51d-9301-417c-b91c-fd0b0dda531e", "comment": "Malware payload (RemcosRAT)", "value": "5bca3058243219c7f9e60effd55f47a89e796cfdceefc2aa52bfa034a0d3afce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208836, "uuid": "68019d7a-e686-4287-83c4-655db4697f90", "comment": "Malware payload (RemcosRAT)", "value": "9fdc8af6793fcad211beb35273cba6a7360d5e1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208836, "uuid": "58755e0e-25e6-43e4-badb-74662ec8ebfe", "comment": "Malware payload (RemcosRAT)", "value": "9252ff445265d8a03e5329e53bde0e6a9667d858b5b08e97cee88e066f72a7fca2d3a4c386a2a13f1be7e839347d6476", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208836, "uuid": "53e73375-d453-49e2-9286-d447cd2ed18c", "value": "T1A266B54597E76432355AAB0C673A9AF38A2529D3ABC1CF0234718723B409D0BE715BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208836, "uuid": "9554722b-e4d6-47b7-8a67-ac74657a4a9d", "value": "98304:2SyI5e2Aa9qh4lIiceboCRb4SZTdgdzebWpv5p6YkrHeJCxr0YeiAoD17H+eAmVW:ryIK424bLSZeipvv+wEr0YD1+xoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772208836, "uuid": "ce83eb1d-9449-416c-8c62-014d984bb58a", "value": 7048419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772208836, "uuid": "3943aa9b-a5ac-4e94-9867-813aab86393e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208836, "uuid": "c5b9d3e1-d4bf-48a1-a2e8-c1a030e147c9", "value": "United Overseas Bank_Payment Advice.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51258f1-1385-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772160148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160148, "uuid": "2be3a09b-5c60-4372-98b1-eaea1933bee1", "comment": "Malware payload (Mirai)", "value": "ec27fa583e31f270ef06d45255791d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160148, "uuid": "90ca3d2e-a9e1-42f5-9005-3a2fab2093b8", "comment": "Malware payload (Mirai)", "value": "5cee3daa56dd53d99992cebbd5e5a6e823299ff5e00a37454fed98b5dbbafaf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160148, "uuid": "5be945bb-6645-49c0-b030-cb1ef3fd0de6", "comment": "Malware payload (Mirai)", "value": "c122c53b1040e7f31b53aae059a81d7b5be5447e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160148, "uuid": "361b9035-49e5-42fa-9882-aad4c5bf2b42", "comment": "Malware payload (Mirai)", "value": "44555792a98e44405dd34b68a19e58753f7957bc72829dccc4ee1ed96dfac4bf1f4d414987a110cbd86cfc873c9ecc2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160148, "uuid": "4e9c2d03-a2f3-4f08-8a7f-5447cc39aaed", "value": "T1E3C32902F98184FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AF123D4AE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160148, "uuid": "d01a9a0b-567d-4dd0-b353-ce741246c750", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BuwGoTgzQLAdojgaR/O:eH3TghM/1weZbcnITeyosFAIxnJdhgJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772160148, "uuid": "510a32e0-5e0b-43bd-b4ff-7e546e08047a", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772160148, "uuid": "e449b2ff-73f6-49e5-9029-dd18c23ae19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160148, "uuid": "8e047e5c-5eba-41f8-b47c-fb5cfda88b93", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9911d0-13d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772192481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192481, "uuid": "02a43b2a-e524-4108-baf4-67012a7a6de0", "comment": "Malware payload", "value": "e4e162d5d59e68345bc9e6088e5dfd8a", "object_relation": "md5", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192481, "uuid": "0f7135ff-84ae-449e-b0ac-1be4ab071689", "comment": "Malware payload", "value": "5dcb1b91f204f55fa6e385913ff7cde95f0b7c0e40c2808540c1cd8db94442a1", "object_relation": "sha256", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192481, "uuid": "988ecd98-f333-4642-9de4-f4c163ba6581", "comment": "Malware payload", "value": "3aa4d9dfc3712a652f22c2e244213d45d5cb7070", "object_relation": "sha1", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192481, "uuid": "0ab4fbb6-5f04-48f7-a211-cb4bc1b9814f", "comment": "Malware payload", "value": "988993ec32b9a4cc4752ccfb0405d0f663c0b58e22aeb2298973cbe41ad40c3661c7c8fd3d894bad937a4c340ffddbd6", "object_relation": "sha3-384", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192481, "uuid": "4cde8ed6-e900-40b5-806f-f514fcb9b4af", "value": "T10F6533BBFA57EDABAC531E2B32486A74DE14C963B813A8C5E610874606F15427D2F092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192481, "uuid": "c6c17872-0e58-4fe1-9242-9e4cc7693af1", "value": "24576:lDrNH3EohBJZkY4BOzgttL1qePQyPNKJfZi/IyIHnK1CCy8GmKSRk+X6GcDLQT:lD5XEyJetOzgXCUNKd4/8HnYzESRki64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192481, "uuid": "11e2e3fa-e3ef-4de4-9142-58ac38daae7a", "value": 1455217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192481, "uuid": "39ca6db0-555a-4206-a24b-5f62439526b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192481, "uuid": "f4637232-3452-41f4-a8d2-9f7e88db1ba1", "value": "Activities planned.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9a216e-13af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178143, "uuid": "797d27d1-ddb7-43e7-9a2c-c2cf5b5804ed", "comment": "Malware payload (AgentTesla)", "value": "d6452b72a4eb73ac55fab6e42f3a33df", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178143, "uuid": "b2ef7faa-58ca-435a-9e3d-86e4266f2853", "comment": "Malware payload (AgentTesla)", "value": "5de1eb4c8c7edfef435d721a4173597b928c4cb9725a6ac20c5da7d086a333ce", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178143, "uuid": "67dd743a-6307-43e2-9a93-8792b31f6075", "comment": "Malware payload (AgentTesla)", "value": "a0a92c4a981439218b9426dfb901d72e1051d9e2", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178143, "uuid": "284fef28-94c9-4028-bacc-2dc6eb9935bd", "comment": "Malware payload (AgentTesla)", "value": "a3d4430ed6ce3875484af7c07a7a162561a9b45533364be1724fdf9ac6de30fcffe61aa32d1aa4f5f46c606217eab544", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178143, "uuid": "a20a1af6-b6c8-4493-b1de-cb498ecf5847", "value": "T10B412A2C4294B3F1D4620BB5E986D9C3FF7549B4242B862694966412025B2BE12F8B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178143, "uuid": "6826e01b-3965-4191-9429-f644fba0b293", "value": "48:91qB2YB7bB4/sEgzyFIUfILFfeKsM6J7cys75/k+Q:+B2YpbB4ED6iyyxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178143, "uuid": "351cd411-2317-4473-80be-dd0b1da2e7bf", "value": 1998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178143, "uuid": "b7ad9837-e197-498c-8350-afbfdc224fc0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178143, "uuid": "da4c998a-6eef-4af5-8988-f294bfc897a5", "value": "FreeFortniteCleaner.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1768247-1395-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772166907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166907, "uuid": "d045776b-a8f0-488b-a4b2-f9f829f1069e", "comment": "Malware payload (CoinMiner)", "value": "65fce8cea22e34af3dd726b838c72a9c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166907, "uuid": "9678185d-4e30-4d50-9da4-4f5c908cf034", "comment": "Malware payload (CoinMiner)", "value": "5e2ba475902c8d15ff0d0cb360a71951eb6a3b95d2737dfebfe55a4c6980d8d1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166907, "uuid": "8162aecb-59b2-4ee6-8f05-697daaea62d0", "comment": "Malware payload (CoinMiner)", "value": "a617567b7538f3b6854b31fa693d4a455506d259", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166907, "uuid": "3c71a310-d9b5-4d61-9d4c-bfb6340f8187", "comment": "Malware payload (CoinMiner)", "value": "ee757cbc9db3109b149b49e6469e881c805a6bd23a43dbb3879a7639abe47b9d9c5c2253e75099e8d3f487026cea2bec", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166907, "uuid": "764eb5d1-90c0-4e9c-a5cb-04e0a9038cab", "value": "T13317339BF503DEF6C28590F42CE1D7942371A11BC6170BB2AB48E38AADF63A51FD1581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166907, "uuid": "e4c19a58-13cc-46de-8f69-63cc8f27ce46", "value": "393216:1Dfc39/iPqXPHCkHFDlcugmERcS0nc77YeiD526BPDmmERcS0nX:1LwWkHJlVY0Ph5D20X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772166907, "uuid": "60486453-c393-46ac-be69-bdb45de44e0a", "value": 18481252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772166907, "uuid": "3774fd6e-226d-4cef-9428-e43ae882b7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166907, "uuid": "59eb2fb6-f193-4382-b8e7-ee66849192bc", "value": "syd-api-01_1771980125_elf_VuSiJeKr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6bde05-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176695, "uuid": "a9ab02ae-bed5-4628-a168-560eb3fca6f4", "comment": "Malware payload", "value": "81ba066fab8f5ec48ce616f5ded56f13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176695, "uuid": "9cd828c1-f1b5-4a27-92f5-d5ac90ed0505", "comment": "Malware payload", "value": "5f2b3b99ca033c87072b4fe4575a099a80090f9e61820d0b481e4651a68375dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176695, "uuid": "612e6faf-9d1d-4aef-b741-f16f0e3e5f7f", "comment": "Malware payload", "value": "8344d18c618183556c63927b2009853d2115b70a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176695, "uuid": "8c4a9bec-1046-4745-b92d-bb38f30d546c", "comment": "Malware payload", "value": "dcf598a8ac4c1413dffc498378c0d3edd79d89cd365222ba089baf21521af2bf3d2d031333569c346106e01e890874d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176695, "uuid": "c4f0d90f-dd93-44e4-a122-708bebc09c0e", "value": "T172F4071233D58B63D258AB32C4F70C005BF8A057A63BEB8F7D952BB915423528E4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176695, "uuid": "928a9053-08a1-411d-a7ce-16d54763a9b9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176695, "uuid": "52b4e4d1-a3e5-495e-9f16-021753195621", "value": "6144:6MFhX21bV5I8jXlq7h0LlI5CP42Y+HOBVGKxmshl1kdtAL41QeYGLcHGSgnlhJ2q:6M/21b7I8By/lTjL41QeY5SnFhxu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176695, "uuid": "94e98099-afdb-4530-a51c-57be8637bdcb", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176695, "uuid": "f2290075-03c0-42d1-a2d1-e39974104fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176695, "uuid": "ba257351-4d64-4dc9-bcc1-adf014af45af", "value": "5f2b3b99ca033c87072b4fe4575a099a80090f9e61820d0b481e4651a68375dd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddae853b-13eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772203918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203918, "uuid": "1ddd6dda-27f1-4bcd-94c3-850d00c0b63c", "comment": "Malware payload (Mirai)", "value": "8fd62e6792ec7c27c177a3ee935b6b2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203918, "uuid": "a907b883-c70f-468a-81be-e104831d0944", "comment": "Malware payload (Mirai)", "value": "5f3c3492ac8d904a88391e88fd39c923dd76d097bfed19d5372d44d366dc90ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203918, "uuid": "a89f601e-a670-4530-9477-ad82c78ff027", "comment": "Malware payload (Mirai)", "value": "7b0720941c1bd42886df0adb45e40bcb2e705424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203918, "uuid": "8b7dc2a3-8a4c-46fa-9a25-78b6afabbcc9", "comment": "Malware payload (Mirai)", "value": "7240ab1d4f254eab5251f36b92c508646804bb8979433f914e28da44f5fb626ad0cf7f74cadd7ff7c97b94a19888bfa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203918, "uuid": "9de02997-104d-4b63-8f25-ddd5e4ec166f", "value": "T1BEC39E32D8396DC4C1945434F8B1EE711F62A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203918, "uuid": "c2e62d6b-6ebc-4469-9265-14639f7e703f", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKZYMkaXN7Y+UKigHcYSQwKprlzww9:if5Z5Z98XdmVMJa0aX7biySQHrMwE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203918, "uuid": "0b78e182-b990-42fe-93a2-ab7c6ebac064", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203918, "uuid": "355e057f-40d8-430a-9fb3-edcd03c0cb8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203918, "uuid": "be2807e0-10c9-4fc7-94a1-ba63d01ea74e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2215b9a3-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176115, "uuid": "dfb4adc3-3ba6-4d31-b93c-a956d8ca4ed0", "comment": "Malware payload", "value": "69415d30d0fbdcc68041304e261416aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176115, "uuid": "2e8c6fb0-2e7e-4984-8692-147e5806a8f8", "comment": "Malware payload", "value": "5f7ac9e132d66b8295f2b12b48fe8fa7b6104554b319125005452298ec701e2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176115, "uuid": "87f3d360-d05f-4b58-8131-2a9f305c43aa", "comment": "Malware payload", "value": "fb615f479c348ae27a2dd27892ca1efd9ddedca7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176115, "uuid": "fe1c0d76-fee2-4196-839a-fe16aec131c8", "comment": "Malware payload", "value": "297c1142aeff180aae4ae8fd71336160f22b7787ec32333e2a80b428b3707cf00cf7434c178c298bb2f17ccebd3a354f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176115, "uuid": "222e1c8c-881b-4192-b36b-c57af660a015", "value": "T13D038F16729ECB08B0B2468E029B07740B5FB95E1FBF80D5558DEACA4FE352589473F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176115, "uuid": "13907264-4e86-49b9-b299-7959313a17bb", "value": "384:E1X9p3kAHXzXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXpX0wToUsaaRa/ADPA7:Kp3kAHwToUd5/AD9I5j83LgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176115, "uuid": "855f13a4-cdbb-4033-8f21-091128b6c992", "value": 39832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176115, "uuid": "c2848cc4-11d8-471d-baf0-8d07072e648f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176115, "uuid": "e8515838-b83a-479c-a92e-fd4a62b8cdda", "value": "E11520681000218-408231.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6434dade-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216599, "uuid": "74c8ac3b-ef4d-4669-85ae-ac3e5170a9de", "comment": "Malware payload", "value": "0e50ff847e3a07f3fd8b627559b1ad12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216599, "uuid": "a1bffa3b-41d5-46cc-b03a-1a8bb3acdf66", "comment": "Malware payload", "value": "6033db20715a79d587e26a206141255f49fb7e16a898e5c8637a7fcea6b75f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216599, "uuid": "ac313466-8115-42f0-9632-e6ee0acd851f", "comment": "Malware payload", "value": "6e06bae639a43dec935ea79331929b12806d9dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216599, "uuid": "e412844a-bb0c-4c83-b5da-c2537c9fd26c", "comment": "Malware payload", "value": "0b500269bf1ef6a44f4f475a5b21b53993a275994520328e048889ee9592204f60e2657295f1a1911dc5d47232c24438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216599, "uuid": "5317b944-3c2c-424b-858a-2b1219155559", "value": "T1E8D30706770D4E03D1633DF02B7B2BE0839EFD9628B5E680752EBEC982719B21545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216599, "uuid": "2f7cb623-b014-433a-85e9-8e8876176639", "value": "1536:Dj6bu73D3B0xDgzPwWwKpgMDgJxSCFY6vAPYdmQBT6D9PUqt/BXUK:Dj6i3B0xsbKvM0JDYjPTXUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216599, "uuid": "01ccc091-a6a9-465c-a594-2b12e38d5a69", "value": 139060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216599, "uuid": "cfc4e048-3c61-4096-b242-4b5050247c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216599, "uuid": "bd4b7293-388d-4d92-b359-79432d3816ea", "value": "kirk.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca7049c-13ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204909, "uuid": "2a196517-f3dc-4741-8e68-af30d5b217a1", "comment": "Malware payload", "value": "69ac36e5f7524a5ce7d732aa05a56562", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204909, "uuid": "2bce0f9e-17dd-422b-9d68-3dad2af0be3e", "comment": "Malware payload", "value": "628485a140d84da6f1232b8aee4ad371a21e013e19f262839e9ad288a5ef9c14", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204909, "uuid": "c418a7a5-ea96-42ed-ad2a-6049c73b843c", "comment": "Malware payload", "value": "d80cb1f18ac5ec61ade900d8ed6236b4d6ff10e4", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204909, "uuid": "a39c9dae-f84c-44dc-9a38-384eacecfcc1", "comment": "Malware payload", "value": "29290724c5546bb9ea236d3d18ac0250f05c8066109969fdd62c2420c7ec215d088f9312ba516775e1cd9ecf944c65f1", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204909, "uuid": "5a1642a4-9517-4fe2-8656-451f56ca71e3", "value": "T1C997334D2E116499FD399131E6E01234D6F4412E82B2EDF68B1D33E53E83BC94BB5A2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204909, "uuid": "d47cce04-24d4-4c50-a944-e2f9005d63ff", "value": "786432:iTWPxSPQZzIlbcFlGt8OjK4luSuE1WtYWh7o/Xbe3XVzE8dsCDaF6BldA3:iYxS4xIFcFQt8OrQhWWJofgFw8dlmsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204909, "uuid": "fb4e9012-5b4b-40de-8134-a5e20a1bd1e5", "value": 41061860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204909, "uuid": "4b4658a0-da09-4909-bb74-0712a16cfd8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204909, "uuid": "734ab7d8-1650-481f-b6c7-7a07d6bc7d3b", "value": "bobby", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9b29ab-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191249, "uuid": "3f2e716a-e54f-4751-891d-9b3710f36660", "comment": "Malware payload", "value": "25adc75337064289ea7ab2e8e51afda3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191249, "uuid": "57c40e4d-f740-4162-bce5-c95b93370c74", "comment": "Malware payload", "value": "638fc69f1d2945d4a575154d019e503ef6e00a67317666fea3655262b474643a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191249, "uuid": "cac5efc7-3a30-4f48-9436-80c94d6d174e", "comment": "Malware payload", "value": "87466ee498515c00d44bfb9c7c03b83e28ca5f6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191249, "uuid": "d91f227c-d217-4999-b35a-623000f55d36", "comment": "Malware payload", "value": "148e1df2686c5336962b3144e9613af55fcc0828a40d54f736ea4df22de0eaf97d64a813bc37dbdf74e8260eaeac3af4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191249, "uuid": "90639613-c632-435a-9fd7-c3fc43e196d7", "value": "T13E55BE82EF05E866D5F786374776467A56064C184B97E7830E89B23C0DBB6C48EC9FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191249, "uuid": "b2aa8f05-f7f0-4bd3-b800-adc30eef8e05", "value": "24576:pOaLF38o/OOd9UH1dsAGxkwr3nziMdmV+bVOwT6Yfpfy:pOaLh8oWOd8sAGx5qiOwT6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191249, "uuid": "f376ea70-b534-459b-a6e6-db660a50a188", "value": 1359281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191249, "uuid": "697d6e9b-5ecc-49cc-932a-874ef9201591", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191249, "uuid": "412769fb-4630-4a6b-908c-19442278597c", "value": "android.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a38dd17-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772212341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212341, "uuid": "471783ff-bf22-4f39-9f38-ddda43937cba", "comment": "Malware payload (XWorm)", "value": "47f0c1d99cf7646e7e4553c37e96ce52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212341, "uuid": "d4321eff-7b7c-48a9-90e6-7de5d552e0f0", "comment": "Malware payload (XWorm)", "value": "6475ff60240e5415552a7fc540f397b7bf8a747ce4a3f06d7cce1718c3b359d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212341, "uuid": "dbe34378-36c7-4034-bfd2-5ef3cb20df09", "comment": "Malware payload (XWorm)", "value": "5094de89f1895547a94fa9fe37355558ad7d259a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212341, "uuid": "9492afa9-79c3-4b7b-996a-d67c317dd641", "comment": "Malware payload (XWorm)", "value": "514e7a4055d734ad99bc1253ced2eea97e0e80b52efdc21768efc2b644068f585fd2cddefcb95ac930f0410a0858b823", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212341, "uuid": "2c40a8fb-7258-4447-8204-678c2e7a77ba", "value": "T1DF550330796DDCEB05E9BBC15B04A22DCFD218F5238A5B08AF4FB1EA7744618D0B5A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212341, "uuid": "c22c957a-7fec-48c4-ba85-605bbc6e38b6", "value": "96:ChBfM+SweC/QEzQf266Sh8YvFJDM+E3ArPiWPcu5OOkv+9pnN71R5QdkD6APN6lf:CnfMsFS7RJeOi0yP0c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212341, "uuid": "dea43065-0112-40cf-8e19-e2c4c10a33b5", "value": 1331781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212341, "uuid": "c2f1ec9a-d041-4c25-a90b-9a0a4fcc000c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212341, "uuid": "8b77c5ce-cbab-4369-8b9b-ab34394250d6", "value": "47f0c1d99cf7646e7e4553c37e96ce52.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633bdc71-1413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772220892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772220892, "uuid": "01644f69-2182-436e-b7e7-be05e52e8efe", "comment": "Malware payload", "value": "859d623a177b8bce91f65e281aa77e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772220892, "uuid": "95476b9f-f09f-4f16-b1a6-8182aeec0986", "comment": "Malware payload", "value": "64d68a4de7ec826994647b4b595a0e30caa00b75114118b655c59b740cc2d033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772220892, "uuid": "f265f577-0443-4e5b-a52b-e14565768fcd", "comment": "Malware payload", "value": "1de558ccac0d2af2016b0f4665bccf08f262a0da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772220892, "uuid": "b94a1cfb-4399-496d-8d34-acc3b69eed2b", "comment": "Malware payload", "value": "86e0f7c3ad21620b7748a69b5512530e3be941d59b2eb0e0d6ef9652fa00d8508ea80e9d2e2178aba74704a63ced76d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772220892, "uuid": "57aa69b7-7e6d-4e0a-ab3f-381969321fa7", "value": "T121F31268A0918237FFF05ABC09D6E63DC7A450E37720C8D8BCA1CB18775EA29D5E250D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772220892, "uuid": "c114b477-49ee-4374-ad05-49fd589311fa", "value": "3072:DMHnmXJmswj8uoMKBdfhBQDVUTIUSFpcGR0sAP4bwlMq9dg:DtZk8fMKP5BQ2IUvGR0sAP4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772220892, "uuid": "9e7d0ede-e5e8-4145-ac27-880488791ce1", "value": 163202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772220892, "uuid": "d8862bf5-dbf0-434e-aae2-ccf90a223a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772220892, "uuid": "9e8b6867-9083-493d-8df5-73f23ad3e9e0", "value": "Linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7632653-13e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772203021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203021, "uuid": "0917b12c-7466-4fb9-b303-fdc7bd77b0aa", "comment": "Malware payload", "value": "2e26152e77ac5b658dc9621d9935a5f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203021, "uuid": "5489fe95-093d-45f3-aea3-4ef86c897646", "comment": "Malware payload", "value": "651f6d5c6e7fabd66085a4a8a95af5e511f997a01df8d3ce56548e681058b5d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203021, "uuid": "0be0c63a-7155-433d-9335-fe2cbc5d3125", "comment": "Malware payload", "value": "71fa3bd3c4fa1c8835fd7af614c48efcf46236ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203021, "uuid": "901107e5-7eee-4c86-808e-8faaa8ef05e9", "comment": "Malware payload", "value": "e51e82d86e1151c16bd6c7054cfa5ef4074f650b757f88e8bf322c9d4ac5d9265123a8461c87ad766bd35cc90d850e7d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203021, "uuid": "d62ca350-b226-486e-8ea8-43a88f2a6670", "value": "T133924BB916496C79BBC0DE799F3C7F0CADE4C1C02219A3ACBA4F39614A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203021, "uuid": "85c0cee3-74ee-4933-acf0-34281fa2865a", "value": "384:xBR0M3vgRjGlsaq7ezsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:xBhmjfizsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203021, "uuid": "6a7e8157-c49b-45db-93ca-8f3c8afb83e2", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203021, "uuid": "7bb4c17b-ed6f-42ca-8397-23c86cd02f7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203021, "uuid": "ba005491-e168-4c18-ab8c-9ab09ee6a1c9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9b7103-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175386, "uuid": "48e956f0-3ba0-4dc3-ae30-efbcd5d71d94", "comment": "Malware payload", "value": "19e747644979f0f1ee459d2d298ab5d6", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175386, "uuid": "70f0a8d5-05a8-459d-a785-7fb45517d7fd", "comment": "Malware payload", "value": "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175386, "uuid": "6285f682-b355-4681-b940-d83a669c3a1e", "comment": "Malware payload", "value": "10c9a8a6c6f6ea9233a7df700c4a724b5f49ff74", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175386, "uuid": "9bf1b84a-5fc7-41e4-829d-81712748b45b", "comment": "Malware payload", "value": "19aa44e5154934963fac4874dc5f02d8a4b8715cba63b83563b7dacfb5a4f797af0a80dbb92584e74ac6cea1cdf3c010", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175386, "uuid": "fd709dbe-5f73-4538-bc32-a8b6748fc23d", "value": "T1FEE73306CF8A08E8FE37C738C65FC201A322FD8903A491AB69F1B7655F375612D5AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175386, "uuid": "294b5c07-30fc-4200-9da2-d28bfb50a0a2", "value": "50acbffe7a37d02e3ff3a14c52ba0df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175386, "uuid": "0a165fd5-e877-413f-b881-f388854f778c", "value": "1572864:le5/uapcYbwCd9xjMPR1d5PIMoVBw/fgI495iX7zZ+4Oj:tajMC7mPbLNE+WszItj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175386, "uuid": "e87845fa-a735-4c13-b020-1d183e2f7567", "value": 67036160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175386, "uuid": "23fc539b-e1e3-4757-8d48-3d659bc10d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175386, "uuid": "43fc2852-9bb8-4695-b990-9d15e7701a97", "value": "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc067bec-13e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199164, "uuid": "bad59348-8a22-4b57-9a13-7be5f7cecb31", "comment": "Malware payload", "value": "03fe9c1ad8548802e8afb039cd51ba1f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199164, "uuid": "c5ed6f79-12ea-4377-a7f4-c4a46aa90741", "comment": "Malware payload", "value": "6525c636f93255cbf2c41900145f9c3c2e8218e5457ce0b53619136da772824b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199164, "uuid": "9bafa064-691b-4508-8f0e-b9ef7879cf3c", "comment": "Malware payload", "value": "30dce1c92e54b6fcd2826f6c34c707fcabf3f76e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199164, "uuid": "0a2c445a-b2bf-4e3f-89bc-7ffcba0391de", "comment": "Malware payload", "value": "ede55f066dc2229ae5b9cd16c309fb21a67f95dc82c3405a0be5da90b0c7d68fa3ff908579f3bed78ff0d16c9b3b0c7c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199164, "uuid": "d895cae4-119c-4c5f-b6b6-b54fdbbc70eb", "value": "T134613B7015F00C736E201944F3772BA6ABB7E8574A97618C388E2E396F97F42A5DF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199164, "uuid": "9c32cf3c-8f4e-4f3c-bcbc-56be393618e2", "value": "48:csRu9+J9nB6gHrJilrmAE69lr8z6E69lriFE69lrElEHlEzl/+BUdl/w:cCuIB66Si6fA6fv6fiEFElBjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199164, "uuid": "fa4112dc-40e3-464b-993a-5986bfeb141f", "value": 3333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199164, "uuid": "2e2ce94a-96b0-4f0b-8711-07eb47beabfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199164, "uuid": "6f4cd1af-d719-437f-87e8-7ed08dcc98a5", "value": "6525c636f93255cbf2c41900145f9c3c2e8218e5457ce0b53619136da772824b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5066494a-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236322, "uuid": "f3993035-7ef1-471a-b367-1e6dd12d08f8", "comment": "Malware payload (Mirai)", "value": "12ad8356983dd70291c82fe2b072fa37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236322, "uuid": "80d0b6a7-acba-419b-a0e7-362b9f1cca47", "comment": "Malware payload (Mirai)", "value": "662dab35f12cd4a5652c9cd2b777d31c1301a0a3dac4e15f4104d52cbbbf7798", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236322, "uuid": "1b79e53c-612a-4b65-bb44-08af6950de33", "comment": "Malware payload (Mirai)", "value": "d8fb76662f521d3868822dd218fddd5798b25b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236322, "uuid": "be67d88a-a46f-4e68-a74a-813793d2b3b1", "comment": "Malware payload (Mirai)", "value": "97b3ae750c341849e18da0eb01aac6ac32b23c60640326eaf61bbbc1af34bbe80c4cf7e6d66f86fd660058b7e554eea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236322, "uuid": "8809273d-2986-44ab-bb6a-96c7081e7500", "value": "T116A3D61E7E259F7CF7AD823547B78E25965837D626E0D240D2ACDA001EB024E241FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236322, "uuid": "9a7cdca2-05cb-4bcf-81df-d5be697dbbcd", "value": "3072:tOineSsfM4E2HxTTn1Qk8AoGYtOPUEh7en:tOinYnDFTuRAYIPba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236322, "uuid": "8f5c1a9e-94f6-4fd1-b3ab-c940ca3a762d", "value": 106724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236322, "uuid": "3d96a118-46ff-46ae-b96a-6f1346da7b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236322, "uuid": "5f8fdfc5-6785-4c5b-9271-0e69cf00d7cb", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c248609-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212586, "uuid": "5c25e486-bd52-4fbe-b64e-8b7373ee2eed", "comment": "Malware payload (PhantomStealer)", "value": "8b805d2d4748e825566af122c54e5355", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212586, "uuid": "5a751e78-faa5-4aaf-97f4-507f1226898c", "comment": "Malware payload (PhantomStealer)", "value": "669becc80a95fb08a932b29b80d9977fbc1b6a73698cbe9476badc43c8dd256a", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212586, "uuid": "54f1bae1-ad43-4c97-9640-3c0dba3a752e", "comment": "Malware payload (PhantomStealer)", "value": "2fc0a9e0868d4feb6734ab3f72837b02eaccabed", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212586, "uuid": "c6d036c2-463e-45b5-ada3-6c10959fff28", "comment": "Malware payload (PhantomStealer)", "value": "6770601cd7784b618a988dd233896efd3a79e60fe9fe3e68583d4194a03054aa28cf28654c8907df7d4a1251dab19496", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212586, "uuid": "8b6c5346-4a32-4463-b2ff-5e263fe59456", "value": "T1FA26AE6096E3770A14D8AE3E06FD330942D44DA22D62658C7F7DBDCDAABC64520F261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212586, "uuid": "c56c469b-f23f-4f1b-9940-d87e1d642e8f", "value": "49152:SQ8dTIzg8kNHJskJp4VhcISSXYcE2Xp8p2DFTlKpmbQS5hoo4NVijx7WyoY5cV4W:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212586, "uuid": "88efb72f-ca2a-41ab-892d-c55bd1580831", "value": 4640383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212586, "uuid": "16673c84-f177-43f6-8677-e886e3f469a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212586, "uuid": "dfe169e6-1e95-4224-8679-8cc668608254", "value": "8b805d2d4748e825566af122c54e5355.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29934466-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772212206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212206, "uuid": "af99eddf-2387-4d7b-a143-f989f200d579", "comment": "Malware payload (AteraAgent)", "value": "4d1334a76c1192196bb4c5a0436bb00a", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212206, "uuid": "3f857d16-1f6a-4e9b-9276-16a150f86a7a", "comment": "Malware payload (AteraAgent)", "value": "66d1a49956fadec6823c4b924507329ba8e454fc3dc07b8a96a59536ee5c4932", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212206, "uuid": "327bdf88-d23e-4853-b031-960b9ece7366", "comment": "Malware payload (AteraAgent)", "value": "e72371ba26d40f7ecb7ec726d2db8fc96d78fa54", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212206, "uuid": "e144d4c1-44a3-45c7-9a7e-663477c3a1c4", "comment": "Malware payload (AteraAgent)", "value": "8af844c7563f729f50339285670d3a3d393dda70845badfe26740669788a92f1e45c6c83d60ca9e5ce6bfc59aa011221", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212206, "uuid": "9c8ee15f-1a25-4559-981e-570b6f126220", "value": "T1A3862318FBE009AEE5778376C56A8520EA327C893720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212206, "uuid": "796d3dc3-e221-4b13-a6d2-84297c0d466e", "value": "196608:GW/FnmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:hnqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212206, "uuid": "50d6444b-60d8-435a-878e-1ac670d4166b", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212206, "uuid": "2f259c6b-baaf-41c5-a135-a668f6fe2ef5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212206, "uuid": "92beef2c-ad66-404c-b646-6d347d3c2caa", "value": "Joinus.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a360042-137f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772157392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157392, "uuid": "b98e23db-a80a-4a8b-9526-1c586b71bdeb", "comment": "Malware payload", "value": "90b20abf80b2ecb82243533259921223", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157392, "uuid": "e72f0c29-76f6-4573-9f1a-04c894f8f972", "comment": "Malware payload", "value": "670c2800abc04f1612d73f0df5f5040f6f348a55464dac69039e5ef1ecc79575", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157392, "uuid": "1e164a6e-0917-488e-9776-ddaa2dc04d1c", "comment": "Malware payload", "value": "ada8bb839263efb2736153d193aea9e394130ebe", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157392, "uuid": "595bb199-947b-4104-8911-8fd80574a8a3", "comment": "Malware payload", "value": "39db63e1de2372efba2aa27a488744429bb58b88793e73e71282f1f3d4c1306a07fdcc2168856bd078d3d5120f3f1062", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157392, "uuid": "13715e39-1ce6-4156-835e-58e2ca20e7c8", "value": "T120545C4A77A440F5D9A78139C9A38A46E7B2B8650771A3CF036443B95F3B7E05E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157392, "uuid": "c701e9bf-d1a7-48d3-95a0-a4b3af69713a", "value": "3d85d3c28c2c171776d82f97bfb95153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157392, "uuid": "762509df-6fcb-4708-89eb-5d1f809d2177", "value": "6144:RvoTljfVSITGG9wNsf8cPR09QTiTrV2Z+qXTLrs+TpCsD:RU5GGiEPRoqXzs+Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157392, "uuid": "e7ada0fc-4872-4c66-af67-96ab3381d282", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157392, "uuid": "5f3a05b9-b4c2-4149-a433-156952095e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157392, "uuid": "841388f4-0524-4977-8cc8-4c99342cb756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d79d514-13f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209340, "uuid": "65904bc1-77de-4d6e-9dcc-03e83feb4a0e", "comment": "Malware payload (Mirai)", "value": "07072d5c62ffa51bd7a945d38cc39c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209340, "uuid": "6692f884-5941-4e31-bb6e-b7f8810c6a35", "comment": "Malware payload (Mirai)", "value": "674b3ee885ff0c6e1091dea19844daa7cd75d3418357ea49705309997954b4f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209340, "uuid": "f5f37b16-9116-4ff6-a6b7-e63b275f7b37", "comment": "Malware payload (Mirai)", "value": "c423ef4b4cf5812799bba7c81ede7239b03910c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209340, "uuid": "d67738a7-fed1-4e82-a872-39c6b32a4312", "comment": "Malware payload (Mirai)", "value": "4cb0062e20a057ee9c28705f59be53992e58e8abc84d74caee91acefbd7213cdfe0d6d4b8928e6fba1a945d9d4c44172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209340, "uuid": "1946ab2b-b319-4741-91d4-3436d740ed5e", "value": "T1E5A34AC4F743D4F1EC5701B16137FB36AB32E1B5212DE943D3699A33ACA2541DA0AB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209340, "uuid": "7967dc1c-da27-403e-b54f-85fbf59c0a1c", "value": "3072:hkAFVLsS9EYiWZFsRb5HLHyKXBcu6JL+B:hkAHLs6EL2FsRtOxL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209340, "uuid": "a9be9bf6-6cc7-418a-b5d5-db9c98eff431", "value": 103404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209340, "uuid": "a727f397-fdbf-46e2-b1e8-6b93d6c1e137", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209340, "uuid": "463e506b-8b02-4bc1-a70e-1b6a33fc7a18", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de9f89d-137f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772157237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157237, "uuid": "7c223a62-9ba9-4488-8b02-99eee1aefc10", "comment": "Malware payload (Mirai)", "value": "f7aef9803d6d2a48aadde461ff004043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157237, "uuid": "a1ea582e-5979-4b2a-a901-56beddcdb6d6", "comment": "Malware payload (Mirai)", "value": "67fa46764b8714702f1feb3e70619916e4f7d5511b7a3a225a1aaa9387464dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157237, "uuid": "22c8ae22-ba61-4c52-b187-71b01ac1581d", "comment": "Malware payload (Mirai)", "value": "513f0e64a1ca1d5fc9d3f5c44a3d1c8f96bddb03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157237, "uuid": "a894f3e2-5724-4b64-be62-ebd9103b7cfb", "comment": "Malware payload (Mirai)", "value": "3880c12af357d4c631406141b8c28b839ac8d34566f072701db343253d3249194f6ca667ca269addee19c5222bec9ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157237, "uuid": "9962728c-b211-41b9-9717-a9b9fb6ae215", "value": "T12C343B45EA418A13C4D117BAF5AF418A3332A7A5D3DF730699246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157237, "uuid": "489698d5-8551-4fa3-ad65-5ee7f8bbfaae", "value": "6144:Ego/jNMTqzHzakeqacEp1d4n1tribf9ihM/9+AU:EDhk2HzakeqacE3W140G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157237, "uuid": "ef88e5f9-d378-4f73-9ed2-5df320579d71", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157237, "uuid": "2287b3f8-1ebf-4660-a81a-9ac2f80c61db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157237, "uuid": "8e9c8bf0-2bfc-42b6-8f60-8794c477c805", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d64ba6-13ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772204626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204626, "uuid": "0e42aa0e-c8a0-4140-b600-41d52cb95343", "comment": "Malware payload (Mirai)", "value": "26aa1e2533510a3afefe81f92354d076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204626, "uuid": "5df2ca9e-73f9-44cf-87c8-e1facc24967a", "comment": "Malware payload (Mirai)", "value": "6822b1588ecf119ca8e8dc868812c371aa37c61417f522bc9f064450c7f7b20c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204626, "uuid": "7ef9960d-aa91-4e9d-81ce-a7e28f3d3efe", "comment": "Malware payload (Mirai)", "value": "41575a377ceba4bc698d329b09a6abc0cac8aac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204626, "uuid": "713a40d8-ce72-467e-b976-3ca69edea855", "comment": "Malware payload (Mirai)", "value": "f531b7059dae2b08b27b38488a72023c59db15c87aa976e9a4bf0fe2565ff471d8e5c091245dd4a81b5df68c963a1242", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204626, "uuid": "34de6a57-9ed1-43d3-8ca5-914708cbb0d6", "value": "T1C8F3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204626, "uuid": "d1ef6db3-7410-42a2-bb7b-9f55ee28187b", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwZ:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204626, "uuid": "da46863c-b405-4127-ac39-df284a217d3f", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204626, "uuid": "8c1c5108-6a1d-4a42-962f-d51c4656a81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204626, "uuid": "bbf62e9e-c689-4d6a-95ae-760a63471142", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836eb639-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209779, "uuid": "0fbb1e0d-cf99-4826-8eb3-2b4f14df24cd", "comment": "Malware payload (Mirai)", "value": "481e6fd3e1df670ec795737bd900c5a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209779, "uuid": "388b1512-90ef-4483-996c-36d5d2d77598", "comment": "Malware payload (Mirai)", "value": "692002a3025ebdaebdb995169c8f552d2a75027af884ee5c7e00499fdf1416fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209779, "uuid": "b479dd5b-6e11-4731-a0dc-0607478651d1", "comment": "Malware payload (Mirai)", "value": "73bfb154680ec50b03fc0b1dfd8a2a8724a8abc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209779, "uuid": "0426df82-a9b9-4e6e-b911-ead956ff8f76", "comment": "Malware payload (Mirai)", "value": "c0a2db59ff49e82cc107641aa65185834c01fa98083ce69a589f743dd0fd552b5d61475cd17e4ba419598cdda8ada178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209779, "uuid": "4e8e1071-b0b3-464f-bd41-41c58c6120e2", "value": "T14EF31B45F8814B12D5D112BEFE1D128E37231BB8E2DE72129D245F647B8A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209779, "uuid": "26bb9d9d-705d-44e0-9877-4f32ee0c9c24", "value": "3072:ZcLaYBU6hhoTXubj7I4XaO7PGJ8VGYvDYbY:ZuaYBpQTXuv7IyaIXGYvDYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209779, "uuid": "55e2239e-2b1a-478c-b763-6c3e38465aab", "value": 157596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209779, "uuid": "771a9b0f-6d90-4492-8f85-28411fc06fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209779, "uuid": "25de8b4f-2cb6-47a0-ab52-19e371ebcd5c", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38e8fdd-139b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772169514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169514, "uuid": "44135810-1608-4591-89f2-c63b4dc6c64e", "comment": "Malware payload (AsyncRAT)", "value": "f8c562516ede87c6849de543317d046d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169514, "uuid": "139349a4-be3b-4a21-bc0e-3adfda57ac79", "comment": "Malware payload (AsyncRAT)", "value": "693f22ef4845f22f4224fd98c669e125b52f43bd971cccc4dbb10f8d64634e17", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169514, "uuid": "8001a7d4-fa42-43f1-a01f-e0abd184f684", "comment": "Malware payload (AsyncRAT)", "value": "4d03c37a28cc9557082048f2cc2789f9c8821143", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169514, "uuid": "32aac65c-e701-4e8e-ad3f-d066da296b35", "comment": "Malware payload (AsyncRAT)", "value": "b0e6cdb1a104a830a8694a9af1a9e833915de4f6cceffd9ed4908c6ec7ca58cf0189adac610490bf4bc448b1d0631c8b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169514, "uuid": "5daf5699-48c0-4149-a83f-f470fecf53d8", "value": "T16FE24B0573E49816E1BD4B7D8C3282009336BA879937DB9E1EC8549E6A23788CF14FF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169514, "uuid": "4553290c-0251-43ab-9d98-ce0a357938fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169514, "uuid": "10f0f84e-73ab-48e3-879f-857122ad8280", "value": "384:F2eAGxy/r+TSWwreDU936QLIeDfYN+4Q793bayse3QxnC7M+WJgIuucCTj9mnEQ+:F2eAMfdwreDojUe0YzRbJABWWe4RQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772169514, "uuid": "73c1a213-38d1-4f47-a959-4b2da9230c39", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772169514, "uuid": "f55df375-27f8-4d35-8861-3dd41a6307f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169514, "uuid": "5973d0bf-6028-463e-9a13-0fc916582d6c", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4808aade-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772190782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190782, "uuid": "74eebec4-8963-4fa5-abfa-0fb9b96d3412", "comment": "Malware payload", "value": "5140a2e2c8296ea7c9cf0bf59e25d777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190782, "uuid": "fa45e672-50f6-40d0-bfef-1a6e949960a2", "comment": "Malware payload", "value": "6a2642ed05187a4d428eb7c9b609b03c69a427a9a0508c419b15ad277a518e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190782, "uuid": "95928fe1-ee53-428e-9eb2-26b9de82fc9e", "comment": "Malware payload", "value": "f4aefd4e7dc7c238cacb85ccd6c8635665558ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190782, "uuid": "38c74977-34fa-4c50-a1f0-fd5c0bc7ca0e", "comment": "Malware payload", "value": "6c893e942647385da89e7e9dc4e238d4c91e2e788fcd568c37ebb181399d5a091832c95989c485d908cce64f2441ff49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190782, "uuid": "fb0bc3b0-d20a-4a73-a592-115fbba579f7", "value": "T10B74E60EA2C12882D41A353FE4BDB2578DF7BC831664D5EBC7C87B149A32EA1ED5491C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190782, "uuid": "35eafa9b-b10f-4ad0-9f79-c79b5442dea4", "value": "aa42d699775309e471b617b5f7ada017", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190782, "uuid": "59371116-4ade-4347-912d-20730594d509", "value": "6144:Zn6Yvbgwok1LN4aaEOJf/9WNoYDyYcVWUHlum7mO4fFqn3iiBO:Zn6YvjjLCaAZ/9WVDyYIxWXi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190782, "uuid": "32b45d01-a037-4394-a542-06fc0a88ba89", "value": 353704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190782, "uuid": "b5714855-3541-4480-b9d4-9c7ad46d5341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190782, "uuid": "558df601-b885-4c96-a42e-e9a28444406f", "value": "Google_Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd3bbca-13e1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772199485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199485, "uuid": "e4d32fd9-6293-4a39-bb77-5940562786ce", "comment": "Malware payload (njrat)", "value": "22716ba644a066de7318dd077cc2deec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199485, "uuid": "821162e7-2005-469a-91de-4b9ee62b50d6", "comment": "Malware payload (njrat)", "value": "6ad1b1db6f7c97ce50900ee4f898058f5ed4cb99bb7f63ce9b1f1509a3dd21e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199485, "uuid": "9f0a435d-1e63-4117-9ef6-7c08e4d44d04", "comment": "Malware payload (njrat)", "value": "488fedc0b2771a700433d85ea4e8b79f1a9d741e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199485, "uuid": "8ae2ea1a-d4e0-4b0f-bdd2-f71824353177", "comment": "Malware payload (njrat)", "value": "6ea93b62ab2247f2fda593ca9e3949606a1c3061b0196fcff619feb4f15216b12e505eddc212e3bc6f83138a1e9fec4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199485, "uuid": "7e0f1fa8-9143-4b96-b1a3-371739a48a49", "value": "T1AE936C0DBB006488C6BD0EBB89A3914C89FDC497B667F77625C81EF68D2399C854F6C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199485, "uuid": "b9693faf-945f-4bad-a7db-023201ff0473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199485, "uuid": "14295b41-a8a1-467c-8e2b-41c28e46a5b9", "value": "1536:4GGFBZXg0+ggFCpBNPA5K8ZuduShbBNIIb2OAJ7ebS3vsUJy:4BgxCLKKdhXG423IbS3vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199485, "uuid": "0ade973a-17a7-43d2-acfb-a876c29fa831", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199485, "uuid": "f79ca7bd-e0ec-40f6-8b29-f63a18cef0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199485, "uuid": "2c28ceb2-6f71-4691-9414-388aff3775b5", "value": "lu7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9f575d-137f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772157238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157238, "uuid": "2aa664a2-10bc-4d1b-b9da-6cd484629e83", "comment": "Malware payload (Mirai)", "value": "c670e2d3345f048f1db9482396c73080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157238, "uuid": "602e8c8e-192e-4be1-b554-83ba97092c59", "comment": "Malware payload (Mirai)", "value": "6ae1afaba196cfa446ceebc1692b6d294ec0f484974eff50e46fd03e53e326ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157238, "uuid": "fe1915e4-4815-473e-a53b-255b9a65813b", "comment": "Malware payload (Mirai)", "value": "b422c9a350c83734841b580ba6571831030777c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157238, "uuid": "7efb4524-4e21-420c-b6b6-7b427f7f0fef", "comment": "Malware payload (Mirai)", "value": "14d6ab4170a163869597d4f3f21ec1184ced5b4bc7a6ae0734deeca4c60df2fcfc7b65d4fddfc8e56ede43d6f325cd06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157238, "uuid": "579cb230-546a-4d4c-af50-6240a3a36f65", "value": "T1A5E37B8BB7026CA2C9918BF54BC747AD2B6322115F5BCBE76C0C6A3D4E219DD5E0B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157238, "uuid": "f8bb8a34-8c98-41c2-adcf-d5bfb565f72b", "value": "1536:344oAgvT40qIYqqwhLgfKq+eorWUGip1ogLgI/LWaFmCrmKmuRl:o7eqNZUKJXGip1ogLgIqadrmKmuRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157238, "uuid": "09ba9c2f-8489-4ebf-8713-45af0fd34f6a", "value": 150664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157238, "uuid": "7adf2b2d-9bfe-492a-9e7c-ef1b22a7093e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157238, "uuid": "f4f7c9ca-d9d3-472c-a005-fc0a92fb8c66", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797615a9-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "3c07e070-7825-43d8-8ecd-61c0d36dba13", "comment": "Malware payload (Mirai)", "value": "df05ef67fefed45ea058c6097cf8f810", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "73f2e391-2703-40a6-a27f-c00fe4969a75", "comment": "Malware payload (Mirai)", "value": "6b622aa1d9df011488c7ad193e575da5be07f55abe2252aef0688e061e6ae497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "eecd965c-ab26-43f4-9feb-79bc6a81692c", "comment": "Malware payload (Mirai)", "value": "a078b9fb2465f5f54505f1bc7c4b361800e64bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "6b6352f7-8d0b-493d-8da1-82428731e9f2", "comment": "Malware payload (Mirai)", "value": "2e647183c544ebbe62c774ec715975b6f5c491ced68dea8d4544aad9d534480dc5bed4df16af193676b4f0ed035c29b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "92a780de-ba20-495c-8bd1-27d9fe83092a", "value": "T18AD34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "039eea89-4385-40b8-84dc-3631ec69736a", "value": "3072:1CldeCsOs9kzj2vV4NcZgqn9EG30A2t5lsLXjVo:wPeCK9kzivVGQ9tymLzVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223936, "uuid": "0ecdae55-5c28-4380-a2ff-00f265b2df41", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223936, "uuid": "bc6fc920-f079-42b1-b65a-af9d89eb5b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "9c98ffcd-22b4-4809-a6a1-5ee7c1101b91", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aafe9b6-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772211483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211483, "uuid": "a4f70c18-3e97-40a8-8e67-dc0e830945ae", "comment": "Malware payload (NetSupport)", "value": "e6f24d09bd6a0fef75be1d61eb8686b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211483, "uuid": "6db95bcd-e3e3-4ba9-9528-b542077039f6", "comment": "Malware payload (NetSupport)", "value": "6cdc023534af5779fc1a05e1ba99c4823cb6dc7e3472598e0b8db8572d68def4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211483, "uuid": "9e66d177-5755-44f5-aab5-4e55866621fe", "comment": "Malware payload (NetSupport)", "value": "47bce66397bf0fc54b8c1bfc604f6ce3148f2eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211483, "uuid": "2ba31ab5-3977-4147-becb-c3a5f22fcd69", "comment": "Malware payload (NetSupport)", "value": "52cef8f81427a3507bb648edd9baf92c31c5d69853faae46f735f949fb8f6047d95f9b52ef6aa4cd678fa62be8861916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211483, "uuid": "8db0f918-c841-46e3-8c30-081667a78a68", "value": "T132D633A0A6E811FBF9EE933DC9619591C99A75673B49C183C3F8D0A12C733C46A7E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211483, "uuid": "f17df410-328f-4667-b4b6-b1705aae4b84", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211483, "uuid": "e80160d8-aa93-4692-a5bd-003bcf6b781d", "value": "196608:714oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorEl+vkvHurH/P/XRLSq2KKeF:714FSsFl7dCR1C99/LkuVlikvHuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211483, "uuid": "2298a0c5-da8e-4a36-b507-f2b352324bd7", "value": 13422374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211483, "uuid": "4c5616f1-ba72-4e6d-9962-673a1e3b37c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211483, "uuid": "625e32ad-b3ad-431e-889d-18d1fb39d834", "value": "usa.confirm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445e92ad-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177891, "uuid": "0a09da77-d4d7-4b33-84ab-d83de221f2e5", "comment": "Malware payload", "value": "85dede4f7a649af25f871d4a05da6156", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177891, "uuid": "ef6d139c-4299-48ab-afe0-632848d3fb9f", "comment": "Malware payload", "value": "6d5458388e1fd7f67ce099560dd1b16204789556ca406053d6741a737d53d37c", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177891, "uuid": "a9edcec9-5d9e-4918-bc08-d22d685fcf9d", "comment": "Malware payload", "value": "10e4472ae3b1d1737460b9e01ea1712ddbbe127b", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177891, "uuid": "b88bed4e-30d9-4ad0-b53a-5a7a50474295", "comment": "Malware payload", "value": "655d4c1271e9da42a471cae9fccf8f58a1bdca91bd3e44061d3b5c6605e6a0b77c4d67e216b74f4bab53bb32d6949d2c", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177891, "uuid": "1467be16-b21d-4c4f-92a0-85db9f35cc6e", "value": "T1B1F2BB19719E920C70B31A5856AF02750B7FBA5F1E7E408A81CDEA8D8FE35118C967F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177891, "uuid": "eaec1d82-6945-4f3b-8466-fad2a934d943", "value": "384:bj9p3G54BBoIthAMrjWjCrjCrjCrjCrjCrjCrjCrjCrjCrjCrjCrjCrjCrjCrjC9:lp3PAZ2ZYEdp4Q0YOcMWRUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177891, "uuid": "42efc97c-f467-4d48-a824-90c81fe727af", "value": 37302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177891, "uuid": "50d9c617-1225-43d0-a6f5-d4ee0b7f6f26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177891, "uuid": "a8d5a97e-ba6f-4f98-a24a-d1c324173b18", "value": "IT021562100-112102.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb67cd-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "39a33067-0cb7-4f5d-a360-8ec6123551db", "comment": "Malware payload (Mirai)", "value": "32b5f0bf790acfd0b0d6c918f35f47f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "18bcc454-6dd3-4b0b-9a1f-fe68b6a26f19", "comment": "Malware payload (Mirai)", "value": "6e0c8cf3bcd78c90258999a8bd9cb804690c869dec30725efe2c001f3e1f326d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "72cd083e-9536-4785-919c-3f044893c4fa", "comment": "Malware payload (Mirai)", "value": "28c7684ba4dfa2ca9b75bb31c395ed48abb505af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223933, "uuid": "c42cb919-c4cc-408c-bda6-bcbb82b44b9f", "comment": "Malware payload (Mirai)", "value": "f04b5b831074b68abd72965a9fac35443d93118622b629e43d4275f75ff44983bb9bdcf6697fb5dad145a647f2e351a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "69043597-8875-4beb-9fa9-9631bec3a0a7", "value": "T1DCF2F1B789AFF27EF4C18B726C28EAC0F966A9C35C090B5F445136AC44737583912FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "da0db971-e083-4001-9f3b-ae9ba9abfa92", "value": "768:ckjvsa/voIruB2NUJfVB5F7n/gcGgg8cFY6BiziJ3ew1hf5eHgotTHOrUx0nZ4:XzHzxUrBPnJ7lAukCjxMZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223933, "uuid": "0179bf6a-d726-489a-8b49-21d1facd2502", "value": 36932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223933, "uuid": "21b09d7d-1d68-40ce-ab0b-415d6fca8329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223933, "uuid": "2d4505b9-74ac-4507-99dd-3a2b26ff0da5", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a30af90-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223991, "uuid": "7052d45e-ea2f-4035-92c3-f5a421d51e08", "comment": "Malware payload (Mirai)", "value": "515dc53072829f498247d991a19172de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223991, "uuid": "95a96f0c-004b-4ba5-93ad-1d7e9628b261", "comment": "Malware payload (Mirai)", "value": "6ea6aadf3db0249183f19900a60fa01bc8685719fea000930d6fd95f271b40fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223991, "uuid": "9720610c-0a52-42b7-97f5-04f8a60c5838", "comment": "Malware payload (Mirai)", "value": "9590470415adcc87a22a5a4f52bd6bee2fe98b8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223991, "uuid": "653bee4d-39cd-4d67-85f8-daa9cc34d8aa", "comment": "Malware payload (Mirai)", "value": "ee34329d1c2619b7eccc55ae816758cb8924f9b698db764a0208e46a75f1504743e09367b33ce2f974f7d1f3fc549d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223991, "uuid": "2dfca3b3-1139-4adc-8836-57cbacceb1da", "value": "T104A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223991, "uuid": "491dc91b-d453-44ca-aad4-609d7b420887", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7qXr:J0DOpPRWu8ERZ+0u8vjhhqXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223991, "uuid": "5f3c4812-b87a-45c4-beb0-930f2729fa60", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223991, "uuid": "545e547a-2f12-414a-a56b-e7e656e07338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223991, "uuid": "dc1579bb-31dd-4582-b8cc-b35214d7c57c", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1401e1-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212966, "uuid": "6fbc83ae-fefc-4bd3-8b90-a48e716c48af", "comment": "Malware payload (Mirai)", "value": "a9301144cd3c15c64f21a0b5977f79cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212966, "uuid": "1cfe6096-15d9-41f2-b2f0-901417c20b39", "comment": "Malware payload (Mirai)", "value": "6ec0a51a4c201b09742ccc2ed5553224f025312c58aca3933cf12e6d79a0d2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212966, "uuid": "b086a2c0-0810-4e2b-b401-f4211b3a3b75", "comment": "Malware payload (Mirai)", "value": "36bc9a6875476ad5178a16c6c3a101c47d966316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212966, "uuid": "7df1feef-e61c-4af6-969e-efb5acfa2de0", "comment": "Malware payload (Mirai)", "value": "008f7c4551303c1ffd92e2d7068c7b678709c974f36bf2167a67a494ff80b1c91efb89e7bc404f5b6fc3f7ad86d63365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212966, "uuid": "7b29298b-6697-43e2-bc5d-deb3a96a30c5", "value": "T1AEB36B63CC792F98D219D174B1B48FB92B53A92192871FBE5567C3B48403D9CF90A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212966, "uuid": "8fc7a881-0564-4259-9c53-8411ae553a44", "value": "1536:QaX881Y9egayTxxR8CO9pVubTWcb/VBcUpKL6myqcn8h89:QwY9efyTvR8ZpVsTWcLsxLU8u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212966, "uuid": "18f9ba2a-b12e-47bc-85fa-5fc65bd9d22b", "value": 114884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212966, "uuid": "830fe1bb-a510-4daa-8a0f-a892369d5203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212966, "uuid": "61e3fbf3-6cac-4f99-ac01-f04dcc515129", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ac234f-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236335, "uuid": "4794f9b6-a79c-42d6-bbc9-d0f24f43230f", "comment": "Malware payload (Mirai)", "value": "4935e64f3f25868be492ab2cc72bfb90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236335, "uuid": "2ff87236-9c66-4244-a362-3c4008187d60", "comment": "Malware payload (Mirai)", "value": "6fa33dd60b92af8e236a7ef8de251783447d10577549378ffa0544d066259499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236335, "uuid": "c778f6f3-ba38-498a-a711-16941a3ecf31", "comment": "Malware payload (Mirai)", "value": "cd3230f87ca3066acd51967715e56e689489c3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236335, "uuid": "ee48f853-f8b2-42b6-8bfa-2bf8c3c2d862", "comment": "Malware payload (Mirai)", "value": "60233f544d5579f468f1fe0a719e963932f0c38215a6f0e247e34d33a479282cb5d8d83f8d77bacd77b4087da17c42af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236335, "uuid": "07f91a8e-e571-40fc-881f-f33c07c16476", "value": "T1F5833A95BD958A23C6D422FBF62E528C372553E8D2DF3103AE211F6136CA42F1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236335, "uuid": "76607cd9-dc54-43ee-8bc3-eae3854427f6", "value": "1536:urNQkpWVs0w3ntK2fu9yyVeqp/56YAphmskLnz02bIWqjlfOuy60qka10Wi:urma/z3nc2fu9HYh5WzRq9ya2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236335, "uuid": "0a48bb1b-2ab8-4ca4-961a-69704de0cea8", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236335, "uuid": "fd888f4c-c787-4d24-853d-7fd0200b2f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236335, "uuid": "5de5cb96-e14f-42b2-aa32-c7f1fdfe95ef", "value": "bin.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75057316-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199877, "uuid": "0c8814e5-8797-4010-8774-4b53fd38aaf2", "comment": "Malware payload", "value": "aa621152fc6840c1ea4aa2542e247625", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199877, "uuid": "3f7b695f-88f7-4ca8-8404-2653756ddb51", "comment": "Malware payload", "value": "70c93d4a95eccb5822334fac8eb8fec51e43ed2477893dee9e033f4adbb14ef3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199877, "uuid": "c148e0e0-f2db-4ba4-9449-5939229a752c", "comment": "Malware payload", "value": "da2f18767d29731e94b1e2354de09d2058512abf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199877, "uuid": "b400a0c8-dd2a-41ce-9c1c-321a837473b9", "comment": "Malware payload", "value": "258a8065387b6104acfc05642327a5e8c7ef45af1c0ecf2f07a8102c163a8cc5604caff09e131dd035254e1ee43e5083", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199877, "uuid": "3448ce27-28c3-4f00-a3ac-440016477fad", "value": "T106041233E3005588C88DE03492DF6A79A270B635C091EC4B6A68EE5D3D35B7BDC9752A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199877, "uuid": "d6f3a116-e8e1-4836-9b5d-8680389919aa", "value": "902004cf7fff8197f1cccd171ce69e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199877, "uuid": "e068eb59-2200-4769-bba7-59c3bb7562a9", "value": "3072:C+x/YbS65+FxIN2VVV5F6xNcx8h3gkcapXkLpklNLJol8eugYTC2nCeQ4hd75i+:C+xwS65kFVtIj3Xcap0NkldC8TbY8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199877, "uuid": "9984174b-18ea-4bef-85af-772f3b05bc7c", "value": 175880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199877, "uuid": "bb189fd9-71d4-4962-8cc1-e86c3b12f083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199877, "uuid": "89714e6e-395d-43ea-a491-0aff89a79dc1", "value": "70c93d4a95eccb5822334fac8eb8fec51e43ed2477893dee9e033f4adbb14ef3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfb60ed-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212292, "uuid": "0ef27d31-efbd-4423-a0ff-bd91e8e0e834", "comment": "Malware payload", "value": "ca29fc2a4d9928814bde7c7b41a41b46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212292, "uuid": "74735fd4-d553-4808-8371-681970658181", "comment": "Malware payload", "value": "71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212292, "uuid": "9eb27ea4-bd74-4f05-8221-3c05bd211dd0", "comment": "Malware payload", "value": "273d0e3c4e63544b4b2448e4f1324b39feb28f60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212292, "uuid": "70a44aa8-87e0-4537-aacc-9cd6ea0b8571", "comment": "Malware payload", "value": "f65f83c9b39f7b544c2736f4795be24198ac0273ffbb80d9084037fe84e0a1990db31b35465254105e02f1bb80ccf6ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212292, "uuid": "1408d7cc-3c75-4dd1-b48a-5e1ee0960692", "value": "T126471224F50CD2C3DB2AA2EEBC881AD28E7C58AB44E43EA7151A4DDAFC8F50D15734D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212292, "uuid": "2a2c0ea4-6394-49c3-9916-32c563e42c19", "value": "96:1ooUGWwZxdbNHtnaMQK6xVLAiXOliJ4qzGlNldy1tVPIWGikJReT+FYpBm+Y4mxK:UYRNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212292, "uuid": "8eaec2f4-edd5-4975-a5c6-914509662fe3", "value": 24877746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212292, "uuid": "da11ad29-cff2-46cb-a6be-fc6f146f3f86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212292, "uuid": "3a93cee7-b22a-4b2c-8114-0c6c40af1063", "value": "ca29fc2a4d9928814bde7c7b41a41b46.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e238f5-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772210218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210218, "uuid": "c8422907-b73d-4155-8537-bcf006edff28", "comment": "Malware payload (OffLoader)", "value": "2fab826976aec3d3e8923b50eceb0571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210218, "uuid": "57ef29d7-74e7-4a22-bcdc-5fe3b5c2d501", "comment": "Malware payload (OffLoader)", "value": "7299233fbd3065c48bd98488db507956a52b9a780388e14e2ffde4d388c94ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210218, "uuid": "b5b298ab-8879-40d7-b8cc-9b26beeab668", "comment": "Malware payload (OffLoader)", "value": "51ba86c6cfbf13440f127ff8d85aa9ba36aaa950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210218, "uuid": "5ced4f8c-543c-4f32-a6a2-cc5cff524358", "comment": "Malware payload (OffLoader)", "value": "a4d3de83bc367745c8e8b91056826b6bb4063b964412760ef5746c4a3e38a96e091a98835e5042f367edde061686ca5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210218, "uuid": "58b6bc0f-17db-424a-86ef-d0f8bc262f2a", "value": "T1CEA5C03FF28BA13EE06E1A367972A110553B7A61A4128C5296FCF88CCF255701D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210218, "uuid": "85dc7ed0-881a-4e9c-a5f0-42411744ad49", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210218, "uuid": "ad99c448-d594-48f9-99d1-ec1ba86f19d8", "value": "49152:duI5hROs3WcUUMxuUO6QQNJ8cOxqDNrlHgVn:d5/F3OnuMNucySNrlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210218, "uuid": "17416c40-1f9d-435a-b4e8-5a6387fef15d", "value": 2098454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210218, "uuid": "d64ab2a1-feb3-4682-ad97-e827a613ea28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210218, "uuid": "d95f1fa2-64a4-41e1-a317-60b7c8bbd4b0", "value": "2fab826976aec3d3e8923b50eceb0571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeebe9e4-13f7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772208993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208993, "uuid": "ee4c6087-5b6f-4780-ad81-86ce9fa9d0cf", "comment": "Malware payload (RemcosRAT)", "value": "fe868e87888e7e76f8a4eb916308cdba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208993, "uuid": "fff5bddd-ec7f-446f-b514-6ddccc404f02", "comment": "Malware payload (RemcosRAT)", "value": "731ae18f35cdcefa9d8ad03ceb602a3655085cc343a6e5bc3ad0ba8108d00837", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208993, "uuid": "c5fca7bd-9c5c-4fb3-839a-73daaa16d980", "comment": "Malware payload (RemcosRAT)", "value": "01e3ace3d12adcd0aafb08313bbd962897735d65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208993, "uuid": "f622fd9d-e86b-4c3c-9b4a-52b8414bf438", "comment": "Malware payload (RemcosRAT)", "value": "15a03fb513ad0da730d40f902110201607fcd1c27362384a04c837c2df385447eacfb75558e07091bd2db1c5afc321ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208993, "uuid": "896838af-5efd-4af0-98a8-f90e9df0e8c1", "value": "T18626125404672EE40FC9C35DF725E878EB62B41629631DECE243F18B4CCAB8A749B4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208993, "uuid": "39986919-361f-4e54-9e15-dea5ac7d56a5", "value": "192:mmhC3+ldTNuTGB3cFSlPOM8HZyc63/Y2eyExruXPa2zvc6Kdk32Df6dWV02kWj/X:O+AaWj9xiXii2LJsFwbPBkY5owEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772208993, "uuid": "81e3ab9a-057a-4d43-a612-4fdcc914840d", "value": 4427935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772208993, "uuid": "f417c153-a41e-4bb3-af90-d27a99480d13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208993, "uuid": "4fad520e-dbc2-4b27-a473-a8dd2a1e90f2", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374b7f62-13f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209222, "uuid": "e88f9302-4d18-4d01-b849-1f5511bef586", "comment": "Malware payload (Mirai)", "value": "7f86faf9fa2944797070ce4a8b6cdac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209222, "uuid": "e600f20c-09fc-41ad-aedc-423f6050d50b", "comment": "Malware payload (Mirai)", "value": "7342b921f4fdc22dd9eaba072b3b95e2b124caa4b7af7c969718b773b7d7e994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209222, "uuid": "013d0f20-a8c3-437e-95e7-675700811b8a", "comment": "Malware payload (Mirai)", "value": "9491c1da2ae98eb95f242afab7a4a8cadfde26b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209222, "uuid": "b6f96deb-97d6-4eea-9e70-eff90d385bda", "comment": "Malware payload (Mirai)", "value": "6e31d2d754824f8bbc96a4aef4abdfea9dd8e9c8d7b5ce1ba13c76f8d4081fa23643f455829454b908473b5840da52b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209222, "uuid": "77441b6e-bed8-4495-9f0d-bd470015100e", "value": "T1EFF34CD7F801DEBDF80AE73B48170905B530B7E250825B372297797BED3A1991923E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209222, "uuid": "3a8371e9-b369-416a-a09c-c77a316043f5", "value": "3072:CgGw1vMV9AEpaJal62EfwRPRyFIj0f09D+WbgPusfRVxjbijLFy0ED5e:CgGwFMV9AEpaMljfJyFu0f09KWpsf2L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209222, "uuid": "600c77f7-6c17-4094-8808-7349eb1fdd70", "value": 163936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209222, "uuid": "ace4a9ae-8bc7-4829-aed3-d6df58ebafb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209222, "uuid": "5c8940d7-fafc-47f6-b0b6-932463e9d926", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5781bde-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772211581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211581, "uuid": "dab361b8-0f21-4fc2-950c-9799c0063df7", "comment": "Malware payload (QuasarRAT)", "value": "d545f3a8ca8b9f11b4bcf941bd874892", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211581, "uuid": "eb65dabd-8514-421b-bc43-8d86d737b88a", "comment": "Malware payload (QuasarRAT)", "value": "7347f0b12918ef4e7b6cefdd29f8c6a39fcc8a4b06385f104460583808c2492a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211581, "uuid": "5792dcc7-3e85-4c14-9841-fa799669c3b8", "comment": "Malware payload (QuasarRAT)", "value": "11cb58f5142dff7d634d991ac2cdf21e0267235f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211581, "uuid": "f3c39d7e-a076-466c-bd16-09ef7a706bbd", "comment": "Malware payload (QuasarRAT)", "value": "9081c55ac267b828f42f2e712c1fc4f68ae2b56fca69d3bde6c4b29d0e6fee35446b676568dea4863a40e0f7c1c6ec44", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211581, "uuid": "93f956ea-9a95-4615-98e2-068c8a5083ce", "value": "T1EC5501158AC86FB5CFEC5E1880FE1A1D53E04A8E542AB58EEB73BD47AFF75040107199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211581, "uuid": "70d85bb2-7746-4632-8b3e-cca49510537e", "value": "24576:OYo+cs0D6HAbMZFgAqSXYH9EmFTd8auefzcn6CkJ2p0e3CN:KzCZGO+Tzfc6VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211581, "uuid": "9939803e-a9d0-47ed-b37b-05c14cc2e552", "value": 1355707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211581, "uuid": "af44398b-035d-4dbd-9ec9-0492107599c4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211581, "uuid": "f97fc4d3-8a83-48ef-8096-df3192773c51", "value": "killxd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27fbff9-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772212435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212435, "uuid": "771a428c-91f3-4dfd-b277-ff56665488b8", "comment": "Malware payload (AsyncRAT)", "value": "6f67ca695bae95a13f4b398e2eede338", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212435, "uuid": "3be95b7f-c4c6-4d6b-b4ab-ed81b8b9a17b", "comment": "Malware payload (AsyncRAT)", "value": "73b3bcf1b9e69c85170700551a9028d21ad93e2dde55e8c7939e66c82b3eb2ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212435, "uuid": "5a19adbf-7fe8-411c-89c9-686a8af63c75", "comment": "Malware payload (AsyncRAT)", "value": "aca1fe417e4a07a3928381b9fafc6278bf8caf05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212435, "uuid": "9cadde81-6335-43b8-bb3e-08c688cd73bb", "comment": "Malware payload (AsyncRAT)", "value": "632e35e8b51c60393bb857aba3d951b6e5f0a02a494eb974e72d6d8cf2380adddcef45bc3a6f698e3185e83153910077", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212435, "uuid": "de2f8065-44b7-4b35-9b84-29440c668a59", "value": "T15F451273867246B475CAD7381E1A18D7F436D9B014EA2D7725C20B84F7B1A8F58CA2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212435, "uuid": "1bf0c086-3490-45ab-a997-e426e4e8b731", "value": "768:W7NtEXSB4Phb6IHC6IdVG/tmbTyjTM55NM:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212435, "uuid": "012b7fe4-58ec-4a6c-ac52-5aa2674e7050", "value": 1271934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212435, "uuid": "b6fb5386-c818-454a-a469-a455c92dc178", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212435, "uuid": "7c678a0a-ce97-49a9-871f-7d9262ffd878", "value": "Contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f700de-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155862, "uuid": "88b6c346-3162-40c0-955f-c736920408cc", "comment": "Malware payload (Mirai)", "value": "5e5a78d5ebd29b52ed0a40b0b0bac3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155862, "uuid": "fa4c0fe8-d625-4847-b760-65e9a679b7f2", "comment": "Malware payload (Mirai)", "value": "746ef34d96104cfd17fe9a0aea6b2d3d2584ade97c9e990fff4214ae8cab5e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155862, "uuid": "38bf31fa-a4cf-430d-9955-4cdda460a0bd", "comment": "Malware payload (Mirai)", "value": "66ff4d08faf7dffad83acda81f438f8f00505d95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155862, "uuid": "1cf962c5-85e4-40a5-83d5-a49f63f21b59", "comment": "Malware payload (Mirai)", "value": "b02f7f4714e152bd286e9ac22f322a8579090011442e9441ec38c9e32ca30f96a7f014e7456cd932eface01aee4a7b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155862, "uuid": "7a299c9f-5bed-4afa-8ed6-01b060d8de79", "value": "T121C33B46EB808B03C4D51775BAEF42493323D755A3DB73069A186FB43F86BAE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155862, "uuid": "c4dd5483-8c03-41dd-9983-35aae21ed26a", "value": "3072:6mL295Z0oW5zvnm82C7L0//+AHmDIM/9nT:6mLM5ZYbnm82CH0THmUM/9nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155862, "uuid": "e3df52be-5d4d-4bf4-b17d-534d3d0ea588", "value": 120609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155862, "uuid": "c4e7b4e6-838d-47e6-9d2b-c85fdcbb3e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155862, "uuid": "a478cfdd-e085-489c-83bf-80045fee4f0e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493f203f-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179187, "uuid": "bc537a22-dd08-475d-a790-1360447fdbb7", "comment": "Malware payload", "value": "9d3e15c20efb8e86e742874df7908873", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179187, "uuid": "6845a09b-dab0-4648-bb5b-1c95ea150492", "comment": "Malware payload", "value": "757ec732909b7e46dbef702cb33172558c31290b69566a1e3c6083d98ba62418", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179187, "uuid": "918b4cfe-b612-4cd1-af66-2991b4a0f8d7", "comment": "Malware payload", "value": "933b9a8634ea0eb3eb9d4f5942d36821a15938b2", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179187, "uuid": "a537a43f-5868-4e07-9ff2-0445cb530670", "comment": "Malware payload", "value": "296111594755e1f4f38d22143d788bf26203e5680a296f157fe8ecadb8fcad41f29b4848a6c2cf805fc7489c71bfb18b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179187, "uuid": "e6843954-0ce9-45e3-94cf-e2fc9eba8572", "value": "T13A7412735AC63D3FD6AE09F31093B8B475998E0289B4712461035BCC5E6765E06AB0FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179187, "uuid": "f00d444e-4a2c-450a-989d-810706a74c8e", "value": "6144:1eHxktl5lNXlEMsBkUK1pownvPo1zCHaFKFn1spwSqN21DSFY/OZPxh7ewHEAlc:1kktl/NXlQBkUK1Dvgd4HAhqEoFjywH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179187, "uuid": "657237b4-2fce-4420-ad7a-8dd1405379d5", "value": 355015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179187, "uuid": "4bc86530-f053-4a81-9910-196e0b955d76", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179187, "uuid": "2cccdf8f-e958-413c-8c73-f9527995de72", "value": "CF26-064 Shipping note.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778e98cf-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177977, "uuid": "0ed3b4fc-45e5-438e-9f02-40961a4db0d0", "comment": "Malware payload", "value": "823be813900377d584b041bcd37b99f9", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177977, "uuid": "993b6b9e-597a-4716-8667-15a31490d266", "comment": "Malware payload", "value": "7594b6e6286d99530857d0083082cbf0718d390bbe4f7e251002eb7ecc5d1124", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177977, "uuid": "5caea0fb-f99c-4d94-a97a-fff5e2ed1682", "comment": "Malware payload", "value": "69df658b8339ca61c1602b271fefdecf7d90dab3", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177977, "uuid": "d2890950-5511-4fca-a971-14243e03408a", "comment": "Malware payload", "value": "e06ed7065c364bec83dea889cb278c5885331748918c89ec5fd0ba64bac3ce323ddeba0094a06cfcb23d8c8debb9e5fe", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177977, "uuid": "a9dd0aa8-c25f-4a0a-9971-d3f097c8b2a6", "value": "T15DF2AB15B29FD20870B34B995BAF06754B6F7A5E1E3D404A41CDEA8A8FE3512CC463B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177977, "uuid": "880a8356-e595-4d8e-933e-b9deb0819632", "value": "384:kj9p3uAOjWj8j8j8j8j8j8j8j8j8j8j8j8j8j8j8j8j8j8jRjvEvYEdIa4QVnWYw:+p3uAREvYEdp4QkYeMMOA4gcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177977, "uuid": "53cd8d2f-f5a4-4e82-b890-c376b7c89931", "value": 37222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177977, "uuid": "f3e1bf13-b85f-4090-a162-5fb08dac4362", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177977, "uuid": "e10617ce-05ca-4527-a877-89618a5484ca", "value": "7594b6e6286d99530857d0083082cbf0718d390bbe4f7e251002eb7ecc5d1124.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e3d40-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772175564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175564, "uuid": "48a35272-42bf-4184-98b1-dc91a79ff3fd", "comment": "Malware payload (AsyncRAT)", "value": "407a119680b8d8a7c83dd766de21dc7e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175564, "uuid": "f8fdcf24-c418-4997-bbbd-80ec1439c541", "comment": "Malware payload (AsyncRAT)", "value": "75f57bbd59cb4821270f03759d513eb4af7317b3a1fa030aa537640863bd10d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175564, "uuid": "15b134a2-45f5-4842-b88e-96163cf0f7e7", "comment": "Malware payload (AsyncRAT)", "value": "1fbde000e3aa276d1b92caab7c704aa92ca4c034", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175564, "uuid": "3fa5a1af-2277-4d69-8f5b-264bc3e95b11", "comment": "Malware payload (AsyncRAT)", "value": "cd2ecb622832d81490eb02ea651bab60bb21d6a3365052bab6e35fa66672572fa2bc4ce58b595b495a102c8ea882301b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175564, "uuid": "3218ac82-f342-4459-80d7-5f319792a119", "value": "T110D23A08B3D88561E1FD57B94D7292048775EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175564, "uuid": "9daa6fd6-8dd7-4ea5-9b46-5ffc47dcec36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175564, "uuid": "dc5a7c27-1241-44e0-8e50-eab6368dfc98", "value": "768:zwbRXxZb2uSEg/cIRGqom/Rb7fB/dTsO/+:sbRXvb2uSV1i4RbN/mO/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175564, "uuid": "765c32d0-a87f-4620-9a21-c1d7de97d8f9", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175564, "uuid": "a1ca654d-6bf1-4643-8e71-a49d4917921a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175564, "uuid": "2078aafa-a8e1-43de-b848-4b7ecb7794a5", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253c6de6-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772212198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212198, "uuid": "c70171d1-4ad4-412a-b51d-334c2ab327e9", "comment": "Malware payload (DattoRMM)", "value": "e337fdfa169b6aa306e98ce31c5609ca", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212198, "uuid": "1474eb65-df65-4ee4-a704-001bbe47a657", "comment": "Malware payload (DattoRMM)", "value": "768d43792ebce5de6f67b72b641af51fd89207d39f10c82946b78a6d2b23cab9", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212198, "uuid": "bf8e5277-1db4-4099-9708-0afbc1d28e22", "comment": "Malware payload (DattoRMM)", "value": "1a0fe18d9311fae0853c9d09fc3bf153a24f0845", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212198, "uuid": "f519385a-943a-422c-888f-a2f4b4b7f1cb", "comment": "Malware payload (DattoRMM)", "value": "e6ad72636c2876bec386df9f3f38b6475b941ede76e759a57357ec81ac5bec0910d43da8e194ae28ae0b477611fe6d49", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212198, "uuid": "47136a89-e27b-4a65-ad4a-1fa143397631", "value": "T106B63347D9778DF0CA330A3890D2196B3305980E486BF4C9F509277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212198, "uuid": "78a0f058-9547-411a-908d-61b1ea41c731", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212198, "uuid": "c9a2579f-47e9-4849-9680-34889d5650d7", "value": "196608:FaZk+w/P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2p:BnumzZFw5S9pE7Asjp29qIT0jarlZr89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212198, "uuid": "aa076c46-f69d-4e42-b0b6-be7d5c2809fa", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212198, "uuid": "67cb0258-989c-4781-89da-2123aeb406c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212198, "uuid": "66f78abb-39b9-4eae-937a-cf0403639aef", "value": "Tea_Party_Table_Food_Festival_IV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d224a79-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190710, "uuid": "458e7787-f971-4958-84d9-8d11bac17c4b", "comment": "Malware payload (Mirai)", "value": "bec6b127e1a0d8a7f672a9a702a5d634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190710, "uuid": "241dd5dd-7b38-4b60-b0e1-eb3ef9a446a3", "comment": "Malware payload (Mirai)", "value": "780600c6734871c76df8f477eef9299103617eaf5de1017ff08784bd40d521d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190710, "uuid": "28769759-d9b3-4eb3-8043-f70f1800794b", "comment": "Malware payload (Mirai)", "value": "b5e5fffcd6757a87755f878fa6721639d03ac5dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190710, "uuid": "c873c108-2841-4a44-acd6-a12d46a6cf24", "comment": "Malware payload (Mirai)", "value": "a3d99827ee1b11d5167591673caeade2209cf5cd197b6a9bc2678e45ed832025ae474bad7be1a147bf70db9029acc915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190710, "uuid": "8097d950-23ba-41e9-8873-56c0a9709ec6", "value": "T13D36E815BD846BA6C02C4B7585EACE9223706D144EF15A372264FEE9BC762747F0BC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190710, "uuid": "a800d3d0-7017-4fa3-9ede-d2435777ee63", "value": "24576:Yt3zJx7MpLO3Koc5RbylfdhITmBASJzt5Ctc6nSsv9IQDua9oL1xsAZPRNdQhVVn:C0pLO51h4AAMv3W74FafsCP0B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190710, "uuid": "d05512db-768c-4f33-bada-b2ccfc328da3", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190710, "uuid": "4cb86bd1-eb3b-43b7-a6c1-0bc3dff31b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190710, "uuid": "b27cf006-c71d-4af4-9fc1-83e296ba4e98", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9da3491-13df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772198677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198677, "uuid": "ecbf6093-3931-4036-a274-3a85a9b3671b", "comment": "Malware payload", "value": "ed7ee9e51422d3ded5fa58c6bb100b34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198677, "uuid": "79d45d00-16b8-4f05-861c-f813a2c7c10a", "comment": "Malware payload", "value": "781bc15e218f1845b33c450ecd3feec2bb42f59a7a85e25a2d17d356908b8a7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198677, "uuid": "c3c699f5-4c44-45a8-b228-b1069d30f2c4", "comment": "Malware payload", "value": "1a3e066106a37b1cddfd5ca34a31409f9b9b2320", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198677, "uuid": "56e3200d-f23d-4684-a06c-020b43fc82d9", "comment": "Malware payload", "value": "95bc2478e30b08b9c6c412e7814698df798320a59657670ad85f2e69d4783a804d7e9e1604b5bff0d3800e23e9dc3c14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198677, "uuid": "4fd8d735-3152-4e06-8fc6-392c192ed568", "value": "T13652483721F08B3297D055C4A3771BA14F72A70B456714B8F4BE5A269F2EA0370EBB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198677, "uuid": "b00948df-291d-4d9d-9316-b4af8647a9ae", "value": "96:cCuGB6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwaV+I+j+3+FIBmIBGIBXgT:cCuq6nC4hvZ5mzjqKNpHPQsmJ1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198677, "uuid": "3cefbb03-2e0d-41e7-a772-38dd4474448d", "value": 13432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198677, "uuid": "e1f42d63-a63b-413a-b8d1-6575054c942a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198677, "uuid": "d49d88aa-cf03-41a4-bc4f-5c110af0c934", "value": "781bc15e218f1845b33c450ecd3feec2bb42f59a7a85e25a2d17d356908b8a7b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a224925-1380-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772157607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157607, "uuid": "2669bcd5-0dec-4583-8dee-4ed7f1a35c3c", "comment": "Malware payload (STRRAT)", "value": "2e5c6da31883273e9ce70f1cc6de4415", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157607, "uuid": "03ab57d1-601f-4f10-b6cc-ffaa39f4b131", "comment": "Malware payload (STRRAT)", "value": "783025823fbc883340141ba01354d3139c8abc44459609437dc8ce7c8affbbe7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157607, "uuid": "ac1d7992-338f-4787-a186-ebe9f48d7ee9", "comment": "Malware payload (STRRAT)", "value": "f00e9c7518a8be8f0e8058480df4e544fc2214f1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157607, "uuid": "fc031edf-6523-4330-b3dc-dbd4050fd0c8", "comment": "Malware payload (STRRAT)", "value": "3dbec1faefdcad4a13e61c86c7c249c4d0900956ef548b517ed76b4508c57aa923b7b21f96779fa1de3115b030170939", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157607, "uuid": "784249db-3caa-4762-b1f6-637786d8c47f", "value": "T167A319447B44D07AF767B073096C928AA970E4EFD2D4B1878EF1ADECDCA98480F53685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157607, "uuid": "d123b8ff-7fff-4b0a-a95d-c1fc9efe670d", "value": "1536:mBRy3KI8QNzpjRFR+eJ7OZJJsKvG1CWXqOUo7vli:mLXIf5Fwu7uJYC2nv7vli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157607, "uuid": "e75d28f2-0e20-46ef-9742-1e807e64b290", "value": 98443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157607, "uuid": "63ae0b47-33b8-48aa-b14b-59b787858e27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157607, "uuid": "b9bd3b48-1b7a-4921-8eb8-86ca384d1f48", "value": "nCOTIZACION.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ba1dff-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191241, "uuid": "707f219c-bded-4e88-ac27-9c0533be8480", "comment": "Malware payload", "value": "f04c4e3354d7b175fe6d4555c9dbff3b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191241, "uuid": "c4dbb085-66f7-41fe-8c89-2a490ca75652", "comment": "Malware payload", "value": "7943027a23fd3f9cc231f4ef8dd26ca05b262a3b5b53a698f48bdae2e693e144", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191241, "uuid": "aa37585b-40f4-420f-adcd-6a09c048a8df", "comment": "Malware payload", "value": "a739537126098c4d7f071d6ff3a45d6a591030dc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191241, "uuid": "0f571ea2-8ef9-49f4-ae7f-f43280528fa8", "comment": "Malware payload", "value": "cf12291db1d3db5a0263f64493aab54bc0419fab29f58c4c003c76a0da1ec812dbbe0dbdd04b42ceac5eacc38510c387", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191241, "uuid": "fc99693f-15b4-43c6-b434-21e366896dc7", "value": "T18B46F1C7F7D8A92FC877507289BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191241, "uuid": "845d8610-2a3f-4054-b3eb-1f4e80e4cc72", "value": "98304:GrhGoTwrYhK8Yofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltk:EjK8HfyaIbaciAFvrEZpXqmY9XrF/mpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191241, "uuid": "61b8fa32-17eb-44e9-8bdc-6742bde66e7b", "value": 5864790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191241, "uuid": "09eb1bc6-44c7-4371-a76e-0174810d492c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191241, "uuid": "2dad280c-7a1f-46a6-ae66-a19858a5c1c6", "value": "Summer138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23bc8e0-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212972, "uuid": "8d36cf8b-68b5-49c5-ace7-cf0612cb8347", "comment": "Malware payload (Mirai)", "value": "6d2eeeb0de989524108822d8afa68a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212972, "uuid": "31a70ff5-1cfc-4b22-8838-26efdce80625", "comment": "Malware payload (Mirai)", "value": "79638aca353d9120c9ebc9ead40a3a54e918d31b4a7a1121401c9304f9854bf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212972, "uuid": "45b6bde3-e1bc-4353-8a1d-1bd3618e4a23", "comment": "Malware payload (Mirai)", "value": "c47bf9f5ea32dc7cb274ec05d4fe590420e400b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212972, "uuid": "35aceb9a-110c-4c0e-8055-00b39be49fa6", "comment": "Malware payload (Mirai)", "value": "ba14a5d6038da44515fadd42485ddd2a80f476854bdb4625a6019f92ccda85bf6a3b86bf9f3683e3139276ede28b3d80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212972, "uuid": "cab310f8-1595-454e-a277-10808b172139", "value": "T18433F191327B65B9D02754336C06B104DE3FB96B2743471F217AB23EA2EEA45BA70342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212972, "uuid": "f85b99b7-11b4-4ff2-aa73-492d272a762b", "value": "768:TlQEuWOnV81fYvDy+DXznUyfBXNPxsBPen4yw/gPZqubiZahGA5M1gt4fgUmhsaZ:i5HlvDfbBXNGPzBAZqV0GQcg2dOvs4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212972, "uuid": "08b25e66-8190-42b8-8171-44a89a78e10f", "value": 51324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212972, "uuid": "124836b1-3dcc-4de4-ba29-06438b14617b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212972, "uuid": "6c8c67cd-4f4b-4206-a5f1-d0e3c44fa07d", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9672fd8-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210299, "uuid": "2f2d7198-124f-4329-95ff-5fcb7ee94c0f", "comment": "Malware payload", "value": "3ce703a79c8f38c99d33ef001316f9d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210299, "uuid": "74668311-eaae-48c8-b588-3bbedf368309", "comment": "Malware payload", "value": "7a02133d3a76d69ea6fff469e3899f9dc308ba8f048cb5360815914ff8ce3bbe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210299, "uuid": "df4970bf-ad1e-4162-9409-685106a3f9be", "comment": "Malware payload", "value": "ed0b467d7246d197a9d6fa9a860666fa8c779239", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210299, "uuid": "74e89431-3028-48f9-99ae-637bdc1f32bc", "comment": "Malware payload", "value": "aa870665a99c3f323b4ff6200a99f208e345ab650997354320582ade1f1e82db43b2bf425fb92c0b1e68d86c0c71d050", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210299, "uuid": "2ae917e1-eecf-4e15-9d97-5bbec115cc8a", "value": "T1F106BFB876047DD6A67F477BDA96ACDC13B626239ACBA8CD4064B7C30563371FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210299, "uuid": "47e78996-dfb6-4099-a7c2-b48763c60dcd", "value": "3b1194b077bf0d2ac1b23c9ef764bfea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210299, "uuid": "4163050c-de81-40de-81bf-32df26b79053", "value": "24576:yi/TeNJe8PqYPZ0MdD0/PeOmJkDhPyNn4ONPcwhiHDjnovfbtP80XebNdY1VNKLb:ykQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210299, "uuid": "a86bc2e3-c09c-4b2b-bdfb-4883ca319b9e", "value": 3660288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210299, "uuid": "08fa044f-5326-458c-b3e3-6086c878a767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210299, "uuid": "bb8dbc49-a0b3-4fae-9639-22985362a8f4", "value": "3ce703a79c8f38c99d33ef001316f9d2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b0db8a-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212969, "uuid": "4aa4a029-2dd8-4be0-b873-395e0b32f8ae", "comment": "Malware payload (Mirai)", "value": "235cfffa45823774a1821ecaff15e6cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212969, "uuid": "616d350a-d5a3-44c7-8445-3415415d9f4d", "comment": "Malware payload (Mirai)", "value": "7a1ae8f00bb1519d27ffee0a507d6b4e720c2e88ca40398697c617cb352308f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212969, "uuid": "d3f68056-cd62-4dcc-b4aa-15a27c2e1255", "comment": "Malware payload (Mirai)", "value": "93ddac4e95a735090b5b404e4a466e6cf37613ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212969, "uuid": "56c1b23b-f77d-4f81-9a69-1ad1616f9453", "comment": "Malware payload (Mirai)", "value": "aac09968ccb39b765d97bd7b527a822f8de49c4f38fae5a7fee9ef6472e7b7ba064b26a4f5b899f1c0d66924b62fc2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212969, "uuid": "2f67fd90-f279-4121-81b8-0634702f4f91", "value": "T163230185B9136C30C422EC75A91F428A12AF4BB4F17637885578464DFE6B52F10BCEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212969, "uuid": "c4c22b55-0a96-4217-b810-384e849eb64e", "value": "768:3LdIP4zIiN/SA3cXIdKbiz41x64h3iTowq6EktlDqTcseCXiLkZ/EeUNkKWNs3U/:7WYPN/5c4del15hSTx/xXMbeKKDkK/zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212969, "uuid": "ddbcd084-f761-4a8b-973a-b6c3ed46e15e", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212969, "uuid": "5db4e4be-0055-461e-bb19-67d99c9659ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212969, "uuid": "df2e4e1c-7c19-4de4-9b15-c5a9b8200890", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865fb493-13e9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772202912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202912, "uuid": "fb4021dd-6e35-4dbc-a318-564c4619df49", "comment": "Malware payload (AsyncRAT)", "value": "04dc4f5bc73930802b16b83efc3cd42f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202912, "uuid": "472a3475-0a69-4ab2-838a-05caeac42061", "comment": "Malware payload (AsyncRAT)", "value": "7b0ff4c29a0e121115f87ef7e97fbc86abe23b4a1164553c19f376e812ba75b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202912, "uuid": "9d363820-fb6f-45d1-b909-47cfb20ea752", "comment": "Malware payload (AsyncRAT)", "value": "129dd62a70147edd6bb792f63a0ea54b91e39950", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202912, "uuid": "238830e0-4c3a-4a3a-afc1-112db234ee8e", "comment": "Malware payload (AsyncRAT)", "value": "accaecc4191e822776461bb80d15b7406d43323933b07dd89bf4f30969aafd30dbd95c204a6c1fdbfd22c5fe9caad5dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202912, "uuid": "2911b744-4c40-4baa-bb49-2eb33502fe6c", "value": "T19B132C0037ECD127E27E4BF859F262454679E6733A03E64A5CD412D60A13FCACA527FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202912, "uuid": "b4428a1e-aa45-4671-b883-70baedcbab46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202912, "uuid": "d58d4d9f-7940-4090-9a5a-7f06d400c7ec", "value": "768:WJ8R1g64bIRdt8QGLwjKKKD0H0XlF0rHKaJ9wP26iGf+:nZdW9L/w0Xl6uaJ9zzGf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202912, "uuid": "a813c6a0-9177-47c0-a7ff-23239c340222", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202912, "uuid": "319a32b6-a0dd-4600-bf14-c7000633871d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202912, "uuid": "7fdd297c-25e9-4807-9d0d-e52f132eb88e", "value": "iamvery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b283ffaf-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772211147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211147, "uuid": "dbe29a7c-b2a1-420e-9fbf-7a6e2bf36b19", "comment": "Malware payload", "value": "ef72529b38a0063385c7f08121467d4a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211147, "uuid": "7da2600f-053f-46cf-853e-d236c0039765", "comment": "Malware payload", "value": "7b6eb29b43e63f8f6b0da2f3f325ac71273b56e11769419a67e180a4040d368c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211147, "uuid": "172e8be6-3645-4abf-8253-d1b6d2b1b1b9", "comment": "Malware payload", "value": "316d38d13a1281bfc80df832c9d7185f21b5eb97", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211147, "uuid": "bce3a994-9e8d-4956-a2d7-8afb4647a9e9", "comment": "Malware payload", "value": "ee7322212cf4cfc4fce07e206d9c3c7d58df5b9552bcc81151104a10c9b2fcbb3217a15a9d1b5938ba4009aebc107b55", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211147, "uuid": "a6b2b0c8-6ed7-4acb-8c5b-879ff1986271", "value": "T1E2D412332BD93E7DD46C65EB1827B070768B0C0A9675B611264B47EE9C2393C92690FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211147, "uuid": "3b6edd33-9ce6-4b61-94df-01c57d8f2705", "value": "12288:Aktl/NXlQBkUK1DvgdjqzlIgVHTY8rwiaUb7w/yopiOdrNIGhbN8FCU0WF1:Xx6k71D4hcKyLj3w/yBzSiCU0WF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211147, "uuid": "10ce7932-274b-4a25-b3b9-ece308f4eb94", "value": 634819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211147, "uuid": "61dd718e-d737-4cca-9d53-9e7dbb4546e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211147, "uuid": "32b6ade0-08e7-4ad1-a9b2-19f48cf28aaf", "value": "PO-ATL860199.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18774b0-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212970, "uuid": "41e3de94-7dbb-4e2d-8af1-717834bf8fef", "comment": "Malware payload (Mirai)", "value": "83f690e3b20cc3c3b8b903c01fee2cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212970, "uuid": "c776916a-14d2-4f62-9cdd-2e3fac2015c2", "comment": "Malware payload (Mirai)", "value": "7bab8e5cdbce8177859b9c96ae6cc419498d7314b2431466adb3a08878920231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212970, "uuid": "764e8104-e75e-4d72-9212-ba65d70038d2", "comment": "Malware payload (Mirai)", "value": "9869c5ba50cb7c95931cdfdb880ad27e2517fb51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212970, "uuid": "aea7fa35-1e0c-474b-9db2-46c1bd7d6164", "comment": "Malware payload (Mirai)", "value": "eaa37b201c541dca6c013f5b678a632393876683e8a134695bd154729d42d17aa3f399b5dacc44f90fc8c7638fe3b69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212970, "uuid": "726cc31c-591f-4a66-bccf-f35760765837", "value": "T1B833E1EEF94E64C1C7EF0A3A519525E09710ADD223A50BEA77628CC593AC81F7D024DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212970, "uuid": "7851cbfb-d602-4434-85a0-d57e31f90114", "value": "1536:ibayoZXFsbejmq8Cq0TX3iUUDpGkbHPjgNBdr/D:ibWHsbeiqL3iU8GkbjgrdrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212970, "uuid": "72eb61dd-3681-4689-9df7-afc33735d355", "value": 53708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212970, "uuid": "c53834ca-23ce-45c3-b37f-04f8d0ac32e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212970, "uuid": "c76310c6-34d0-438a-aed3-ac1d427d1f07", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54801e58-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236329, "uuid": "ad76ba98-03ce-47d0-8aa9-da7ec79aaa52", "comment": "Malware payload (Mirai)", "value": "1edaea527c5d958a82d5ef4b740187a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236329, "uuid": "cfd1eff4-51a7-4e0e-b89d-85fcae588b5f", "comment": "Malware payload (Mirai)", "value": "7c0730fdebdea8477568fd9c950661b944ad0c1e37858cc3b899055751fa5a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236329, "uuid": "e1be52b4-f484-4586-a9dc-11ed0fbdb59a", "comment": "Malware payload (Mirai)", "value": "39dbd63c3544d93dbda4c7067f2a51dbcee9f17d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236329, "uuid": "a9da0ab7-8453-4a7e-b4da-204f9142e9fa", "comment": "Malware payload (Mirai)", "value": "5aa61bccaa2f88c64205949400c4fed768417f2bd775cbdf0793a79598d7ed0db58a81797dc99e1a676922d09d8c35a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236329, "uuid": "e36c3018-bdf7-4b40-9958-201ccfc556c9", "value": "T175F35D46FA404B13C4D62776BAAF42463332A794D3DB730399285FB43F86A6F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236329, "uuid": "c7a252b3-84c3-443a-bdcb-37b71d33b267", "value": "3072:WrlV6AM/TJheSNRJz4fihzdHcPGs8z1cVagzDdmOM/9l3Mm8wxQ35x:2lsAmN0m/zdHcPG9zG3zDd3M/9hMm8wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236329, "uuid": "3307de00-2178-4cb0-8630-e468721122e1", "value": 163514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236329, "uuid": "8d15ec8c-b24c-47f6-a6b8-ad1e72d219a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236329, "uuid": "0f9ecb50-c23e-4e11-a6af-f59a316b39a7", "value": "bin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f261f46c-13ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177753, "uuid": "6436b2e6-7d38-40cc-9f9f-dfb51a980684", "comment": "Malware payload", "value": "000e88c7d46d85faa3f5db764e4a02cc", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177753, "uuid": "e5365227-95cc-4417-a3c7-ef44d073448d", "comment": "Malware payload", "value": "7d02532a3d0d76fe226428fafd91eaa0e3952abc54c221dc696b1cddd69e000b", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177753, "uuid": "1bf2e3b0-57ae-4a94-a5d3-cc173f417ffb", "comment": "Malware payload", "value": "6e7e5fc7b1d40d0e3d6031a9966f9831ca153ab7", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177753, "uuid": "e3bebca5-d940-4c82-bdb6-d0c97de9a65b", "comment": "Malware payload", "value": "da0358170399b551e4d565a1458d9331a674bcb449937f9ab836caa3bcc4016408d20d74f1dd95dc1014d6b602aaaa5b", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177753, "uuid": "eaf4559b-3b69-4c0b-a6b0-22f3ac91e491", "value": "T1E5F2AF12729F860870B38B4956AF07744B6F7E9F1E7D40AA058DAA894FE34119D4B3F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177753, "uuid": "2f5324a8-9455-4e47-9420-b9c1bf081e1a", "value": "384:IFX9p3XAHX3XAXAXAXAXAXAXAXAXAXAXAXAXAXAXAXAXAXFXgEPYEdIa4Q1CYOcg:mp3XAbEPYEdp4QwYOcMJi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177753, "uuid": "7d1f7d96-03b5-483d-a9f8-83fede6aff9b", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177753, "uuid": "bb1b54bf-b2a8-495d-83ea-96289d717bf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177753, "uuid": "9e9161f4-4dea-49de-980f-fc260817f60c", "value": "7d02532a3d0d76fe226428fafd91eaa0e3952abc54c221dc696b1cddd69e000b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe22166-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212968, "uuid": "c49afa05-2288-4e0e-8846-75a6043db05c", "comment": "Malware payload (Mirai)", "value": "6a6bc241cc9ea589d708d3d918a7b9f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212968, "uuid": "35ec5a48-a457-457a-ad67-5ce505603626", "comment": "Malware payload (Mirai)", "value": "7e96fc03c336798dfc6e38e9305d6dc0c5cd4c290e15222a500f3343c98d2793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212968, "uuid": "c95327f5-0860-4700-beb1-ab4cbf539e82", "comment": "Malware payload (Mirai)", "value": "289a77cb0b52b58475bff82bdaf32bcb20551097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212968, "uuid": "16726f38-f7e0-4cf8-bdfa-828e3a8b9dfa", "comment": "Malware payload (Mirai)", "value": "4ba970cd6b703ff7314ffb5eba16f170689b41a34c6211cac036930ee2d76e3b2c29f819ae6da42db3d2145acd0a2eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212968, "uuid": "88708194-436a-4959-ad02-ae99f5b0808d", "value": "T1C8E329C7F800DEBDF80AD37648634909B630BB9255921A377317796BEC3A0E54867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212968, "uuid": "461bfe10-084d-4b79-a127-9f1296bb9c44", "value": "3072:R5qm2+EA+yexgvCAabFcqVZjbiLLAnXMjLVgyiq7hggBs:2m2+E9gvC3FcnLQqRgyiwgWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212968, "uuid": "dad6a296-33ac-4b62-ab2a-54b59daba88b", "value": 150368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212968, "uuid": "48ff57c8-5270-490f-9234-c078413f9ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212968, "uuid": "2d7c2eec-3fed-4c63-82b6-e95abc6de07d", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2841f8-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212316, "uuid": "b78252bc-9d94-4b0f-922d-37ec65edfbac", "comment": "Malware payload", "value": "c36a853992d524c2dcbd8d2a998e1d7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212316, "uuid": "b93df791-bca0-4d06-9108-5b81ac851248", "comment": "Malware payload", "value": "7ede5711d23d113307f8f860c87028fb34b0c7e63b5e41384795988be7731d09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212316, "uuid": "3c1ecaa7-2af1-4727-89c3-1df1fa9b5430", "comment": "Malware payload", "value": "ef71495494c049489c0df529cb68d2f147d0d477", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212316, "uuid": "e1871ebd-fddd-483d-b79a-1f55b87e4343", "comment": "Malware payload", "value": "a7d5f0393f6f2fb21b8650b26171f5253ebe66eeb9e6bf1bc2ab141eb7c8462b1502bd90d01eeb9d81965e8f2d13c99d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212316, "uuid": "cc1fcf44-61cb-48d2-aa54-b6367584d25b", "value": "T142B022380C0C8B0FC3822A0C0CF0C332CFA08F30000288002332E0BA0F00CEE003A3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212316, "uuid": "3c9f583a-f89e-4c7a-b5bf-cb07fcc78580", "value": "3:wn8cocJJvKSvgRLRR5TCmZjRfGRXkZiXncShNVHM/Kewv:6lo4ccUl/TCmZ5WDsYnMCRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212316, "uuid": "7c71d1e7-1d4d-42e7-bdfe-035b4c0c5e31", "value": 123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212316, "uuid": "93c36425-1f03-4c3b-a6f9-557d68d7273a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212316, "uuid": "fc0b1859-8921-4ce5-a2f9-3cb3f28bdfb4", "value": "Y848815207.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1ef7f9-13d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772192023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192023, "uuid": "b1a748d8-2cf2-4e0a-a411-488257bd52b2", "comment": "Malware payload (Mirai)", "value": "642553704dba7ed1433a23ea382d9ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192023, "uuid": "b079cbb8-c208-44de-873b-17c6c5c7631f", "comment": "Malware payload (Mirai)", "value": "7ee339b6c14a2ec2ae0e18892e8cca216fffdd9bbf1f4701ea144d0efea265c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192023, "uuid": "45d3e376-bf3c-40bc-a9b0-6cd0b8f14a21", "comment": "Malware payload (Mirai)", "value": "089303697d42f41c743c99b03d44d511e5aedd9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192023, "uuid": "230edd10-ab37-4315-8e12-cd54d308683a", "comment": "Malware payload (Mirai)", "value": "0dcb6902d7970e584fecd6531249e3c26807fd30327682fdfdc7a80f22171ab149d26d135bc9c2149e52672ce27de953", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192023, "uuid": "0cc2189b-e5a3-4852-8ee8-b6d29de31e29", "value": "T11614D716AB510FFBCCABDD3706E90B0139CC655B22A53B3A3674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192023, "uuid": "9869eb5d-68bd-419d-8b90-dabe4964001e", "value": "3072:iJj3G62uPcQacZw66TpRF8zHAmBzPxH/sN:ihW6RPcaw66/FgH9rxHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192023, "uuid": "37e6fc5c-5c13-434a-ab93-cea4807f9d5c", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192023, "uuid": "0c0548b5-4e66-471b-8598-176192856f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192023, "uuid": "8d2bf582-83ae-4dab-927e-10a4fbe2a3cc", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebb0b04-1400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212590, "uuid": "d75de67b-963d-490e-8a77-79f3be284c17", "comment": "Malware payload", "value": "7a3f02ee28f58e581208d97639696f8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212590, "uuid": "85007b34-efd5-4900-97ff-daebb0ef8217", "comment": "Malware payload", "value": "7eefd88cafc759525b52e3f45af3b6cbb3c5b1f91acc84d8d31e4cbf2bd914a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212590, "uuid": "2006d751-963c-468f-859b-7a64cd4db6ff", "comment": "Malware payload", "value": "b4d32ef6c2e80a0dde5ca1ff6f5173f9a75d907d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212590, "uuid": "91e43825-bfb4-43a2-b05b-20f71fec8537", "comment": "Malware payload", "value": "328b6856a4dc5b4ca45d0d4d023683f561ff11d5c0fe451b0a27f43dcd1f8a2c38610b610506bea38d871302a6231e44", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212590, "uuid": "08fc01b1-d76b-4d7d-8fad-1742f28f36b9", "value": "T101E24290F7B774CA352408B21BCFE04F34B6845BEDD60CCBE64156AAA476910BC2D1EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212590, "uuid": "5aa2b076-ed4b-4358-bd41-f14e9741b16f", "value": "192:ifO7v8lc3cW+bT+71jlNhfjHWmsrT3tQ6g3cLRium2OqB1C3EkUlhS3jD09jtY90:kOgGUbaw3S6gMLLracp4gKzlogQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212590, "uuid": "17be7c42-7c1e-45c9-b2bb-6beb8fcb5d05", "value": 33751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212590, "uuid": "d8767d25-d24d-46e3-a623-4b7c58d048e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212590, "uuid": "5f6c39d9-7075-4e91-94b1-c0b5356e3bc3", "value": "Placement of Demo Purchase Order 20260116_POA03.26 Spare parts_INV#3048536 3048604_Shimadzu SDN BHD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b77c96-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210506, "uuid": "19d0d2ec-10f2-473c-a72a-dacc25bdf83a", "comment": "Malware payload", "value": "fdecf2c297084d9ee0af977349993ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210506, "uuid": "6a6ec344-5c45-45df-baf2-4bed97640e54", "comment": "Malware payload", "value": "7f37e85103beaf87529dce079b920489289c0c11052bf8de3ef0e846d8852945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210506, "uuid": "e4dc4c26-4454-46a8-876a-d13f1f433736", "comment": "Malware payload", "value": "ea4c54cb54703f2dbefabfb79c71f401635da05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210506, "uuid": "f3db0520-6be3-42a1-addf-27f28c34793c", "comment": "Malware payload", "value": "5cadeea425224d8cf1e68e0d1cee8123799c6c1a000cd42e3d519ae349033b81acd25d7917d2393de4aa4a5fce979b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210506, "uuid": "713e2aba-1180-4be3-980b-e7ea33e68384", "value": "T19B06235A3BCB0AB1D41FCFB1C69564BD70797BC18C25DC5EB6C8664C5EA32086EB2306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210506, "uuid": "133719f0-d9a6-46a8-880a-a4c306e7440c", "value": "8da0e8ff9b93f7f3227639b88e7bb4ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210506, "uuid": "5ad405f8-74bc-423f-96d6-60a387ebe243", "value": "98304:kZio1rt1GxI9lad5Ul7XTTSI7oF86ouPh3:kIoRDGV5YbTTRI8oPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210506, "uuid": "5a4e3199-a29e-4669-8a5f-36628c12ea8c", "value": 3775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210506, "uuid": "f7f1f066-5437-44d7-8303-ef05d6870b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210506, "uuid": "8cec0ee3-049d-46a0-8e10-6a8e4a9fa96f", "value": "fdecf2c297084d9ee0af977349993ec5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f542e73-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212403, "uuid": "2abaaa12-ffe7-422a-8fea-88122ed8fda1", "comment": "Malware payload", "value": "c0563fe9bf45c470f1e05ce76ab75be8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212403, "uuid": "6884b1a2-4867-42e4-8f77-a1245e0da3bd", "comment": "Malware payload", "value": "7f646cb76f25f1b09b821d159f2ada550c001accc124227d21b7917643884c86", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212403, "uuid": "3d6d24c5-2145-4b75-88a2-b446df7e82e2", "comment": "Malware payload", "value": "c718a750c43268f03f73d3a46059d6db3a626f98", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212403, "uuid": "1efeb5d2-c059-40f5-9f3c-b97b81c2f4df", "comment": "Malware payload", "value": "4ccaa4c1c2405c36f738bdcc098fa71720c5ec26e8fe4d1de0a5bc57e9fe8247be78824aabcc6bbd5c3210eaa9c22841", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212403, "uuid": "0135f801-0d62-4b98-b0cf-8b11b75cf25c", "value": "T17335647015FFE676BDA91AFDE21274081213C6222F75597F2A2D8D48ADE8C607F5C388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212403, "uuid": "51415da3-9a86-43fd-a79b-050db64ba723", "value": "768:7cn8PI3spSKRclDrBrhfGRtyClz82iQHbRQC95eD07H:bI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212403, "uuid": "589a3a9b-8c14-406b-a2da-1044147597cd", "value": 1148005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212403, "uuid": "414ba2b4-f602-4f33-b04f-2c0b51e114a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212403, "uuid": "2a9430ad-64cf-40e3-ac6c-e6c152fa14cf", "value": "c0563fe9bf45c470f1e05ce76ab75be8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e9fd73-13c7-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772188387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188387, "uuid": "92c6cf2e-0693-4b1f-9c66-1361f20fead6", "comment": "Malware payload (GuLoader)", "value": "232e326192a221416a2318c16247a6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188387, "uuid": "5ca104fb-904a-417f-95cc-bc82c96fdb45", "comment": "Malware payload (GuLoader)", "value": "7fd4ecc26e3ba4b8c6c410dbcf8d4ca00054fc526e91123a6cdab4393191db07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188387, "uuid": "d47dcfca-b249-4e87-952c-822009629e39", "comment": "Malware payload (GuLoader)", "value": "1b68d129e1d7550fa671079a6f4b74aa0704db90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772188387, "uuid": "b63a39c0-26c5-4bf7-9edc-0e3f36c68e25", "comment": "Malware payload (GuLoader)", "value": "1bfd09f43661ce1fbf09c518750f18543c3180db3ab0a2dee8e22b95644f569b74a6be200baf48814b727cb0867651a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188387, "uuid": "905d4359-7d5e-42d1-af86-204aa3c2f15b", "value": "T1BFA4E092F691D9E6D83743B5993B6E301763BE2E99700B0F369C326D69B33920027D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188387, "uuid": "01320077-7fc5-400b-813f-bf39cccc4d96", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188387, "uuid": "331c7bcd-7a70-4263-b964-508cd20a9dc0", "value": "12288:YnqpyMcdbTayv9r1kPUT650dp3R0cdP4VP5:Ynqpydayv9r1kV0dFRj8P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772188387, "uuid": "d536a224-daba-4d20-bb52-3fd4d85551b4", "value": 486600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772188387, "uuid": "d6aeec9f-0c08-4fb9-9f58-c0bd8298a144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772188387, "uuid": "99f28388-4996-46e4-bd31-2321e0eb0bbe", "value": "TRANSFERENCIA DE PAGO pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb14a25e-141f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772226301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772226301, "uuid": "38baca67-b45a-4c3f-b54c-8a900849ed7c", "comment": "Malware payload", "value": "8ac224ccb1e69a6792787300710fd5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772226301, "uuid": "d90fec50-df4b-4738-8f45-b0dd9e073149", "comment": "Malware payload", "value": "8113afa512f97afc1047a10362dc47503d8daaf141fe31bb7eaa6c2bb41f3f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772226301, "uuid": "bafacac8-e696-43ac-873b-3aabb9eebf97", "comment": "Malware payload", "value": "8611bcdf02d6b2328926c2537007dce048692c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772226301, "uuid": "114b98d3-88ee-43a7-82ed-ef331f52d432", "comment": "Malware payload", "value": "19c14075664174aaf0e0ff831fa871d4cf38703c602e257e8059f0abbd1a258587d1a06710b02b10708fcd5264c8b70c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772226301, "uuid": "d57153b4-546c-4e19-8c60-a61daf1d6a6c", "value": "T1C0C63306B7951DD6E8571039C04B9118E7B2BD620F60C7EB03E46FBD3E5B2E11E3A668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772226301, "uuid": "a2a777e9-9ae2-4319-8242-b5a53e730968", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772226301, "uuid": "177fd1ae-b0ea-44d9-8e2b-59b40f3ef2c0", "value": "196608:0v8ZdnltdQmR8dA6luA8Qnf2ODjMnGydShQZK0RSHOrIDTPE2uZWvpxGLUc34BHB:QqdnltdQJluIF3MnG3hQMOSH5TDpx5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772226301, "uuid": "fbf72c0f-918f-43a2-b383-562a00e3cfeb", "value": 11496709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772226301, "uuid": "e9c296b0-b05c-4cbe-b032-d962d50011e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772226301, "uuid": "c3a7c94c-e731-42f2-a631-d502f5275d96", "value": "Everything_cheker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e128a7-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772210929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210929, "uuid": "8f7bb16b-a85c-48a9-9d83-27aa021a29be", "comment": "Malware payload (Mirai)", "value": "0ba7bf49846ba1f9cfce819c66c05d95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210929, "uuid": "a2da9607-cf32-422d-8a9e-b2b6bc2f5bcf", "comment": "Malware payload (Mirai)", "value": "816ec83efac24d356e9adda3d3f0a7158e4d3c50f95767f4e13aa0e2bd618f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210929, "uuid": "0c32616c-0f3a-4c40-a5d9-86d9d1ff7d2d", "comment": "Malware payload (Mirai)", "value": "efa02865fb56502dc1d719aea69c2acb9482ddd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210929, "uuid": "23af375d-e929-4899-a2f9-54e783154cee", "comment": "Malware payload (Mirai)", "value": "618d8924e4b2cca9416987cba71145d5274c7a3138a3deb9ef7f9f212306aed7ee028fbf5c463d3545465d05365e09d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210929, "uuid": "f1361be6-d33a-4ca4-a945-b29f5d5836d9", "value": "T15EB339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A49E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210929, "uuid": "4f321cd8-4450-4a72-800e-b0cb6025c19b", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wxzSr9bMFflN:Pbj4doYGFB0/45gdt9ulN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210929, "uuid": "ef7bb687-3566-4372-bcfa-68bfb8f57bfb", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210929, "uuid": "bdc1e464-1e60-47df-8bdf-d0ba89ebc2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210929, "uuid": "b52e44d1-ebb4-4250-b408-a1b8c5da872a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9952e44e-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772212393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212393, "uuid": "6926cd02-9a26-4b98-8392-6171d96f9fb9", "comment": "Malware payload (AgentTesla)", "value": "b82608196cae7197d83f44174bf75247", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212393, "uuid": "5d756842-4f50-463d-8ca5-81e7a6cc60b4", "comment": "Malware payload (AgentTesla)", "value": "82594ce45814604484f413d8d97a6e9f49f929535e79fcc7a253dcb6dd2374ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212393, "uuid": "89125216-3ce7-4cb8-856a-a74e392bccde", "comment": "Malware payload (AgentTesla)", "value": "3c431e982cc5648bb73371c373f5263ab4ed7446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212393, "uuid": "2f67bae8-9307-46b5-81d8-92d5c259e69f", "comment": "Malware payload (AgentTesla)", "value": "538c16077ff3c82355771a056c07b65d46e6577dbec52158de678769a60933e3f30409d38d0ea17f91575501d59d0091", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212393, "uuid": "b8c3291d-4bae-43f2-9164-be8e9b2d4ba3", "value": "T1B855AEC3AED4158EDEBA363D23F92F3097A58FAD4055C2CFE2CD264E8A7761584260D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212393, "uuid": "4535aa34-11d9-448f-b3ac-126ae0d83722", "value": "12288:T6AyvgZpjJYb+3n55ReYe7nRsFYaZhjDNgHyNXv/orhkkGGkUKg2sQKKrLoQo2oN:vZxJYGlrZhjygPfGpKwQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212393, "uuid": "5427ccb5-ebc4-455b-bc5c-fbeabeee531c", "value": 1352727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212393, "uuid": "ad93408a-4488-453d-8422-263f6d12da90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212393, "uuid": "e4e1f943-afa4-4fc4-84e1-e07d5bde2d67", "value": "b82608196cae7197d83f44174bf75247.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07584ef9-1404-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214296, "uuid": "7db0dec7-bc29-4a74-9211-1e6448cf348f", "comment": "Malware payload", "value": "c557537112d37ccc141dcb74c225fdd2", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214296, "uuid": "3ad92762-3032-4009-889a-994b5fe0b167", "comment": "Malware payload", "value": "82e9eb36245ed8d4eaf0d7ad3c0806dc2c7c3862d0821577573f65fe9c022eb1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214296, "uuid": "07c9b9b2-631c-4609-b0bf-d19b16ce5539", "comment": "Malware payload", "value": "0669c9cbce371acf3071980da6871b2a20b31922", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214296, "uuid": "82772fb6-8c16-4096-9e19-e1cc53962013", "comment": "Malware payload", "value": "54348c1d424e8a0eea278e048034eb36d6e8a2aee952283e991908f84dd949d12987782d48f7e98e1bdfd3a7d4141089", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214296, "uuid": "42d7b115-5725-49b4-8584-4f1d9f22e245", "value": "T12153C6FEAE7DE100A8D28D78264D26D916E5E77AC0DEBB0B2445D321CFC4F671502AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214296, "uuid": "9ec01167-f817-4aae-925b-56eb619a4e1a", "value": "1536:hu27JHHeoLZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZo:hLJLZZZZZZZZZZZZZZZZZZZZZZZZZZZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214296, "uuid": "ff953470-2ca5-400c-ae4b-ce49b422b79e", "value": 66383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214296, "uuid": "6ff69af5-ebd7-4618-9b1a-3fe9b4733bca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214296, "uuid": "c62189ef-36af-4088-9c05-c30ffee582c0", "value": "\u041b\u0438\u0441\u0442_3_18_5_1397_27.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21abd016-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213051, "uuid": "12b9d83c-0634-4473-81bd-d9bf206e7222", "comment": "Malware payload (Mirai)", "value": "4f2cf385ee6f979d8a2940c1617e20a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213051, "uuid": "0ed2bc74-69b8-4159-94c5-8f96ab8ac16b", "comment": "Malware payload (Mirai)", "value": "834e5836ce802cc5952b354af2ffdc03bb10b920c74045e024f18efbecf86c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213051, "uuid": "2650e27d-c0d1-4fdd-8aa5-d3ca168e02ef", "comment": "Malware payload (Mirai)", "value": "d51c5a7fdd5aaaf876610d17e55dd4b8fcf763b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213051, "uuid": "991865ed-0481-47e8-87bd-3ebee3dd5a34", "comment": "Malware payload (Mirai)", "value": "498d8082f7a4f0c5e6dbf6ce903d64616864c3308c6744c6e2dce3ce38e937ad26714dd624de30c15652b2390dc11369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213051, "uuid": "583fb6b7-92f1-4d74-9a96-832eff35cef0", "value": "T11404855D6E229F7DFAB8823457B34E20975923E623D1D684D2ACD2001F3029E645FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213051, "uuid": "f49129c8-6be7-455b-b7ef-83b2b801c5ea", "value": "3072:Y2e+VrVslZGR7ndFORhv1+7LOHTvYO3AQmchAREkNwBtN568sO5N1dJkInOCJGyA:YnvGR7ndFORhv1+7LOHTvYO3AQmchARB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213051, "uuid": "d86cb91e-740c-49d7-956c-0a685bc3bf41", "value": 174124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213051, "uuid": "a62be539-09b3-4a17-ba9e-f6f96281805b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213051, "uuid": "51ee8ee0-e02d-4fbe-ab9e-bb55eaa52aa6", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090570fd-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212151, "uuid": "4c9a18bb-a9ee-484a-bbf5-927a6efa14c8", "comment": "Malware payload (Mirai)", "value": "7fc4c68d6743cd3d5b0b8fe8964086ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212151, "uuid": "0eaa0603-f7b5-4a4d-aaf4-0225b43c3d1d", "comment": "Malware payload (Mirai)", "value": "837ad180528c688a9eeb3755a1b292d94bb7bb5cc8743040e651de9f7c486c17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212151, "uuid": "3313a99e-17bf-4df9-b33a-5fa908abcc58", "comment": "Malware payload (Mirai)", "value": "4326a6b14f49fad79ceecd2a2292ddb612f0cd53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212151, "uuid": "96be9527-0937-483c-882f-bfaf87ce3949", "comment": "Malware payload (Mirai)", "value": "c845c5da606fdb9ecb350fe1890014cf55b6b93eac3408d63c2d6430ab58a33f9481321631a3104815ada53bbcf443bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212151, "uuid": "0375cf19-cd7e-4382-b631-1939dc3da952", "value": "T13A14E81AAB550FFBDCABDD3706E90B0139CC944722A43B3A7674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212151, "uuid": "58fa2f54-3078-40c0-a271-fca6287aefb1", "value": "1536:ZApm3TGAbl0qCHcwm7d0aTswUNt8h7cF8aRzEtZvdue2lU1LgXZAqxjE8XNCIwgR:apm3TReqlr0Cn25lTXCKNCmhmCYOCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212151, "uuid": "d4c7885b-9b91-4e03-b1e2-f2e05509c5ce", "value": 194464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212151, "uuid": "5b7b6abe-a26f-493e-a01b-ed8c3485ce64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212151, "uuid": "98cc774d-8444-4b69-9a84-2e1673f63618", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9df030b-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212958, "uuid": "021416a2-6d51-41f2-8ab8-0e8e9aa31252", "comment": "Malware payload (Mirai)", "value": "a69efbf75d19eae1a814fa78f3d93578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212958, "uuid": "975d4615-8695-4b10-a0fb-aff622273831", "comment": "Malware payload (Mirai)", "value": "83cc2d75ed129fc3bc44540b4bd8dc204b57addf8125d79345870cb7391ba499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212958, "uuid": "884b02b4-83f0-48d5-ab58-4cb3066c22f0", "comment": "Malware payload (Mirai)", "value": "8a11e960156d9cdb85dabebe9878fbd996116f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212958, "uuid": "cde5cb5f-99c8-4ea8-a054-86127ae14076", "comment": "Malware payload (Mirai)", "value": "2013aae174501f05d64b91f7a93da018b9c2ff51e6f3cddf294217a822eb28b86bccbfb14a8efce848f9a6e0782ee756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212958, "uuid": "1109b624-9e3d-4ef6-a389-d78efd146784", "value": "T1E572C022355AA570D0719CB9DD7DC70B7FD809BCC9DA3324261483A4E6832077A78B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212958, "uuid": "15265a99-4424-46db-a8b8-799e771439ac", "value": "384:j7Kkx6VmPigOCvXcR1ShThymdGUop5h8X:CkQVrCvXcP8Ts3Uoz6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212958, "uuid": "4bf4a58f-4fb3-4ffa-b245-6a1a23005601", "value": 16640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212958, "uuid": "09628ca8-8a68-4467-9555-508181df0b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212958, "uuid": "91ceb96a-36ee-4e86-bab7-01259a6bd3ef", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dad5ba8-13f7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772208750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208750, "uuid": "b4025979-5885-4235-a560-3aabc2bf697a", "comment": "Malware payload (RemcosRAT)", "value": "93957f7ee981def1e7af370b832d98d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208750, "uuid": "f9c4de88-12a7-4cfa-8aaa-25a01ee64b4d", "comment": "Malware payload (RemcosRAT)", "value": "843cd39ee3289b222029c3b128414eab31fc3dd7a6d84892c686b8e5b303226d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208750, "uuid": "02da059d-8d48-42b0-9e76-db1b1ea06081", "comment": "Malware payload (RemcosRAT)", "value": "76f33dbf313249b5c574d1e2316e50990493a7f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772208750, "uuid": "71e1b3e8-a413-4bb6-817f-c450c205b0a7", "comment": "Malware payload (RemcosRAT)", "value": "ff90d8cfe5631b55a59b1008bb1c668b6ca2d9eccedf159c83d6192a2e86c6ceecea0afe2e85256a3bfadb214f840be0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208750, "uuid": "b6767a9d-afdf-429f-99e1-4bef1db56274", "value": "T1E766D8811536DA97667B245C4ECE97F88E20A44BDF81AB81F03AE5AF7705CCC66C063D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208750, "uuid": "11efa978-5c87-4b27-a5da-44da95b07257", "value": "196608:hIIu3eniDtSvAVcqIvg0bOaXBIA1wzKnXTnD9s5+:hvuDgYmqEbDZ2uTD9s5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772208750, "uuid": "97721a0e-5c44-4f44-94ad-702766744451", "value": 7104395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772208750, "uuid": "002e846f-a3c5-4db4-86e8-852b411a65c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772208750, "uuid": "aa65f697-3ef5-4bef-91c0-ffc567f965c9", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b41e3f-139e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772170560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170560, "uuid": "4b9b5d9c-f753-4618-9a39-568e0e798ace", "comment": "Malware payload (AsyncRAT)", "value": "273446e586d66598ea2da95507508dc0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170560, "uuid": "ebce1f4d-1d16-4e72-b0ad-c117c08ff759", "comment": "Malware payload (AsyncRAT)", "value": "8486ce4769ca3c2f886ebe2e230c80817ee4b1b5969e8925ea972b5a68bab315", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170560, "uuid": "78d22a10-7265-4526-8cfd-5584861c716e", "comment": "Malware payload (AsyncRAT)", "value": "efe83cc99b983292491f0c3ce5c71c7abb6b185c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170560, "uuid": "ed24389d-cde9-4079-89c0-6dd5cdf10340", "comment": "Malware payload (AsyncRAT)", "value": "30ac2c2f70f551dcbb5bc8d49ce93af21967fb9a41e3eeff5dfc8ef307e9efe27db3e9f36eb2980258c4ce486a8bcd1b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170560, "uuid": "ff0379ca-0f12-46e9-96db-7013880eeeff", "value": "T13AD24B08B3D88551E1FD57B94D7293048771EA5BA973DB9E1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170560, "uuid": "bd61af58-5e47-4940-b707-dad0b45ba716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170560, "uuid": "fc0a497e-cd51-4277-898d-0a8d5bd185b7", "value": "768:pFuGRXHMMVEo8Yg/cIRGqou/Rb7fB/dTR/+:SGRXxVEo8B1igRbN/L/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772170560, "uuid": "5769e940-0c43-46b2-884f-73077be93eca", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772170560, "uuid": "e5db3761-68ac-4a13-b175-5e6318a33c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170560, "uuid": "1fa8aebb-9043-486a-bf36-f0d862b0b2fc", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3164d43b-13eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772203629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203629, "uuid": "bcb8502d-abfa-400e-a190-b0cd0a51e859", "comment": "Malware payload (Mirai)", "value": "85702200c9058605cb8708ebc20de410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203629, "uuid": "06cde15c-8a98-4a9a-85ad-e21ffbe4b70c", "comment": "Malware payload (Mirai)", "value": "84dc5392b56c73d7b88ff374b22b0cfda40ef701102d22d95e7be0780a100176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203629, "uuid": "57374b41-db54-40fd-a53a-296865533403", "comment": "Malware payload (Mirai)", "value": "9c5914256b4c8adb7f7c3025c19e7d582e635cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203629, "uuid": "e094cd7e-d3f5-4b4f-90cc-374bae52427c", "comment": "Malware payload (Mirai)", "value": "db4647b8f602b61b367ffd14af9587e5af071a64a58b53708ff2ea150ab868dde74b638a6352191456b35f6fe7f73474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203629, "uuid": "1999d574-d1ca-4749-8f80-ebf2fd910f42", "value": "T12AD33845B9829A27C5E123BFFA6E018D332563E4D2DE71178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203629, "uuid": "ed5212c7-1b4c-4a7e-8881-100756d69407", "value": "3072:snFif7apx6XS+kUgpjWXGsmMs0u29wzulziQSq:sn8ZS+dQWXGsm5s9TeQSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203629, "uuid": "53309a30-cf9c-4c90-86fd-b8def0d1fc64", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203629, "uuid": "23658daf-6196-41e9-bf3a-41ee4355d5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203629, "uuid": "b4b0e781-0435-457e-a6c5-420e1256192d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bca063-13e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199282, "uuid": "64679556-e526-42d5-9e8b-eb2519ee246b", "comment": "Malware payload", "value": "9a73cf2ca389c8649b8e0993c6556f20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199282, "uuid": "e9aed3d7-81fe-40d6-96be-0c827267e202", "comment": "Malware payload", "value": "8537f2fc8e4af0d1d9c1ee4773903b17f64fad801ce80b77aab109244d7b9597", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199282, "uuid": "d50f7637-a280-4b9e-b976-da09bea9709a", "comment": "Malware payload", "value": "41f2a389ba70e65d05bebacc54bd960cfd370d5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199282, "uuid": "5ac29b10-32fa-49af-bdbd-281ee7eed76a", "comment": "Malware payload", "value": "39b5e82107724bb74f3fd27d10bfb1a5453864dcf29ba14aa2df804cc8067bd3797dc285cd246af7e8000f2ef4f7d9b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199282, "uuid": "faad3032-f9d9-4944-973b-8133478cd624", "value": "T156224D7034F04C732E256580F37727A69BB7A85749A3318C35DE1E2A6F87B12A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199282, "uuid": "f9053f24-71b9-4900-a484-68b51edf8bc0", "value": "96:cRmX9Eh9mLj+ksN8ZPa65UOsp8CfUwD14Ims2hZD0:cRmACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199282, "uuid": "2f66c04a-01da-4cee-881a-3f25c775fc14", "value": 10177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199282, "uuid": "182c2988-929b-465b-9861-97cf9d342736", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199282, "uuid": "7fb9efd1-82ba-4d4b-80c1-7bdfde264dde", "value": "8537f2fc8e4af0d1d9c1ee4773903b17f64fad801ce80b77aab109244d7b9597.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f943561-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772224000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224000, "uuid": "4486264f-e4b6-4176-bfdd-dab5280ae1ca", "comment": "Malware payload (Mirai)", "value": "9175d928d095ea7fe30462f5d7b6372d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224000, "uuid": "f4cb4d4d-171c-4ac5-83d2-d2d9f5f35cbb", "comment": "Malware payload (Mirai)", "value": "8659fdaa1d37cd7508014e2214d15c2013ba9c001bbf1e38a24de988950b19f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224000, "uuid": "d34d71b8-43c6-4449-ae00-05816853014a", "comment": "Malware payload (Mirai)", "value": "05874e828c65381e6c4a8c9390f39ba2b8064af0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224000, "uuid": "fc99ae50-9bec-46f1-91a4-3611a8498358", "comment": "Malware payload (Mirai)", "value": "e63bb5114dd75d7e7c52c2a6bab291115096d03228d183801778998453ef25902701ce29bd1b9e42acf1b2480dfc3fc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224000, "uuid": "9d7432aa-9e95-432f-89aa-090a17d75170", "value": "T1B7733A17BA4080FEC899C43843BABA36DC7274FE1379725A17D8FE366D55E601E29C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224000, "uuid": "55e8c4c1-3f77-4a06-beb2-c6150a51090a", "value": "1536:DeuIZobGRRINkGIb/+w4HnC+8l8Anzcfw:quIZzDIWGIf4HT8l8Azcfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772224000, "uuid": "24688dc8-d874-4937-b6f4-332e9617940f", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772224000, "uuid": "1395fccb-3768-427d-9e4b-692165785e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224000, "uuid": "d0524c46-127a-4233-bca9-181018ad1f9d", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7059cbe-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216791, "uuid": "3aa37025-cde2-4b38-8105-9d1897ee1461", "comment": "Malware payload", "value": "5036c5e00824ae0ca6017948395deec5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216791, "uuid": "0ffdd05b-ac27-43bd-adbb-d175dabc6c4f", "comment": "Malware payload", "value": "86d89c68b57ffff141d8bca41efcac59188c9b70d314a1bb81272eb96e932262", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216791, "uuid": "dbecc897-13a0-4875-8072-4d267bc92a1e", "comment": "Malware payload", "value": "fb83cbbb7fe47abe7d1d1f11542d0f32c6ba5d89", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216791, "uuid": "d69d410f-3c7a-4f6f-a9fd-6f226ea5fa01", "comment": "Malware payload", "value": "440a8454e8dc0dd7ca87393d2b7f5fe9e28a054e39c30c205024b5f0c41d3479a610a84e46335cec6ae8782a2738f680", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216791, "uuid": "94ffc32a-90cc-4dd4-b3a1-27110293e725", "value": "T102E6332DF314EBA4EB32AE7815413104927D3DF51ED2CADABE1C1A9E133954685323EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216791, "uuid": "ef0b388d-9688-4a39-b0a1-ea8519a6e1e8", "value": "393216:FWWVnV6Drp1lge55EmStjnCrO7Ps+ZHMcgrRfwBguC57i:FrV69fbEmStjn8O7k+ZqyBpg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216791, "uuid": "4bd3dcdb-fe37-45a8-ba34-9006c01c39d2", "value": 14491648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216791, "uuid": "64a530ba-d0e9-4380-aa80-0149854e28e6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216791, "uuid": "1f1261e8-6375-4d3b-b915-d1868e2fcffb", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757175ff-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223929, "uuid": "155f3972-0af9-42e2-9aa4-1a9f757b4b25", "comment": "Malware payload (Mirai)", "value": "9ba7c0ee03efc1c103ba9484400dc7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223929, "uuid": "1f186006-74ee-4473-a24b-15e63ce1cfbc", "comment": "Malware payload (Mirai)", "value": "86e4e9c186b3f4d9f39b4b24bb3d62ba232ac6e35d162e03e9f9291bf14f63b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223929, "uuid": "addc09f9-d0a7-45c4-a0d8-3d2a01e804db", "comment": "Malware payload (Mirai)", "value": "2b4dcf8c2970e507ef2b8f6b78391b9cbf393399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223929, "uuid": "314b756a-203e-4824-be79-712fa75de113", "comment": "Malware payload (Mirai)", "value": "fdc03bc22693930df46e369618623cead04480a3f915b97d65e0e0dda46efc1f4f5004180eec8b5fd9e746f80e903c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223929, "uuid": "da98e9df-dae2-4295-a1a3-81c8ee3fe733", "value": "T199F2E1702606FCA6CE204676E9A6CF87F76AD368D0FF317D15050A64F8D162254FA3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223929, "uuid": "660d3481-209e-4f41-a4b3-11ef4635b327", "value": "768:rJTKmOVP3WWkPgb7lPBIqxwQEECBah3zGKYOWyZYn9ms3Uoze:rAmO4POPN5Evo3FY799Lze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223929, "uuid": "a00f3d22-0642-47cc-9a98-a436a0a6411b", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223929, "uuid": "5e697a7f-1cb7-409d-b001-943db4e60125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223929, "uuid": "b9ece536-9d95-4a7a-b1b0-5512b529c4b1", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3a1f01-137f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772157320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157320, "uuid": "efb2eb2d-2da3-4614-9fac-a9a69046e11a", "comment": "Malware payload (QuasarRAT)", "value": "e91e0425024419c967219cd8bc2f33b9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157320, "uuid": "5b22dbca-cffa-4339-a5ca-8e98d70f43ab", "comment": "Malware payload (QuasarRAT)", "value": "89232935ff2589c9e76199eb1365af640e357e44b313b4fb8052ef7c2fb656f1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157320, "uuid": "c141fb5d-401d-49e6-8232-ba67064b0c70", "comment": "Malware payload (QuasarRAT)", "value": "c97f0239184513a3fd10ebe8a0d97ef07ffb1403", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157320, "uuid": "1c90d0e9-d47f-421b-9078-bf426c36d75b", "comment": "Malware payload (QuasarRAT)", "value": "dbef6fc31bf3f8f15a6b315ff296093a176956df4232c143f228ba73585f7f6c1ed72d5ecd37efb23387ea2a0b45653d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157320, "uuid": "8fe24709-486e-43f8-9baa-536790a795c8", "value": "T1955502218DC82FA9DFAC1A1C90FE161E63E14A8E542AB58EE7337D47AFF754442071D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157320, "uuid": "b7b1b90b-15d6-4114-8082-39cc3da87f4c", "value": "24576:buWHSQm2NYJk6g1w09r/rvdu06gmKXhjp/rZY/S8Vy4:iJ0rMVqlg04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157320, "uuid": "f238d625-c8a0-40d5-8c12-f2b6475070b8", "value": 1354520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157320, "uuid": "ee7d332a-e70a-41bb-a88a-5038e05864c0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157320, "uuid": "b874d304-4f83-4e50-8657-1f7c3af86bbe", "value": "Luraph Dumper.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b5d51b-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223935, "uuid": "8e7715d3-a7d2-4b48-8db9-62c7a67267a8", "comment": "Malware payload (Mirai)", "value": "7a48287a543290becc04d7e2ea6775a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223935, "uuid": "fc53cace-d9be-46d1-937d-cf2849634542", "comment": "Malware payload (Mirai)", "value": "89945f4dee2d309650797af5856d4da12f52fd7a11c2be612c4d8df12a671019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223935, "uuid": "3d5cc6e0-3f47-4e83-8707-80e652d34e27", "comment": "Malware payload (Mirai)", "value": "0c1bb084e95b4815a93e256ee07b73b8bfefc40c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223935, "uuid": "18b6bcab-62da-413e-9179-2438573b0840", "comment": "Malware payload (Mirai)", "value": "ec8bcd292f38f3c40ead62a07902a96e8c0cb644a39e9c25e2f562a8af603750b50c1a2450f3fbcadb30b32dc6da5371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223935, "uuid": "2ee40750-e8ef-4569-92a3-f5916d7a8297", "value": "T1E0639E16D8211999C28685B4B1ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223935, "uuid": "9f5db5b6-e770-4d84-a1d3-2f7fb96eba13", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udK:dWVkwgAYugsz9xznsxrdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223935, "uuid": "2b878e6c-2990-4e6d-ad68-197946ff47a6", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223935, "uuid": "19c6f3be-bed3-4cae-a4f9-6f8b19276295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223935, "uuid": "8142a41f-df0d-46dc-b21d-ce01605391d7", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f742c9a-13e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199518, "uuid": "011c72c5-3740-4d89-b091-14c8bd30ae81", "comment": "Malware payload", "value": "7b158a1a4421d1c3ebed00b9f21ee5fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199518, "uuid": "f60e5914-b08d-4f25-9c10-b85e08686ef2", "comment": "Malware payload", "value": "8ad34ee9f304099fb8da08966769db735b3328874b0f804b8af67d6a2cd62aa4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199518, "uuid": "7d389e35-3388-4d64-9e34-1431ecdd8391", "comment": "Malware payload", "value": "49144fb152e1ca090f8ba6528a360eeffb6f4e48", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199518, "uuid": "9a13b073-7a8f-4832-8d91-92323b7558db", "comment": "Malware payload", "value": "3f315c89624665c3479a0ca7f0e2c565dc5155c40ebac22b687efa9c3344e533e441374c6b31abf9dad53452c6f03847", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199518, "uuid": "9e5cdf57-ca77-49e3-97f5-96a116a84cfe", "value": "T19CD1D67125F14C333E606980B3772BA6ABB6D95345E3218C35DE2E366F86F12B1AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199518, "uuid": "16c2ccf5-45bf-4246-9389-835e5937821f", "value": "96:cLu7B69xiUSUOSCx2xkStgFIrOIB6IBUfs:cLul6CUChQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199518, "uuid": "e2a971b1-da49-4a0b-846c-bdbbced3dc28", "value": 6390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199518, "uuid": "ea801478-9fe6-4fea-82b0-8ebf239f29c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199518, "uuid": "3b5e84ca-32ad-473b-898d-1bec71e36341", "value": "8ad34ee9f304099fb8da08966769db735b3328874b0f804b8af67d6a2cd62aa4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e19781-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177778, "uuid": "77a0d4e6-9b3a-4cba-adec-09ac5f4d773a", "comment": "Malware payload", "value": "56005a013aa4f3a602885892d35e76c4", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177778, "uuid": "3cd60988-2912-420f-a722-ea1bc7ad76ef", "comment": "Malware payload", "value": "8b5cd5d3b49d6d31e1e501651fc3039ea4f022b6e8dd954a03501c4ef71da881", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177778, "uuid": "6d5c3565-bed8-4d8b-a4d0-18cbbaeaaed5", "comment": "Malware payload", "value": "9873228345ea0844acb931bd8a50aa6bc26fab25", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177778, "uuid": "11f232c8-4105-4874-8009-e97bfc6db7b4", "comment": "Malware payload", "value": "b678b6031b16e8272ca3681f896dc212a4993fc365261fb1c7a8a9f488eefe613ef4943afb3d9a815ee96d3616c0e242", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177778, "uuid": "7fd6e718-1ef5-435e-8ede-281872d0f2b2", "value": "T115C135005BE95608BAF36B15AABFA050493B7E9D9E36DA4C0048C54E17F2E40CCA7F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177778, "uuid": "b99d5fbc-945b-4833-80e9-c07e40c170ae", "value": "96:WyEBs5sZ54BfOOF5yFwFiOD1hsZ56vHAttHEznxdelwQ2QRsAHWHAPv+5BAvMF4q:WyeWf4qFictQHEznxdeCwss+fRFiX3ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177778, "uuid": "1c71e91d-ec57-4cd1-8f7c-9d38a79aa2b7", "value": 6018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177778, "uuid": "ff452afd-2c77-412c-bf7b-631e49e5b7eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177778, "uuid": "81c95ce6-1e3b-4e42-99a8-7af04a4c559e", "value": "8b5cd5d3b49d6d31e1e501651fc3039ea4f022b6e8dd954a03501c4ef71da881.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3b543b-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212960, "uuid": "4b76a261-3b03-42ea-9a4b-a5fde009ee17", "comment": "Malware payload (Mirai)", "value": "4bd6ab28aeb4529c5ec6d14f8d40b5f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212960, "uuid": "5ee54a70-1198-47bc-904b-eb4cd2eb7fb0", "comment": "Malware payload (Mirai)", "value": "8d620f7df9e03f97adac874b1c911c762dbc6e2b246647d0e76ba6d853abee6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212960, "uuid": "154b2b81-b491-494e-bcb9-7320cd6f74a0", "comment": "Malware payload (Mirai)", "value": "3180f204e67f096ec4c1d998ec5d36c736ea6add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212960, "uuid": "3c0de86e-b361-4226-9a63-ca1f7d2cf58b", "comment": "Malware payload (Mirai)", "value": "b159a26713647d5460720c5d19ad7039b5312509255e5d1655a557fb061f04a8a96544eb9411368f042ea9a72dd22770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212960, "uuid": "d822b34f-8028-41b7-a49c-04b591548943", "value": "T1ECF22903127D6517D4E8A63902F39757F2DA7A9CA014871FBE3A0ECBBA613D01F6A570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212960, "uuid": "baf6cfbb-0f79-4757-90d3-a37e3124087c", "value": "768:fyQIH1RjyptP7ehBxnGImJ34TC5tuHajtyBsYPD:fyQIH1RjyptP7e/lG31yBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212960, "uuid": "0f33936b-022f-40ae-acd2-6fde11ae6951", "value": 34648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212960, "uuid": "3976733f-1f42-4042-9aec-007d2d671cbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212960, "uuid": "7f6c7877-995c-4298-9875-677937adab17", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea906d50-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212959, "uuid": "edde1305-b90f-41db-9492-f73a16fdf823", "comment": "Malware payload (Mirai)", "value": "dd5f05c731cf1058a1deb53a980e69a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212959, "uuid": "7f66ef3d-c2ca-4832-a0a6-1521a1071194", "comment": "Malware payload (Mirai)", "value": "8d908a5588e9b6c1f940de92801f1f0c5e0ac19c2d1f151c0cc350895f418115", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212959, "uuid": "f3311486-d363-4878-93f0-14b0424059c5", "comment": "Malware payload (Mirai)", "value": "7d3b3762cfccdfb9d37dcfd0cb4c3f4bd227d6dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212959, "uuid": "b4a31904-1210-4bb3-887e-4d6c3440e21b", "comment": "Malware payload (Mirai)", "value": "39020ddeacaae0edf71670bfda2b324b418ae96c85d2dd53fdc74da8dd1ac3a0b3db84aa042b68e33dfefb27b8aedb83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212959, "uuid": "4632e55c-15f1-45e0-93bd-ee066fc31d7d", "value": "T15C5171A6F31649706FB165967DBA4054758893A25ED5AB0BF8FC78FC429DF0820E06C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212959, "uuid": "e9dbe39f-a6a5-4c34-ae31-ff0cacb1db89", "value": "48:iOzL8zLZzL5zLTzLNzLl3EzLIzLZzL4zLjzL1zLpzLSzLIz:iO383Z353T3N3tE3I3Z343j313p3S3Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212959, "uuid": "feaa016b-3210-45b0-a6ca-54b62dc5fad1", "value": 2824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212959, "uuid": "ad118706-091d-40d3-9a3c-01b8adc02d7c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212959, "uuid": "a5e2bcf7-3d4d-435e-b752-4c9929b72743", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b8a527-1389-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772161575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161575, "uuid": "bebd29d0-fb47-47f4-b490-84473b68b7e3", "comment": "Malware payload (RemcosRAT)", "value": "6bd774868fefbe4ebd9fe4f8970c2585", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161575, "uuid": "ce42a56e-816d-412a-a539-0085d6395f6d", "comment": "Malware payload (RemcosRAT)", "value": "8dd48a02c728e70f89b5cf22b61a5f67f7daa2d3cf3585a65bdffa1ab4b3e9f8", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161575, "uuid": "9ea7d946-437a-42fa-9900-68c5bcc4078b", "comment": "Malware payload (RemcosRAT)", "value": "980db1876a3903f305863bb5385bc23f9e5895f0", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161575, "uuid": "e83152c3-7745-46fc-9553-c33a38fb2bb6", "comment": "Malware payload (RemcosRAT)", "value": "1ea200d2665581955cb42f1b73cf1d2bc48ee5abf89ec5e92d5c20cffa1d3f2abb946892441c626919af3ede673cb697", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161575, "uuid": "ed0c7cb3-8907-4019-b151-cc4d2705d4bd", "value": "T167D533E0D08A8F87B2957DFF24E654FE564F7B5AD7B48F6042EE4096C0281E83B0E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161575, "uuid": "f02cb64f-6c09-44be-b81a-6220e6ce1aed", "value": "49152:rjzNO7/F87u8jahxWKgR6wT2G4wRxha6jOJaxrD2jt6yoou3wit3uWCcNermQEsJ:rjzNO7/F87u8uh0KgvhB1xf2jUyon358", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772161575, "uuid": "07fcc32b-27f6-4470-8331-2593eece39b5", "value": 2860181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772161575, "uuid": "b9f18ff6-625a-4def-a165-71b351369583", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161575, "uuid": "0b90e0f4-74d3-4061-bcd0-06aed7850e65", "value": "suspek.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac89f9f-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210436, "uuid": "45e6c417-ffac-43e3-b61a-e362170c1c32", "comment": "Malware payload", "value": "84160465eba93db5fbf349565941fad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210436, "uuid": "0f6beadd-e37e-490b-9ffb-d0a105893fbf", "comment": "Malware payload", "value": "8dfa125b86de55900e8d8423bc8af52cc50abd7095203731972bdea19de63ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210436, "uuid": "38755823-8387-47f4-955d-ca6ca97125d4", "comment": "Malware payload", "value": "77b26f859370a5914e883939b82e04e168d330b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210436, "uuid": "bbd39e6a-1347-48b3-bb54-e8b9371aa03f", "comment": "Malware payload", "value": "89cdb56e40e9975fba33a89ea422a0f0bfa9694f489cd7e33d2211238f66196603b73800d77026474e5046ae1487c9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210436, "uuid": "92c45ffc-2b75-4bc0-86fa-07289dc9aa01", "value": "T1E6E533600CBD72E4D456043A49AA82031D57BD7FE3B9C369669CEE5B273B380CCA536D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210436, "uuid": "91696d56-3434-4a38-b5f6-6814c94f6cdc", "value": "f1b9f4ddfaf3ec6ab992b59da8c25802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210436, "uuid": "52a756bb-f453-4eef-9dbe-9d461b51a174", "value": "98304:kqXfVfpZxjvIqjkgTVhQSDis8V/y1mDT:kWfhTiqjdrOV/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210436, "uuid": "8e057112-0eb0-45c8-874c-108c82ac8461", "value": 3218432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210436, "uuid": "4f4f5316-46b0-403d-a17a-3d7aad9f8115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210436, "uuid": "2082d9ec-94a2-446a-8bef-d4389b8bfb79", "value": "84160465eba93db5fbf349565941fad3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbedd5f-1380-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772157777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157777, "uuid": "55ad304e-093c-42d1-ac78-e6c77cf09fb2", "comment": "Malware payload (SalatStealer)", "value": "d26fd14919bb87c96bf503f1f09be157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157777, "uuid": "4171222f-7d3c-45fb-83c0-e3b8a0e61802", "comment": "Malware payload (SalatStealer)", "value": "8e2cbe20866f1a9db047ab45f07916e91554cb86b89e864f2d4b62ff7baa95dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157777, "uuid": "f00eae51-9f0e-4ebe-bcd7-1816947e216c", "comment": "Malware payload (SalatStealer)", "value": "53776f8f33cb55c85c049cb7df5a87401ba16236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772157777, "uuid": "d2a5d2e4-f6a4-4ac7-8d4d-d6b24eb91f44", "comment": "Malware payload (SalatStealer)", "value": "815deb9e2f75b9d9ac46aba87a4788c75b920acbea82aef09689be57adc4a68c0fdd1e454813eb38221d560beac53267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157777, "uuid": "ac683e76-0498-4ffe-b9cc-6424961e7b5b", "value": "T15DE5338628154342EB2D1D7801C5F3F54EDE67B17639B32E9B88F5F1E6290421BEEB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157777, "uuid": "5a8d90cf-be5b-421c-8784-dc6a051a024c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157777, "uuid": "952c51a2-5ce4-42ec-89a2-267d9dfc6460", "value": "98304:DntUPuafSRohcaqvZht33aB1yJugTFbQ:DbZohgZhR3k8VZbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772157777, "uuid": "2cc2121f-8b18-4e88-a0cb-a922c8d1742f", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772157777, "uuid": "d1fcd5f9-b345-4079-8469-55a710014403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772157777, "uuid": "c4cd199b-3d5a-451d-9d47-20db061a92ff", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc539f5-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772210547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210547, "uuid": "f66d490f-0f83-48d5-86d3-73cef27aca51", "comment": "Malware payload (Mirai)", "value": "eafbb23d47b8e4d81a8107698fc13c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210547, "uuid": "051217d3-6e92-40b7-976b-8ac93be98e2c", "comment": "Malware payload (Mirai)", "value": "8e7b7dbbdc2691ba6dc52da311073dd9215e662e32a9be076d180e27d0e10840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210547, "uuid": "baa2ba59-1ac4-453a-afbd-8dcdbcaeca63", "comment": "Malware payload (Mirai)", "value": "5ad9a2faa0f9ce215b6220183e07313ab35c491b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210547, "uuid": "ab3a10d6-165a-4a6a-937c-c0ba86a97bc5", "comment": "Malware payload (Mirai)", "value": "1406833038eaf4c07fbb9e4ecdc789c8909ebd54146d01d9befbb907ae94a239c151c8454baeedd73c298446d60ac11e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210547, "uuid": "74d40dac-8f89-4b5f-8e7e-079370182b4e", "value": "T181E33A17B5C194FDC4DAC1744FAEF53BAD36B19D1238B16B2BC8AA221E4DE305E1DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210547, "uuid": "a6acc4aa-8a3c-476e-8dc1-17c5ff3d376a", "value": "3072:8qyoG7VMD+5T27M/eu3AC0EFGGXGxgUFCu2g5FY03lpF:8qyoG7VMD+5T27M/p944iPpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210547, "uuid": "6b400bcd-e93b-4aa5-8acc-092cfd8e7992", "value": 152424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210547, "uuid": "3d6d4e81-7a04-4db3-b600-a8f0e252b3ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210547, "uuid": "e6c6cad0-1af9-43df-8aa9-7660e38d8072", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab31631-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175298, "uuid": "4077b704-4133-417f-a1db-534c657113ee", "comment": "Malware payload", "value": "26b3cfc809e2419c69136ade0e3fdd5f", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175298, "uuid": "f6792c8f-1642-4644-954a-235e071f1902", "comment": "Malware payload", "value": "8f131b63a4d69b4028e9aa9e349ed63d0ed0fcbe13e903b4a6325982e4a33351", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175298, "uuid": "be4072ed-12d2-4dcb-b5a2-55182cb5a43b", "comment": "Malware payload", "value": "5ddeb4437d41dea725bca36b99db3777bd62ab97", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175298, "uuid": "a1f5c2b2-50eb-4157-8a1e-278748e6356c", "comment": "Malware payload", "value": "742390d399c9918cf202817bb2b9af5cd355727284351a507939e0583ea8636dea375c3c8438af0e13c1ffc1f61b94d0", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175298, "uuid": "88fc87e8-945f-4664-bfaf-d6424c153e08", "value": "T1B031503740398D05C7B693D4C0590A0D9F8FC49202289BA6798C9856FF2CEA3C1F89EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175298, "uuid": "7adfb80d-57e1-4819-9029-3887d1ba31cf", "value": "48:vCUDnLlWnFj2wpuz2RkZdV5q5pHNB2szMF:vCI8B2zBjIt5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175298, "uuid": "3df30d2e-0782-4a70-ba68-c99eeab95f29", "value": 1558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175298, "uuid": "d5f548d7-9cf0-4e3f-a110-6adc5c00a0b1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175298, "uuid": "a4a8af1b-bb42-4f92-a0fe-54a6a980e2b8", "value": "8f131b63a4d69b4028e9aa9e349ed63d0ed0fcbe13e903b4a6325982e4a33351.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968ad7ba-1383-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772159131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772159131, "uuid": "322fb219-0e3a-4e7d-a4c6-ea4b63639bcc", "comment": "Malware payload", "value": "51e955977bb4725582dc05b5b1e0210f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772159131, "uuid": "7555a04f-b101-4b8f-8e34-ceb6853a4254", "comment": "Malware payload", "value": "8fe26d8f6203fd590f77dda8790e8a71d50989730f0aa962934f76aad977fbcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772159131, "uuid": "4cf37ef1-1d43-4e71-bb38-dbeb63687408", "comment": "Malware payload", "value": "3bf58c5cfc651b6a8e600d73846c1a35da39544a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772159131, "uuid": "ce36370a-044d-412c-8181-9762010c79ba", "comment": "Malware payload", "value": "e4b7061a2ac2171943b10cd166ecb91b891cda8ed743f116fbae221fd0110deb2edf7694092445b95129d90df90eafc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772159131, "uuid": "926d0106-33a2-4ccf-be90-ae00ba111b85", "value": "T18C925BA916496C79BBC0DE7D9F3C7F0CADE481C02118A39CBE4F39615A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772159131, "uuid": "d633ee96-ad42-40b2-b74e-d46e40953a95", "value": "384:OA0M3vgRjGlsaq7rzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:OSmjf3zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772159131, "uuid": "e1356da5-9c7a-426d-a366-1e6f214c943c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772159131, "uuid": "b8a444cf-efba-4b76-8497-42a6b983ed84", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772159131, "uuid": "77fb5d3d-229a-4435-8d5c-9aabc5c6bdc2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32991e6-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1772211631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211631, "uuid": "7bf1a17f-cf2b-43be-aca6-1f38f6aae0fc", "comment": "Malware payload (Loda)", "value": "4338bb038cba4d05da2e19076eb88631", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211631, "uuid": "050fc858-d184-4799-8485-582156224dac", "comment": "Malware payload (Loda)", "value": "8ffd4ed3a40ad525ba7d114cf1ed8feb50cb4d6dbc453ed78c809780ea4695ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211631, "uuid": "4b9e0e34-20df-4ae8-91f1-d025bcad8333", "comment": "Malware payload (Loda)", "value": "1732448283a8dae52d654195fa571e22feb741c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211631, "uuid": "c3d8480a-c51b-462a-9f70-bb1c55659f01", "comment": "Malware payload (Loda)", "value": "af4d1cd8806833fd6627f8fda697a9852c703e9af48a01383ebac0d261839a53ac0804ebd90b4ebc79c53319d2884351", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211631, "uuid": "bc2bc7e6-3149-46fb-a784-d4b5cdd39ad8", "value": "T12BF6333099762D791BEC4A7DE45B1FA83DD0EAC78444B9C54988B3F3B2CA704567E0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211631, "uuid": "8ef93fbd-8c5e-4ea2-b064-be101698698f", "value": "49152:SLyz5G2bAbI24AUZyV0L8WUTSnkJjqNTNhkSoqq2QLr3l+0pTxmKWs14Wbhs7Eew:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211631, "uuid": "1abfde66-e3f5-4c68-8624-659fc5a1b978", "value": 15832334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211631, "uuid": "09778caf-1451-4f9e-99e5-8c22bab85f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211631, "uuid": "9bac8cf3-ab15-4e3b-b839-e895da8b5721", "value": "Chrome.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ce3926-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772212609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212609, "uuid": "039f78ff-e97e-46ca-beae-5e1571dfb1dc", "comment": "Malware payload (AgentTesla)", "value": "292bcb1c73f8b810b0b9784d7a39d721", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212609, "uuid": "48ad0d9d-638d-400d-a7c9-50b46eaefcc6", "comment": "Malware payload (AgentTesla)", "value": "90a83bc719689c61c6a98d66351efd7595e5113fc47f50b26239879d98d83ff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212609, "uuid": "ea04d7e3-af3e-4f1d-9086-d0dd81b49ecf", "comment": "Malware payload (AgentTesla)", "value": "ba10c59660ca76b7f1b8a1f84aa4f355241161b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212609, "uuid": "23a41340-98c1-4abd-9e7c-6a44372b4081", "comment": "Malware payload (AgentTesla)", "value": "7da2cade9d177793edd06c9c1da3fc93c98c9a0a9b21f894cd3fd66ac5131e48df007a1a74704dea18b8740eb840938b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212609, "uuid": "0090d1f2-6a25-4c27-b118-7e84dc7ab52e", "value": "T131C58C419DC05F188F4C4709B2EC9E37A7F09BEA28963A174FE136192F7B69893D904D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212609, "uuid": "70dd7a2b-92b1-4111-b8e2-027d54ad9cc3", "value": "24576:ZvafBNIoIwS6pBMmqAL1CSfGR90ncRez3ygVZEIFQmvafBNIoIwS6pBMmqAL1CSk:VCmi3CmiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212609, "uuid": "b6049baf-9938-4e00-ae39-e9b16887a5e5", "value": 2573708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212609, "uuid": "24408056-fd98-4797-9790-491e49d5eba0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212609, "uuid": "7b9162ac-284d-4a34-85db-c8524575d1e1", "value": "292bcb1c73f8b810b0b9784d7a39d721.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b6a9d1-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175319, "uuid": "e2e26933-6797-4ac0-a23e-73cd393103f0", "comment": "Malware payload", "value": "ff857a4ffa89caa81ab1312732669da4", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175319, "uuid": "4f421b0d-2de5-46af-aa54-322c7fabd4da", "comment": "Malware payload", "value": "90f2b095eb3b4dd8b484cc50a3501601891d242e715cdc88bc1def44ef891fd5", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175319, "uuid": "7e74a76c-077b-459c-b9ba-6aa0470d0162", "comment": "Malware payload", "value": "baef59543d670980e981a1cffcc92821f1fc6aa0", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175319, "uuid": "d0e0f094-895f-40f1-9244-44fc4e5bd1e7", "comment": "Malware payload", "value": "3301f2fd1607c3a765da31c3a599da1bc023023803027b5cdf1717ab9450cbeb7abdbd0cf3cb371bbbd3eff298f9a1d9", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175319, "uuid": "286838a4-de41-4284-8f52-1ddee5496d4f", "value": "T139A63369B3E14DF6E9E6553987F08316A7E27862A371C09F03EC026A0F635C29D3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175319, "uuid": "9ee242b1-6c8f-420c-87cf-a9971281e62e", "value": "a06f302f71edd380da3d5bf4a6d94ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175319, "uuid": "53392f1c-bc01-4d8e-b035-ac4fd3111408", "value": "196608:01GV2y3BvRBA1HeT39Iigw/ZITet4Q4G/NsI6yzWbluIMYn77k+:GGV2iJq1+TtIiF/ZKS1NsIZzWRHT7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175319, "uuid": "9233f412-7fe5-45e1-a7d4-a1150917a92b", "value": 9753166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175319, "uuid": "b2bbc56f-a517-4208-9b72-c6848570a51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175319, "uuid": "00ffd733-bddb-40dc-a810-00427797309e", "value": "90f2b095eb3b4dd8b484cc50a3501601891d242e715cdc88bc1def44ef891fd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180dcee3-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176098, "uuid": "fa90a2e7-9d13-4532-8efe-ffd9cf2e2d67", "comment": "Malware payload", "value": "d8e2e2df7fcf3245136925a49ab72a3c", "object_relation": "md5", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176098, "uuid": "afd75e5f-ef6f-4874-a832-8403b6500ad0", "comment": "Malware payload", "value": "91bc5e4f6e6654c1a9f014ae8d896fcb1f0e2aa12699fe7a186ee2448d62e735", "object_relation": "sha256", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176098, "uuid": "672582f6-933b-4b45-8635-af559cf4106c", "comment": "Malware payload", "value": "070ff51374a1ba81299b427d27dedc6971865dc1", "object_relation": "sha1", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176098, "uuid": "b3537a8c-3ee9-4025-affe-e9d8b72cd16b", "comment": "Malware payload", "value": "f301b6994d894a9d4abe21af5e41af2538456465d8c482291a6d712e2bcf46b6bac8920c3b743f23ca9eb8482f80ee4c", "object_relation": "sha3-384", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176098, "uuid": "9f13cfc9-c36c-40af-b428-253b27eb21d9", "value": "T139038E16729ECB08B0B2468A029B07740B5FB95E1FBF80D5558DEACA4FE352589473F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176098, "uuid": "4b712871-34db-4e7b-ba39-0147bf96bf60", "value": "384:p1X9p3kAHXzXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXcXpX0wToUsaaRa/ADPAe:xp3kAHwToUd5/AD9I5j83LgFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176098, "uuid": "5dc8d3ae-8eff-4b25-a099-a031fda28721", "value": 40016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176098, "uuid": "9f044a8a-a8c5-4825-af03-b74a8739fc38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176098, "uuid": "0a60295c-4238-4936-9ce1-3ae9f5a6b3fc", "value": "E11520681000218-408231.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5559bbee-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216574, "uuid": "3c317623-b3d0-4c79-a583-c80ad6fe09c0", "comment": "Malware payload", "value": "35eae4f161f82c6fc4885b94c17b76b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216574, "uuid": "f83d1afa-efd8-454f-9b17-ec582f0cab60", "comment": "Malware payload", "value": "933ca108b552bdc59597c591b03f710b3b6f3be612c48ff74d4ef4b18f09d762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216574, "uuid": "2aa9f110-5f86-4103-b284-d3a79d57dd0f", "comment": "Malware payload", "value": "f09ca25aa70f6de410c7f5869b63b2fbf06eaca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216574, "uuid": "ac82a100-0f8c-4db5-a50d-ce99dca64d9e", "comment": "Malware payload", "value": "eb5771c4f7fd9b11434dd7e2def5b862b2b4741c05d87873fca07ca8f26f777b7b8d721fe20ac0c1cdf38f3cc6f8c664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216574, "uuid": "fdba9b63-7fcb-4739-b12a-7c699c2e4d02", "value": "T11AB3F646A9429F01D49731FAFB8F425433536FB8E3F971019A24AF6123C6ADB0FB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216574, "uuid": "02022d4f-b051-4d8f-a205-d8cb1d4ef513", "value": "3072:uS7JGA9f1OARN2adwC3G8xWlGHdOXDmji:dH9fECN2adwC3GKzHQX6ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216574, "uuid": "c26cbc19-0e35-4b6c-b019-6abf77f61a1d", "value": 110820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216574, "uuid": "32860e4f-2423-4328-93d1-e865bc5ba041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216574, "uuid": "d80104cc-5125-421e-85f7-b1037b62eec0", "value": "kirk.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7152c23d-1387-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772160786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160786, "uuid": "56c266d7-9cc4-4453-9a23-a859a198fe60", "comment": "Malware payload (Joker)", "value": "07e547b19184b7f54c9e933e88b51aa9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160786, "uuid": "5594ccab-fb2a-4015-994f-e0a673cad957", "comment": "Malware payload (Joker)", "value": "93db8acacdea5f97ebc0a9debf97603ca21d3031e091dca4202513c71e0685c9", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160786, "uuid": "94a9db9e-208b-4c81-a811-ee1da514f26b", "comment": "Malware payload (Joker)", "value": "495ca6e1f968ae9bf85161ac6888cdf1255381e7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160786, "uuid": "3eb93aab-90ad-4e3a-9ed8-3cfed5033032", "comment": "Malware payload (Joker)", "value": "ee1822312c46bfeca6bc60dd2c6aed70c6cb6c247d648ff98537986398092f26ea2021f4e120030adc84768c9cf96d08", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160786, "uuid": "fee66571-55dc-4acc-8374-752770423991", "value": "T139F6235AF758A02FC837503289BB62B051574C478D839B93B618734C29BB6C89F5EFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160786, "uuid": "c99c2ab8-c815-4cb8-a654-fdaa94a0669a", "value": "393216:5PLgXnO+cNxRnr19EzIsy5h1putoso5MzZef2ZOUoIw3DU:dLiOBjnpy0d1p1VqQIO33A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772160786, "uuid": "55ebe302-3961-4a20-b0db-1074554a09f7", "value": 16745993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772160786, "uuid": "5cc515c4-3ec2-4dda-bf81-9580eb91e259", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160786, "uuid": "795cadb6-edc4-4b96-b89e-f163f2c8bbaa", "value": "com.gold.metal.objectfinder_1.0.1.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e4ee74-1405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214857, "uuid": "21a586b9-84a8-45b0-8d1e-cdcb2b46a9db", "comment": "Malware payload", "value": "90ab28b470c343aa3dc1fd8206d2891a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214857, "uuid": "bfc08883-40a9-4668-b37f-e1fb651c6942", "comment": "Malware payload", "value": "945702afeeb1cfefdd7ce2381972924472586bf60ec06602e55b8ab232842773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214857, "uuid": "bd3873ac-162b-4927-8eee-f08319756a9f", "comment": "Malware payload", "value": "8f6aec9d20ae8b9bba814038d0048bb80f451a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214857, "uuid": "beefef75-eb21-4ee5-b87b-103e448eb199", "comment": "Malware payload", "value": "6701fad1e8e738d7af1e3c29184909f3ac8babe5d67af64f2cfa1f76d4d5819f21010d1e0e622086bc59c6fcb267d7bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214857, "uuid": "df37fa3e-c7d7-4704-997f-c10159c40773", "value": "T129B66A137B6CE70FC22822341DF2DA942B696C9601D7A517B285F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214857, "uuid": "bf0a3e60-7f0f-41e5-a089-a97bae6d64ca", "value": "196608:SR9akaaCMNaPxKzW95HPFzFPeq2yJQkbl9Dnvi4R9+9Ok/QOLvB:SR9akaaCMNaPxKzWbHPFzFPeq2jkbl9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214857, "uuid": "39eb0879-db3e-48df-aee7-fb7069aebe76", "value": 10964597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214857, "uuid": "5e8f11ed-8c07-411c-befa-3368fd9dfdc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214857, "uuid": "7298b9c9-f255-4ddc-a650-26a797dee0a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b54f7fe-1372-11f1-a769-42010a9c0008", "comment": "Malware payload (FakeAV)", "timestamp": 1772151623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151623, "uuid": "351d34ff-10a3-4181-ad62-b54eebab4778", "comment": "Malware payload (FakeAV)", "value": "ae8f880430a1b72585a3b90a9cb0a551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeav", "colour": "#307897", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151623, "uuid": "f546cde3-6e45-4c7c-b536-036df89236f2", "comment": "Malware payload (FakeAV)", "value": "951609afe4d88d8ea8a5d6b6b3b904536567280d0a1e0aa4e564ba279d5ebe23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeav", "colour": "#307897", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151623, "uuid": "cd86171e-cce9-4383-959f-fbe083b398fb", "comment": "Malware payload (FakeAV)", "value": "533cad0afd95fef4aac6f99e7d286bf482999603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeav", "colour": "#307897", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151623, "uuid": "813722a0-ae50-4001-bae0-ff01b63e151e", "comment": "Malware payload (FakeAV)", "value": "507e79bde039fa5f91d42624de090eb110274f78b8c30768bb0f060ea9d8495b1d7309018c1d4ad645c444678bfbe000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeav", "colour": "#307897", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151623, "uuid": "e956fc3e-3479-4dfa-a462-090230b220ce", "value": "T15C94DF06B604CA26E71C4B7894A5F8E049D68D7C52D9E84FE5FC7D7A2D3228B993310F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151623, "uuid": "d26da06e-b12e-40d1-ab84-52f8e1179192", "value": "cf126b55ca9ee5af825c7c549e01292e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151623, "uuid": "8071bc07-c564-477c-a25f-1743314a038f", "value": "6144:BvL4Ifpi7SrrY1rzWAo1FfJwjSoCKJ1cna46BD3kFfOo41l4pw9:Bv0Z7IQrat9vKJOa3BafO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772151623, "uuid": "86372700-cdfb-44d1-805d-34d63cc800bb", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772151623, "uuid": "20630529-b0ea-4db4-95cb-7da940e916d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151623, "uuid": "da86e955-72d2-4427-b5dd-cecf68bef79d", "value": "ewbu1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518d2113-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216568, "uuid": "81165e24-9c08-46c0-ace0-6b56d1b6237e", "comment": "Malware payload (Mirai)", "value": "130f063af145c3c0b32db863884f5188", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216568, "uuid": "04f37038-5218-44bd-949f-d5650d2b8a0e", "comment": "Malware payload (Mirai)", "value": "9598bcacbc8600e4f479d54d5352cff9b6006282ebc6444b60f2f9155e6724a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216568, "uuid": "15f2251e-4346-4f1f-bc15-1b47265b8c6b", "comment": "Malware payload (Mirai)", "value": "cca30256d289ed990dee09844656303eae9e16fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216568, "uuid": "d8d03342-7fa7-4be0-974b-8dd854a120c3", "comment": "Malware payload (Mirai)", "value": "796f7eebedf99579eb377c98cde26c74f8dd472aae9296dd09987cac68551dfd6c9c4bc350e669d94e2b831e886e9a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216568, "uuid": "e5c9393d-566b-47a8-9c2a-0d532d9ffac0", "value": "T14C93F882BB43CFF3D95314F041F75A398A31FC2A4836CA89EB65BDD6CA165D06216378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216568, "uuid": "4eb74ccd-72ee-4dec-837e-96f0daf76dd9", "value": "1536:rEhyTSecX82w2kW7Cvm+XstfV0xT+PJ79:rEgTSecXx5Ovm+cRx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216568, "uuid": "7b4c0563-d680-4266-9530-161e939926f8", "value": 97668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216568, "uuid": "6c2fdec4-9b27-42c9-a53b-c1ce135c0b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216568, "uuid": "06f8c5a4-ca29-4cbf-ba77-05f9cc9956e5", "value": "kirk.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebe9f14-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223918, "uuid": "d00f0b7b-c02c-4bf8-ae24-5008cef55b5d", "comment": "Malware payload (Mirai)", "value": "2401e3da2da718ed8206f84469d7f40b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223918, "uuid": "3ba7de76-5bc9-4942-becd-0e7b478836b0", "comment": "Malware payload (Mirai)", "value": "95cb9542611a439e5e444fc5cfd9f73b85d340be671c18c0b73d70dfee6d8ec1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223918, "uuid": "594d5de6-6695-4c1c-afc5-93f129714e46", "comment": "Malware payload (Mirai)", "value": "e49065a2dd344d504979600eacc668898400d689", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223918, "uuid": "3d00d25a-fe75-4033-ba24-ffb6984e71e1", "comment": "Malware payload (Mirai)", "value": "61b360bb950f2b9fd32483ab8ced6852adb6f96a1ac31a66763dcf7dc3f7603660d87eca15ff3139c9b084d7685d7e40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223918, "uuid": "b43eda1a-441a-4cca-8d09-423dcfd1b1a8", "value": "T1FA4192C926E21A716DF7DD6A7AF98844728050C6DCCA3DA4E4DC74EC84CEF187089B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223918, "uuid": "bbcb01ef-b21a-4b92-919d-ef2d4a867960", "value": "48:vpNEHpUzpEXpKNpvepl+1pyeYLpX6VdJpo+kpCtpRCpe+:vQHkW8UwyLYN8OqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223918, "uuid": "5d18c37e-1695-40e8-8c2b-3314483e9a9f", "value": 2044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223918, "uuid": "4fd3b054-6026-4e68-bbb1-2b55b6e99f08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223918, "uuid": "98af3145-85f1-4f7d-bb3c-120e5583f253", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c817395-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191246, "uuid": "8823d86e-9401-4260-a63a-46c39ac3dbdb", "comment": "Malware payload", "value": "9d5614feb0514b304dc107f9db367522", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191246, "uuid": "2f10e195-b013-49fa-931c-9c98dc5a141a", "comment": "Malware payload", "value": "95e88ec3ceb56c7f3679c45b837f931d0b38269a2e275628f2bc1a9f5c77a19f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191246, "uuid": "5cc9ba90-d854-4fa2-a703-20805034363a", "comment": "Malware payload", "value": "6b21dffc6b1086e9d5ac6ea2e7b0c1b9f4e913de", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191246, "uuid": "9f4c8689-66b5-45c1-b7bb-8cf991ccf13b", "comment": "Malware payload", "value": "38c00015cb76629721e23361de468da429b1733912b260e5f88e3d403fd7c3fe385ef645fcd37e672eff07fb025e97be", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191246, "uuid": "e2b79002-9e61-462d-a26c-a5f09086f55b", "value": "T11FA633C2F3296C2FD4770A3219A607712B22AD16CE96974B2549332D7CBBAC90F54FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191246, "uuid": "c8ebf1de-f5c7-43bf-ad06-8a33ae104fd7", "value": "196608:+I5ktrR78Rdhj/t/dItuSP6VqDTyDVoc4bpx/kFJib7A6wzlpgoLyStn2I:+I5Id78vRt/dCCV4eyckxYJIsVlpgoLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191246, "uuid": "afccc645-0ef2-4a50-8ce0-4051cb6e918f", "value": 9598738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191246, "uuid": "078f9604-1e24-4c56-ab8a-7596fb4bd472", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191246, "uuid": "e57716df-d733-45e4-b4e1-18bae3d6e6e9", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e48aeba-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213046, "uuid": "bbd756f3-5a3c-4c2f-a9a5-b4379496c63a", "comment": "Malware payload (Mirai)", "value": "079841764c14b5e0be1ec5f98ca1f50d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213046, "uuid": "d0bd4bf0-c5ae-4d41-a6a0-1af502e510db", "comment": "Malware payload (Mirai)", "value": "971c43684f7f2615023a8ad17e305b74e49d97e8c818626b9343783976945b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213046, "uuid": "4bc7b56d-828c-4227-baf7-48fea0353269", "comment": "Malware payload (Mirai)", "value": "3c38f0b6f6a7d35ef815f1fa6f704f46ee86809d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213046, "uuid": "8946a730-a68e-4b58-baf2-f5e53839a9d3", "comment": "Malware payload (Mirai)", "value": "e36971f62273f5eb73288cd636b214d8149cdad2b23549fda8ba9fbd201d5bbd274587b17a9378a51d7b5b8ba1b7a891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213046, "uuid": "28facb8c-65bf-46a0-a550-9c1d9e7e1820", "value": "T1A7934AC5EAC3C8FAFC160575213AAB76DF33E17F202ADA47C39D9932A821511C61676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213046, "uuid": "6a03b8cf-c652-4c08-9e0a-11ce1b0963b4", "value": "1536:5NllXn3Tq35VUtaeMJsPH3Nw2f001f+nfjaI6SQsfT9rTeSmo:5lXn3TqpKcC3NNan77TQ8T9r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213046, "uuid": "083b0c15-4d4e-4c17-b25b-dac5216d542c", "value": 93704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213046, "uuid": "91c8b801-640a-41cb-b409-0a8f1059906f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213046, "uuid": "deae0416-9c5a-4c9b-9cdc-8338e9153326", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd90f3a-13b7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772181477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181477, "uuid": "f6a76753-8012-4799-83d1-57e4a46a3170", "comment": "Malware payload (AsyncRAT)", "value": "2b7e97eefc289f848e49c5e705f00d48", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181477, "uuid": "3aedf028-e5d1-46e6-8da8-bc936592fbd7", "comment": "Malware payload (AsyncRAT)", "value": "979ee9cde008e6a19bad8b4e71462cb4fae000ae625c8e942e17fdd131144c9b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181477, "uuid": "75a84884-045f-4de3-b30c-d1aa1ad5af8d", "comment": "Malware payload (AsyncRAT)", "value": "ec2c738afecb6005645abee2251bbf2fd5438981", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181477, "uuid": "4b59b1cc-a3d6-4f70-a44b-01c423347b67", "comment": "Malware payload (AsyncRAT)", "value": "39952dc35b900aa8715ee2beaeac7f941ab41c19ec245f7fcca0e5b689d55aa28e3879de4838894136478424129b64ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181477, "uuid": "84ed62b2-d3af-4814-8d2b-f4dfe2ad5549", "value": "T10D536B1877F64125E1FE6FB05EF17293D676F2635803A66F24C8028B1713A88CD916FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181477, "uuid": "7732178e-52c3-42fb-b030-b414d0190a71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181477, "uuid": "83be4a17-97cc-4661-b6d8-a21930e8b5b0", "value": "1536:e9/8tCk3bbO2kb179dFpBdkbWCcQhybB+0O6NOldzX:h3m2kbnfprkbWVtFmUOldzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772181477, "uuid": "d2a559a0-6dc6-4db7-b730-35a23740d34c", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772181477, "uuid": "5b85cafb-7cab-411e-a736-6468edc6e046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181477, "uuid": "e479db45-9a34-4326-9ed8-a9a1627f602b", "value": "MINECRAFT-KEY-GLOBAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c85e6a-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176850, "uuid": "e73c48c9-010e-401b-a614-089243543cf0", "comment": "Malware payload", "value": "d1c7a0d0cfe459662366254c78c76196", "object_relation": "md5", "Tag": [ { "name": "eventul-com", "colour": "#ADD907", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176850, "uuid": "e4872054-6072-47fa-a389-6d516d1ad85c", "comment": "Malware payload", "value": "97b0de865550ca811db7bd89b33aa5ff1958f801a0b525989f3a0b3bd51895b6", "object_relation": "sha256", "Tag": [ { "name": "eventul-com", "colour": "#ADD907", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176850, "uuid": "5766a571-f241-4c04-a3ec-21c9d18cc2d9", "comment": "Malware payload", "value": "c25d636242260a9180f326f8395621ec851358b2", "object_relation": "sha1", "Tag": [ { "name": "eventul-com", "colour": "#ADD907", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176850, "uuid": "93136726-2abc-45ad-ab41-e2acb4941f6c", "comment": "Malware payload", "value": "5ca33fb5c853e0217458e140c49c36aa757c43ed77ca3de03cef502412b899c6a8944db9dbf2d9a4aa411b16066715be", "object_relation": "sha3-384", "Tag": [ { "name": "eventul-com", "colour": "#ADD907", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176850, "uuid": "47b350ea-161e-4da6-bf89-03601895c18e", "value": "T10B41ED6B77A7486016FB69EE777B93483461404B2C07D0493C2C4945AFA6F43857ABCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176850, "uuid": "91555b80-acfe-48c1-adde-740cae170e75", "value": "48:+6WlMtOnqBebeNDouHFuHJWH7HLbNuZDdZxjoo0b8:Hfn4oHydr838", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176850, "uuid": "f0f5e946-97ce-4705-8473-8229058b30a1", "value": 1930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176850, "uuid": "a83225c6-3c5e-4bed-8092-7c4988a02f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176850, "uuid": "79c9f3b9-f8b3-4161-b95c-3853c376c60b", "value": "97b0de865550ca811db7bd89b33aa5ff1958f801a0b525989f3a0b3bd51895b6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fa1805-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772209859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209859, "uuid": "a218d191-29dc-4f81-af0f-ee104258609f", "comment": "Malware payload (PureLogsStealer)", "value": "0d1d99789084c6004189b24a7e85a179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209859, "uuid": "ea11f61b-c9bd-42c3-a4fc-6140885de24c", "comment": "Malware payload (PureLogsStealer)", "value": "98226eef8ce1c7f85211be74dafc426b6c55cf0407aba63c3bd8f68e4348b30e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209859, "uuid": "09eca3ea-5a79-4baf-bd3c-ab9f3c43ec41", "comment": "Malware payload (PureLogsStealer)", "value": "c1117fe65b3c709249344db5852f2cf7a560f4ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209859, "uuid": "b16ee2d0-39de-4af8-aeeb-74a1ff0cca42", "comment": "Malware payload (PureLogsStealer)", "value": "e33e49dd71d036ff7524df8c21d8e550723498ee17d64eaac1622ed468b98e1c0529a23ceab418a01adb443e5c9c7ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209859, "uuid": "96a82caf-47fe-4460-93b3-0560134a8398", "value": "T1996502501796DC16C329033659A1F27C8B748EA6B125D25ABEED3EDB7B3AF110983343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209859, "uuid": "327e418b-ba5f-49ba-bf44-b8829bbeef30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209859, "uuid": "0bba062d-18ab-4fb3-86a5-08e69e41e43c", "value": "24576:5vDlBg7SeR6BcbtdziX1gY86dbPjuNPYhelm0i57ZEyrcDQfT3vXPx8iI5aO:5rly7S+6BcPagY8BFmZ7KywDQfTnGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209859, "uuid": "1c82ea65-1983-4d73-abd2-a9ed932b23d8", "value": 1542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209859, "uuid": "2fc8f92f-6efe-4fdb-96ec-3642fd1d0ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209859, "uuid": "de32d5d9-abe8-4a47-be6a-e5830b26571d", "value": "0d1d99789084c6004189b24a7e85a179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b861d62-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213068, "uuid": "24d52de2-1fb0-40e6-a5af-d254ecad674a", "comment": "Malware payload (Mirai)", "value": "a2594fceb80d52a7bcc547fd0e8ea161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213068, "uuid": "5635167b-4729-4c8e-9709-071a1f98af74", "comment": "Malware payload (Mirai)", "value": "982ad33d32ce20596b1fd3f43cc0b1bd30242c483562bc63ad302681734b3305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213068, "uuid": "7906c63e-ffbe-44f4-8807-6baefefc7662", "comment": "Malware payload (Mirai)", "value": "7a605b805d79a7ff906075082a3dd3176a2d537d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213068, "uuid": "8908825f-9ff9-4635-aceb-a6fd2ce026a7", "comment": "Malware payload (Mirai)", "value": "32ffe261d3640dd4f74f7d79ec08e79c08dbee32826d2c7c1ea897d25fba0edd16b79c763391e0ea808048f753a77ad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213068, "uuid": "19d3b9ae-65dc-4924-8e14-c15a7c45111b", "value": "T1C3C33B89F8914F23CAC652B7FB5D428D3B262768D3EE32039D156F61378B95A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213068, "uuid": "2991f910-a0e5-49be-86d9-aa811ff928c5", "value": "1536:DB+hTi2kSCMgPExBJCs2OR414VU24BTFJy7Oa+Klm78wywFt0x7Z/PucWE/O8EMy:D8VCMgi3CsI4POJaeix7ZKlYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213068, "uuid": "1de4982d-a207-45c5-b892-686f8554d141", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213068, "uuid": "7e7310ef-de66-4610-ac23-6728e17356eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213068, "uuid": "20f185d5-9253-4cfe-ac8f-136193933210", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb8f4a5-1403-11f1-a769-42010a9c0008", "comment": "Malware payload (TrustConnect)", "timestamp": 1772214147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214147, "uuid": "33996899-be0f-438f-8cd8-6938d49ecb60", "comment": "Malware payload (TrustConnect)", "value": "f94f874b0fe88914590a2fced526a25c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214147, "uuid": "03407e59-e21f-42ea-8a8d-313552675e2c", "comment": "Malware payload (TrustConnect)", "value": "9843db19d27407d139ceffb19b88dcb14cce3a9e84baa7be37ad9374b6213a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214147, "uuid": "da2c8e9f-c657-43d7-96a7-cc98f84d7971", "comment": "Malware payload (TrustConnect)", "value": "fd9f31ba2b8ba685912bc3dcae9db1e1032e59fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214147, "uuid": "a6344364-bfda-4850-9bd7-0243517a9b32", "comment": "Malware payload (TrustConnect)", "value": "6af85a94ac1145b01f07e5d6dfbb2d185e4193e2d233ac5a0f4cdc1601f546323d1a40f52067dcb19de3a73a905a9206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214147, "uuid": "6a1abdb6-7a6d-435a-b52b-f0f3e6411136", "value": "T19C871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214147, "uuid": "0c4af9b4-cc86-4164-9547-3e14130e83d6", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214147, "uuid": "73098054-09d1-48a0-9753-bbadc19221ad", "value": "393216:3KxapWfkJIPr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81z:r4Kir/vbpvuY7Key+7PJsYPUlbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214147, "uuid": "5712d472-d84b-4397-8bc4-18e774eb0227", "value": 36333240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214147, "uuid": "bc14d25a-86fe-43bb-b44e-6f14d466de3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214147, "uuid": "d445708d-90af-495d-bc9a-7d075ac4104f", "value": "SecuriteInfo.com.Win64.Malware-gen.29272219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acc100d-139b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772169231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169231, "uuid": "dd20d2be-3d5f-42b6-846e-bc101a436592", "comment": "Malware payload (AsyncRAT)", "value": "4fa3e7a568d7abb83a837a06e38b6ce4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169231, "uuid": "a2a2acdb-6dfe-4be1-aa5e-be65fd9f0a82", "comment": "Malware payload (AsyncRAT)", "value": "984aa58d81c6ebb5b42b899eee12946272b3f30aa3d122b176fb62113bd351f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169231, "uuid": "f2d9f045-c474-4d29-a720-b13abd867f95", "comment": "Malware payload (AsyncRAT)", "value": "b517013aad860d421d78d6907681aecd048b9e75", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772169231, "uuid": "979df34a-4133-4a8a-87a3-840cf545697f", "comment": "Malware payload (AsyncRAT)", "value": "b6fcfd4103af42c1899fa9ca1d51ed0dfbee22644004433862251ab2954db01f92e8e9347947412f3b40151bdce07bba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169231, "uuid": "73a6f31b-a763-46e7-a788-c66f29560dc6", "value": "T192D23A08B3D48561E1FD57B9497293048775EA4BA973DB9E2FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169231, "uuid": "4c055f05-2369-4c9a-867e-c3cd605517e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169231, "uuid": "89a25a78-a4e3-4c09-b23c-bc515ebebd5f", "value": "768:cQjRXQO7Wqykg/cIRGqoG/Rb7fB/dT1R/+:3jRXH7Wqy11iYRbN/nR/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772169231, "uuid": "33668406-6ba7-40bc-a3b9-d692cce73cc1", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772169231, "uuid": "69669d3f-4665-428c-bf2e-849a91a5a686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772169231, "uuid": "b07a4a5e-6c7b-4156-86b0-8b74b5c0a85f", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcebe74-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772210820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210820, "uuid": "e627d10c-b8fe-476b-b00c-5540c0c9675b", "comment": "Malware payload (QuasarRAT)", "value": "c301913b5fc190c701e486ed48e53035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210820, "uuid": "f33918b4-217c-42d4-92eb-cfd03b2aedaf", "comment": "Malware payload (QuasarRAT)", "value": "98b8e1e32402b26c6b508bf39528d1f7d7a671bd038302a87514c3d446996a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210820, "uuid": "6684e3c3-b731-4f9b-ab22-3f4dee5e284c", "comment": "Malware payload (QuasarRAT)", "value": "989b13f99c109bc2427a4c75d98fb723ccaa5be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210820, "uuid": "f4355b6a-65d6-4e37-a3dc-5be3d58e5e9e", "comment": "Malware payload (QuasarRAT)", "value": "f69ab0ada3d57ae6f4549e12fb5fcf3ed61c213cb27814fd1c2e4147088090d46e1e49b0b257f24d41a6b4b4b890c025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210820, "uuid": "f1d9177a-fa34-4131-90fe-2e5ac4e4173e", "value": "T1E91633484A56ED02C9B2673A57A2E278077D1E8FB924D1275FDDECD33C32BB91508386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210820, "uuid": "d9e89edc-00d6-46e2-8b33-a2215e66bfd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210820, "uuid": "7a06a6ff-2d26-419e-ae1d-5e718d523a37", "value": "98304:UUMtPUGu5RlqKV8Dy6uNEUDKfCgDLPJWgLIfcE+wZdpCzzD:UUMt8G+R2y6uNEUm7PJWkcpCzzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210820, "uuid": "cdd16b29-b414-40b6-a997-bbca756c1b3a", "value": 4121096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210820, "uuid": "1aa69f61-99eb-4fc0-9a76-4f606080873c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210820, "uuid": "d1e7f1bb-b219-49c0-89f2-cc0a244ad4b4", "value": "WORDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547cce16-13ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772203258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203258, "uuid": "ec9bd958-0fd5-4ba1-b207-52b7a6ca04e0", "comment": "Malware payload", "value": "5a75901bd576fd481ed0e8c000c491fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203258, "uuid": "8baaa7b6-4f51-4de9-bf49-b14866a29179", "comment": "Malware payload", "value": "9967575e2899559fd22c911d7dd17d61a5e3d3dbbcbe232a9947bbc4a0e414e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203258, "uuid": "530f10fb-6cc7-4a30-b9ca-0110e8bd1fc5", "comment": "Malware payload", "value": "7b955c4700b10989f975665219a46a6b11d3fede", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203258, "uuid": "8a4411ac-9f1c-4512-9640-44ee188d76ed", "comment": "Malware payload", "value": "282417162ce48ae50d9dd8edf6185c483597875a19ee6e57b60e99ded74663693bf312324245a305d7dc093c53fe2c76", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203258, "uuid": "e07f8677-38b8-4fb7-9cec-3345ca8d680c", "value": "T12532D67025F18D732E25AA80B3372BA69BB6D95345E3318C35DD1E265F87B12A0FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203258, "uuid": "b2d6b4ce-d256-4b53-918b-8b1199e55e6e", "value": "96:cCu3k0B6VzYMPZo8zS+6+x+s6IBqHIBZIBcIBSIBrIB4IBNIBrIBFRDfBVZUdR1m:cCu0g6VjZYBe4Tm/9g/C4Qhfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203258, "uuid": "6655b436-628e-4a53-885b-c80ddb18d672", "value": 11491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203258, "uuid": "2fe6b067-f70a-4f34-90ff-e4af8e77dd31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203258, "uuid": "b190a883-1cb1-4817-b83f-204dbc36d199", "value": "9967575e2899559fd22c911d7dd17d61a5e3d3dbbcbe232a9947bbc4a0e414e2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6138907d-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216594, "uuid": "18c663c9-ce62-4737-b540-3b108e223419", "comment": "Malware payload", "value": "8a709616e3437ff61bd287764e97f211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216594, "uuid": "5c7c0d4f-c782-4bc6-b332-4105f9d45a22", "comment": "Malware payload", "value": "99ea1573ed7120104bd746eaac7e9aade7d36980b3855881cf8f05a4688c865f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216594, "uuid": "979a393b-b98d-4146-b135-c2794eb248a7", "comment": "Malware payload", "value": "388297f782e71785ee90b4254e6e8868f2f8755c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216594, "uuid": "3c4bd694-5a97-4775-9eec-4523cff1f948", "comment": "Malware payload", "value": "09bea048cd15f3ef05c3aeab21307cd54a166bbf64943ea0df8259a743b8964c4d61e5d3d96c765e54234e692d4ccc9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216594, "uuid": "06339044-771d-46f1-a7cc-21fac975a57d", "value": "T1BE93F886BB43CFF3E95315F112F75B354A32FC3A4C26DA81E324BCE59A525C0A616368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216594, "uuid": "c9cb93b4-758f-4978-8f25-091914e4d628", "value": "1536:6NeeWfIpE1A1Mt8lmqMqdvq8jGyQ73eqzL9jjmWSDV0G:YeEI8lmq/NpjGx7Oq3gvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216594, "uuid": "a17ac398-c18a-4baa-abac-ddc5d8e70e2f", "value": 96356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216594, "uuid": "c44744d0-7e84-4efd-9127-869b0ac24d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216594, "uuid": "70796acb-4041-4ea0-b1fb-348513fd7445", "value": "kirk.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf91a71-13e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199677, "uuid": "9858389b-321a-4c8f-bc06-17a500fe16ad", "comment": "Malware payload", "value": "ca37633d2254279b0dfdbe515042380d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199677, "uuid": "1648850f-70a5-4281-a7c1-04a7cf5bc88b", "comment": "Malware payload", "value": "9a103bbea861f56d1a47494a45a9496aaf3ae7be3d6ce1fc773f2a16a3e0d4a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199677, "uuid": "10dab91d-4597-478a-9a03-711393f3e7f6", "comment": "Malware payload", "value": "b66bd7f4744a16a941541d5ea8433d33bca53e6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199677, "uuid": "849539de-67a9-4f61-8f6f-cb007cb8c322", "comment": "Malware payload", "value": "4e5603a8c2eaec49ea9431e0fd0a0d11a7199b5e3f0569b979997c9a49fd37e0dc76f69606b8015ff0ed6a5b1d9756da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199677, "uuid": "f426e8e9-7285-41de-830f-157fbc487974", "value": "T17B62663721F04B3297D415C8A3671BA54F76A60B456724B8F4BE57399F1DA0370EBB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199677, "uuid": "49cb70f9-4ebf-4537-b4cb-e54fbc4ebba8", "value": "96:cCuolB6Lsht+O+v1fsn+h4+tIiKkC1ymyRyzuKNpUj4waYvjJlVv38Zo8zJwD6fe:cCua6S4hvZ5mN9i/KNpiv2ZkvsMQ+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199677, "uuid": "05ffa0a4-7da6-411f-9e5a-48521f95fc38", "value": 15719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199677, "uuid": "e47a5f8e-f329-4e56-a3d7-5e6915142e7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199677, "uuid": "a3f9f33d-5097-470e-adca-bce8d5b911eb", "value": "9a103bbea861f56d1a47494a45a9496aaf3ae7be3d6ce1fc773f2a16a3e0d4a2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f01c4b-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772211339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211339, "uuid": "1372a328-1d74-450a-aab0-ab526cd52fc0", "comment": "Malware payload (AsyncRAT)", "value": "9bf19424e1b08ea01b0df2271116e45c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211339, "uuid": "f2429ea2-0397-4d6e-ac20-cc68d9c0948d", "comment": "Malware payload (AsyncRAT)", "value": "9a7153d921414cf235936c00352f7a54ebedd0c131314382099d85acd83b286c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211339, "uuid": "a74d40e4-e1ec-4f71-8cfc-fe640613e331", "comment": "Malware payload (AsyncRAT)", "value": "3a1416f8890061332e4448cd26f55d8249a3777f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211339, "uuid": "9c314138-6d54-4e75-91a4-d22f1b1bcc77", "comment": "Malware payload (AsyncRAT)", "value": "38e8b5a769e412dc5ec7f19c51bf8d41f3ae437474d7817ada9109ea53d13a384ff4ee5f4e0b02a746d1300f821b0b56", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211339, "uuid": "ca74ca35-5d6a-4a97-9b4b-f00f3e665875", "value": "T17F1612CBC7501EC619F3A2B0E28230E45ED59050DEE3666EACA05DE7C6DB49C4BC747A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211339, "uuid": "d2fd0476-6314-4759-8853-7262e6b8b681", "value": "384:zqXfg0zXb+Q+auPCTAcBzUm3kHFg95c15eIaEuE0k+eMw0I1HALDW7dauZ0V9RH:t0v1qO3+FxpSaHDO+datH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211339, "uuid": "4bedd8f5-e566-492b-89c0-c01d7a14cfe0", "value": 4166461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211339, "uuid": "0f2910c2-2d1e-4a4e-8830-0390848b659d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211339, "uuid": "c0f921c4-97f6-4268-8237-ee504920fa3b", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89a93f3-13d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772195239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195239, "uuid": "f354d3e4-f6cd-4185-b255-14edd1988591", "comment": "Malware payload", "value": "fcc48cb05af62de517d23056b00013a9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195239, "uuid": "edbc1378-3896-430e-bee1-5074190943c3", "comment": "Malware payload", "value": "9a95e66673d5d0479b2f119387ea1c71f4e6a0e5ae51d6ce420f8170bb6d2c5a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195239, "uuid": "522a1539-7ff0-481e-935b-5a4512196466", "comment": "Malware payload", "value": "436ac67c7484be4c7ef8124dcb5fa9b7cc7aee35", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195239, "uuid": "023cbfa2-34e2-4e4f-be59-07c67456c08e", "comment": "Malware payload", "value": "4c0a53cca2780b73fc2f373150fd424f4b3afaf19596c813b77c86a38e797fda7af8d98f11c5b4c3a9871e6ae307d402", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195239, "uuid": "29ebaebf-9344-4d0a-94dc-5311d39280ba", "value": "T14F1148D7AA12D12A551A0AA808BC51563803F0C34758ADDA3C9E7175C25A3DA83BDDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195239, "uuid": "251d44ae-e517-4743-a825-2c4b99b6a703", "value": "12:SdE4S+rThZ/fz8GSCNwXGxUCEx2xsx2FRffL5GtrMGSAzIbUmn0rZofXoQX7fHn:0hZ/fz8604fwtrMOIcItTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772195239, "uuid": "212c6d8f-11a0-4795-a103-f3ce082374e5", "value": 983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772195239, "uuid": "6779f27a-44cd-4dc8-a2f5-ecf371e9d5aa", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195239, "uuid": "73d1dc5a-e55b-4d3a-88b8-eb84e56b707f", "value": "megenta.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556f7df5-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772191234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191234, "uuid": "59b6a0f7-33c1-4faf-9de5-c4bbee3fa543", "comment": "Malware payload (ConnectWise)", "value": "a16d5492a98b8db4d33ccdee87c1f720", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191234, "uuid": "1fe4536a-4c3e-44c9-a7aa-ed9394ffedc0", "comment": "Malware payload (ConnectWise)", "value": "9ba7d9e22d29cf36dddfa49de3af500d4fcfd89d294f86cc8d5523055375ee42", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191234, "uuid": "a6cc79ba-a050-4dec-aef1-7a5b36456bb0", "comment": "Malware payload (ConnectWise)", "value": "04cae3c2f5d42eefbf6f82df4d2a643c874bea32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191234, "uuid": "bbabc4b4-4ec5-4508-b4f6-bae5c6983dce", "comment": "Malware payload (ConnectWise)", "value": "5389304f2d9ebf5f715dc71ab6290e36f8ddc3f0ce017afeda9d013b317818e2348682652fb60124fd0d93ac2f6f417a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191234, "uuid": "18b988d5-90f3-4d2b-89af-fddb98d7e7c5", "value": "T169D61201B3E945B5D4BB0A38D83996656A35BC009715CABF13D4BD6D2E32BC08E3637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191234, "uuid": "6d61d4d3-3ae9-4912-8cba-55b511b4e46f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191234, "uuid": "dcdc616d-256f-46e9-b4fb-545aba284a09", "value": "196608:y5QfefP+n/dkyMb5wH/no6vDsvn/dkyMb5an/dkyMb59n/dkyMb5G:yqVWwH/o6vQvVWaVW9VWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191234, "uuid": "cd4ed441-42e1-44c2-9403-dac0741090a9", "value": 12626488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191234, "uuid": "4e0af084-b914-45fd-8979-0171ab4eb29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191234, "uuid": "fae252d3-ab2d-446c-af47-565f8f692366", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93588afe-13d1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772192626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192626, "uuid": "b548b16f-4b59-48ed-8a47-ea1f3cda02d0", "comment": "Malware payload (AgentTesla)", "value": "50957b79871aef1b905153e7d218a50c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192626, "uuid": "e99d2250-187b-4b7e-98fa-99fbc8932972", "comment": "Malware payload (AgentTesla)", "value": "9ba8dee5043176d0f9a0eba7b3f25a8156280cfb5862e0899f63798efed61143", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192626, "uuid": "73a21b6f-9344-480b-b91f-30abcdecd1c9", "comment": "Malware payload (AgentTesla)", "value": "841dede7070e5e7a8f85efecd1b54be8dda81af8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192626, "uuid": "f385d015-3dad-4ca4-8656-938a61867da7", "comment": "Malware payload (AgentTesla)", "value": "2bd7a47c319ec18cc2e4c08006fdbadabeabec81fac892898d8c1551d3467cedc9392f8ac1c3d6abfa61a8ecce7e4808", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192626, "uuid": "71fdec45-3316-4150-8844-72ebc406e265", "value": "T1F0A461037E44EB00C5A83D36C2DF542403E6B9C62773D61BBF4E37A929513A69D6E68C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192626, "uuid": "5c7f5bd9-83b0-4157-b2a8-a1f77a73f39b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192626, "uuid": "727a6e3c-6f04-4321-81c6-36c1d23dd600", "value": "6144:N+LhCzDILidbfYBx+vipi4aFIZuyunhfmiHlavEgBG9:NWsyis+6p9RuVmc029", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192626, "uuid": "f0cd4821-2fb7-49e3-beda-58f80aca7ffa", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192626, "uuid": "830f57fb-adb1-4d18-8594-cbd82f05862f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192626, "uuid": "058f4c8d-3f7d-4e28-a28b-7f7f856912b1", "value": "9ba8dee5043176d0f9a0eba7b3f25a8156280cfb5862e0899f63798efed61143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64872bc5-13c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772187394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772187394, "uuid": "224c1ae1-be25-4b5b-af08-29ef198d25dd", "comment": "Malware payload", "value": "f0a8c95988adcf0041c898e21c314a91", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772187394, "uuid": "4122ea1b-dd6b-4865-99c8-8cb975938fc7", "comment": "Malware payload", "value": "9c5778a684e6088815328ec1b718123e3b795e5d948c3f1456d07507b145cdd9", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772187394, "uuid": "ec8ceb3d-65f7-4e38-86e7-999702d0cfc1", "comment": "Malware payload", "value": "7374da91e7f3b868b801bdc2d218a0f5bb520db2", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772187394, "uuid": "3d74fc24-bc06-4a5a-b873-112b4e4787cc", "comment": "Malware payload", "value": "dda1c4531c925250a52f33a7fb7028f188330e18c67073f5aa821ae058615ec60b1e1755c3fb629a46e1e5ed4478636f", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772187394, "uuid": "7c45b9bd-cc1c-4400-879e-606fbc35f5e4", "value": "T107D19805A588C2A4858653B7D43EDE488CF31A52323AE1F5E47CC786755C8388BBD9F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772187394, "uuid": "8bb54dcb-b0ec-44a2-833d-cab995d57be8", "value": "96:5BvTk4v5qRddEjpOS4L0UxWi/5UqZ2dZLYxuC2ST26l:vv7BWg4L4iaoozEtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772187394, "uuid": "88fc4f8d-97b9-46dd-addf-b1fa328fd59a", "value": 6467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772187394, "uuid": "812ee348-f875-407e-a4ac-c64314aedee6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772187394, "uuid": "96c93ce6-ffb0-4b07-92b1-5913e14adf39", "value": "eszja_1.3.41.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b1d88a-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199883, "uuid": "b701f984-8ea1-4228-8e1a-ce9995f29a69", "comment": "Malware payload", "value": "0b49f539b834dd3bc6b612b710aab722", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199883, "uuid": "0581072e-4db5-43d3-8b34-d2b68cdde2b4", "comment": "Malware payload", "value": "9d6d9ee96034ec7ebe1b191dae0ae84916e9cf783bb21a026a9b9ba859d8f76b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199883, "uuid": "d066de1d-47a9-49be-9951-8881ef449fdf", "comment": "Malware payload", "value": "391ec399f3ef5d9124e9f7f6dd48dda2d11b72d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199883, "uuid": "b8f6e573-271b-4208-9c79-3e9d72eb427d", "comment": "Malware payload", "value": "3a76aae79f79192dc3c5542e1e2ceb7211c9b109ea00ec291f1f5283515268fc61931aaef12b3b67f5f094c827159b0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199883, "uuid": "3a6514be-b398-46df-b60b-98d326a0e198", "value": "T1DB42357721F08B3297C055C8A2771B614F72970B456714B8F4BE5B2A9F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199883, "uuid": "c10020b0-862d-4835-b445-ba91d82953b3", "value": "96:cCu3k0B6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwaaIBRIB0IBT7IBbJYJN:cCu0g6nC4hvZ5mzjqKNp02LG7hxm+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199883, "uuid": "4a54948c-e3a8-4945-9ff5-8711d7449f61", "value": 12355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199883, "uuid": "bd0d5b5d-0bf5-43b8-90a4-cc6df34f7ec6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199883, "uuid": "c9a475fb-6d7f-41ce-82bb-c8c8ff80cd8d", "value": "9d6d9ee96034ec7ebe1b191dae0ae84916e9cf783bb21a026a9b9ba859d8f76b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c40ea3-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176152, "uuid": "72f5ed1e-70f7-4efa-9e18-7fa781b0c5fa", "comment": "Malware payload", "value": "52b894c17d40146ee4ae0378cfe2caa8", "object_relation": "md5", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176152, "uuid": "8fb70dee-cba5-4839-8f3b-33a919b00e69", "comment": "Malware payload", "value": "9e7336a6bb41c2df4a29dcbc1c2bb3c14bc82054615bc172773ae4fa545e043d", "object_relation": "sha256", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176152, "uuid": "ea7ddf22-62f6-4dda-bba5-1ced2c27ecf9", "comment": "Malware payload", "value": "8589ac76d40ff83e991fc2230edfc5fce2d3d568", "object_relation": "sha1", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176152, "uuid": "2bdede75-3f58-44c5-9473-4c8d2968e3c5", "comment": "Malware payload", "value": "aa5316dbf63516e01a1d5b5b5590b3f81cce508bae816e8a2aa19d1f2ea8b636e6e258ac785b3f0087241e38827ef9c3", "object_relation": "sha3-384", "Tag": [ { "name": "mandatechgroup-com", "colour": "#60449F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xtadts-ddns-net", "colour": "#E181BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176152, "uuid": "a62a306d-8a9c-409a-8e7b-f894a4b0d28f", "value": "T103C127009BF95604BAB36F05A9BFA491493B7A5D9E36DA4C004DC48D07F2E44CC67F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176152, "uuid": "34b57e52-fb2a-4d16-a44d-96b43649c6ab", "value": "96:WyEBs5sZ54BfOOF5yFwFiOD1hsZ5LvHAuXEznxd/lwwKRieHaHANuBAvM4//h2lB:WyeWf4qFicMxXEznxd/C9is8rihOWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176152, "uuid": "90fbb01b-07c1-48fc-aec4-339258c00bb7", "value": 5982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176152, "uuid": "670f32d5-e311-497a-855a-6ef0e051f779", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176152, "uuid": "ba433f78-869f-414d-924a-2a6ac27f0d63", "value": "pgqpq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eff7e9-13a8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772174944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174944, "uuid": "0790c077-9940-401c-87d6-e8cd69364302", "comment": "Malware payload (RemcosRAT)", "value": "1444d015697a2651e4f9285f5dec05d2", "object_relation": "md5", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174944, "uuid": "6286a9b8-6432-46b5-9d0c-ff6685880f84", "comment": "Malware payload (RemcosRAT)", "value": "9f2f363bcbb2c4830150bc23cb79a2f7000325636b4714ecc2e568eaf48a90f7", "object_relation": "sha256", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174944, "uuid": "d8f567f1-6363-4a4f-876e-3bed1230c365", "comment": "Malware payload (RemcosRAT)", "value": "4a137aaf6313fdc9051ddd98fe75d76cb1d7e614", "object_relation": "sha1", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174944, "uuid": "55d4f4f2-8d0c-4082-ab39-cc98211e8d17", "comment": "Malware payload (RemcosRAT)", "value": "e53517f43037b7d0a0e8473a7ceddf0c2521446a44ad24af21b3ee92c5410704a9f606aaed6b975c35b12edfcfe90691", "object_relation": "sha3-384", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174944, "uuid": "88261879-fea8-4fcd-bb19-f4c3c5710a51", "value": "T19472741A8856DFF00A2D7164B65F781AA4100366B9383D4E7D8FC5AD3F7AA10CBE11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174944, "uuid": "14821f72-3e09-452a-b0f7-9bada9d2b780", "value": "384:K377XJi+FHh4TfIpF8WP3KJWwh76UQxWuiVETxZqD42igHvqjr:KH5kf0VdOWxcETT9gHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772174944, "uuid": "50be2c9d-781b-42fe-80d2-be0f48529317", "value": 16181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772174944, "uuid": "f0cbbc0c-7eff-4131-9476-a3190dc45b5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174944, "uuid": "ee47a339-6cb5-418a-8c33-6d0f08a74824", "value": "SOSTENER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f368efe-13e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772202927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202927, "uuid": "a5c2d4c2-99fc-4eb5-89c8-169d978ee985", "comment": "Malware payload", "value": "8045a1aeb75a713a446088a79cac1346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202927, "uuid": "8d52fa09-bc56-422f-b026-c24f35ec1837", "comment": "Malware payload", "value": "a0a1266c8af6131c5da672ed4029023ca2dda40fc27f9a86029ec59a3c28eb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202927, "uuid": "cc2facad-6813-48c1-9f45-d53ec609ca6a", "comment": "Malware payload", "value": "57aeeb7bedb1cb2072ab81f0ca0781cf3178ec2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772202927, "uuid": "7fa1e2bb-825c-4988-a7e1-33c8e6ad8ced", "comment": "Malware payload", "value": "bf6381bc5fb2f7c3129e408a066c721b44b2babf9dc610bb237e4401eafd752bb775d9c4c6226a9c25759a40d1a15451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202927, "uuid": "94e59c75-6cd9-45ac-a09d-b7a78da1fa76", "value": "T1B5378B6260AFF869EC49F03FA5C12E2B241B2DB8A22FE135B55035477FFEB980714156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202927, "uuid": "4ab3cd10-989d-4ddc-a4df-cb33d3025b2e", "value": "1cc63361e542209555ef1c12ecf869e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202927, "uuid": "466621c2-afc4-465f-a300-ac46f1d9cde7", "value": "196608:sPGlLxYPXy3Ji1HXLHepqbU5z+XaGmpYm9oxn8S/kX0OWK3vw:IGBB3JAXypqbU5Qm6muyS/kX0OWK3vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772202927, "uuid": "5b8f6523-55f6-448b-9e6c-ddb768365543", "value": 23150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772202927, "uuid": "0e622863-a386-4dd6-ae61-cda1ff9fd4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772202927, "uuid": "ada2d6ec-54e6-46fc-be82-8988081b5fbe", "value": "pycharm64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c53ce9-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "a377254f-431c-4771-83d8-09b57b0fe4a0", "comment": "Malware payload (Mirai)", "value": "0ca84f13163320ae078bf230a3b92a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "103ffb9b-6cc1-4d43-8f14-0ccd02b7a60a", "comment": "Malware payload (Mirai)", "value": "a0bb66d2859e94bcbe52993225842388f92e9b9c0f561a4940e8b92b69b1c683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "45a5844b-0ecc-4aa2-9db0-4bacbe4b1fa3", "comment": "Malware payload (Mirai)", "value": "1b92bc6223ba84efedb446c13cf902701540eebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223936, "uuid": "301999f1-0ef7-4c7a-ba21-38a957d1a321", "comment": "Malware payload (Mirai)", "value": "a76a1b35051738416d35126fabd67ae80c76174c813d11fa7dfcbb88c915e160c881dff61b9cfaed2d84ec7d68d0e015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "c8707971-1571-4485-b736-41b8ee4e3538", "value": "T102F33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "b5fb6809-0b24-4f64-aacd-d5914b572d9e", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6MjMHDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6OMHDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223936, "uuid": "de78187e-a72f-4082-a106-df6b23d9bc1a", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223936, "uuid": "7a0a10d0-7d01-4017-933f-b8e5cc02b1b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223936, "uuid": "6d72f0c9-d1cd-41c4-8242-88ed0cab31cd", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5147576e-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236324, "uuid": "82d1887b-72f8-464e-b5b2-4435a3722b35", "comment": "Malware payload (Mirai)", "value": "e65e1436018c545de5993b54fbb69b03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236324, "uuid": "236d0a8c-216a-4f33-bb51-2b3865370c4e", "comment": "Malware payload (Mirai)", "value": "a1fcd4f9b85b6f47ab0ea984986715f522387f937eb54417ba714d027e1874dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236324, "uuid": "71ad9f0b-84b5-4d39-9b08-536105cb1f78", "comment": "Malware payload (Mirai)", "value": "50d021993e3a4c43782a97e462aad5f0b1afa2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236324, "uuid": "1823817f-c53d-4e87-ac41-09f8f7abf523", "comment": "Malware payload (Mirai)", "value": "b2f7dc33dfd43fde29ccc05998bd33c3cd56a1b0c3cf5318eb92bb6632ccb7ea6caedd7f1dafdfa2aefbb3f25c398ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236324, "uuid": "868fedb4-0e53-49fa-8b47-4d49572a83c7", "value": "T198834C12B2180B47D4930AB12D3F6FD157BBEED025F0B685759FAB1A9435E332846E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236324, "uuid": "0048cab1-3826-4047-860b-f25e456456ba", "value": "1536:mt9/osje9716Zso90MDpW9HnDRT7TQsbIWn6Gq2a10WNq:A/c716ZhO9HhQsbI4qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236324, "uuid": "ba48d283-e3aa-4f3f-a61e-049ac3303d44", "value": 84676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236324, "uuid": "a778751c-94e6-4d12-88ca-333c293c517d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236324, "uuid": "4fb4b285-216c-4622-aeb7-76ea3e33dae7", "value": "bin.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb1446c-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212397, "uuid": "1e782129-270a-4ed0-8b92-043d5696f740", "comment": "Malware payload (PhantomStealer)", "value": "ee6646fb7c11be161099a19a3fe6e2e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212397, "uuid": "7c7f5a0e-23c9-4b55-aa89-76ecb6d657e5", "comment": "Malware payload (PhantomStealer)", "value": "a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212397, "uuid": "622184a8-aef4-46e9-b101-5ebd2e8f5293", "comment": "Malware payload (PhantomStealer)", "value": "47d7d7731ec955f5dbe89b6740c064359f4829d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212397, "uuid": "e160f0f1-031c-4aa3-abd8-b3e74df26176", "comment": "Malware payload (PhantomStealer)", "value": "7492c22f57fa1efdd15a2ade14c21d1061f4a3c2ed60bad26f66177f9031e9aa98e64d8cabb06c8f0328b63f3f02a2b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212397, "uuid": "17a063c2-6ae9-45a9-8305-79265ca4891d", "value": "T11C82038C3EC6F2A65271A437AD2FA15EF7FE5C90B58CC095C63D5CA2E814308E9B6C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212397, "uuid": "47a4830c-4f72-43b8-8808-a092294b0bfc", "value": "384:KSPfNlzkG4pqF9dfHvrvnOe2MomTIwZ7jeNkz6u9D4B:KYfHsYOe1oC7jYSz4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212397, "uuid": "f5c637bd-15dd-473f-8740-4c23e178fe78", "value": 18325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212397, "uuid": "195262dc-7375-43f5-b698-197454d10ffc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212397, "uuid": "ea803cad-325f-44ba-9bb9-3ea64510e2db", "value": "ee6646fb7c11be161099a19a3fe6e2e1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d0309e-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236333, "uuid": "753ea96f-bd14-418d-acc5-e3d3516aeee4", "comment": "Malware payload (Mirai)", "value": "cc2701a0fd19eb05d016c61bda7353d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236333, "uuid": "8f6c900c-8aa3-4c97-8e7e-903fdbcee845", "comment": "Malware payload (Mirai)", "value": "a502021056000926fb478aeab971fb7c260ab6e2296c9650b1e8a2fc1b0acc79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236333, "uuid": "619f9c41-ba41-455a-a463-dce794a7884c", "comment": "Malware payload (Mirai)", "value": "cc0ac125036d450dd76dc9d98a1d75d3a9e7601e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236333, "uuid": "58ac66fa-6ad7-4093-a89d-d32900d07bb6", "comment": "Malware payload (Mirai)", "value": "58ef946e03f82ecfdbdc11cd37d1a705007f7af77363bbe891011fc56093a2a0c69eda4aff5791383207062e86b99ce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236333, "uuid": "ac5b9e3f-a41f-4abb-abc1-3215cbeca999", "value": "T133938D32BE762E13C0D5607A61B74722F5E217CD32A8C72E7DB10E4AFF686502113A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236333, "uuid": "e1e1c6c0-a9b6-4c8a-8008-85b911754ed9", "value": "1536:wvl7sJjyYOIYP30I2DS7jzqZpD5bVsHtc6kqdfiV0oFb:WI3uWPbKazx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236333, "uuid": "4345715a-9356-4eb7-aec0-4031a80974a3", "value": 92776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236333, "uuid": "9de7b370-de93-4916-b998-32d55c9eebf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236333, "uuid": "670133c8-d369-418c-99a1-9cbb19a471ce", "value": "bin.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b5bac9-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772155509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155509, "uuid": "b328a545-fff8-48c7-83e7-86c1b749799f", "comment": "Malware payload (NetSupport)", "value": "5ccd38b39a45ab1242129fe7f6bed6ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155509, "uuid": "a01ebc30-0f57-4ab9-bb63-8af2e7858225", "comment": "Malware payload (NetSupport)", "value": "a558b4ba7d4b18cea0f69daaa0cd432454fd18b8f467502e3493f1e407460d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155509, "uuid": "46712af1-9a92-468a-a98c-e8cce55f9881", "comment": "Malware payload (NetSupport)", "value": "1efe6b617b20f1cebe4c471d099ea3f1986ee218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155509, "uuid": "826dfdd4-476a-4112-af1a-f97feaa1a306", "comment": "Malware payload (NetSupport)", "value": "6c58426bdec22f7a71fb9663878e057ca18d8c884cafe6b2c66621a82411b5e0a42c70764bc72780bb667e737c4321fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155509, "uuid": "4af5bd9b-cbc2-4b72-ac4f-032cb236c701", "value": "T1DAD633A0A6E815FBF9EAD33DC861D592C89A75663B49C183D3F8D1A02C733C4697E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155509, "uuid": "74e9f5c2-ebc0-4a2a-9554-2edc6670ae80", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155509, "uuid": "bf78eb62-e16e-470f-9369-b10b5b6ea8c4", "value": "196608:I14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorLOIwFurH/P/XRLSq2KKeF:I14FSsFl7dCR1C99/LkuXIuuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155509, "uuid": "cf9c228e-722f-4c68-b82c-c27d7e3435d2", "value": 13422219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155509, "uuid": "123a0737-d3c8-4310-87b2-2a969fc8e37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155509, "uuid": "60476a52-e740-41a3-839c-7fbccb1071fe", "value": "us.gov.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692497ba-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772210165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210165, "uuid": "ec30f7d1-d1f1-489a-b30e-95979e6b9914", "comment": "Malware payload (SantaStealer)", "value": "0e5e999b26f5da1b6dd1d87161801a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210165, "uuid": "7975e968-ca22-4892-8934-ecc870bc1c4a", "comment": "Malware payload (SantaStealer)", "value": "a57ffaabb5eb0a688e1744272e1779587655cfab97db17d8b49cf1fafd56d1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210165, "uuid": "3cd0b7b5-8a1b-4ce3-ac3d-b1b86d80c95f", "comment": "Malware payload (SantaStealer)", "value": "218ed1dae22690ade5707d674abe21d27e00690f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210165, "uuid": "0bbdcd5c-7936-45b4-9cbc-fedcd4d90167", "comment": "Malware payload (SantaStealer)", "value": "5f939dfb29462683deb9f8f3b64e1330a9273db393a3c42e8307e18d280e5a336042462c544af60553bfa671a9bc09b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210165, "uuid": "57c312c6-0bac-462d-aa7b-f734c55963c2", "value": "T1F4A6BFDAD16E44D2DC053FF9A8142AC79B2447328A7400283A6F7D498F775FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210165, "uuid": "263590ff-05fa-46a6-b092-04e22311c4dd", "value": "fbea132208a7f61142442acb5c4b14c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210165, "uuid": "4ac2c979-71bb-4f65-a4cd-e212d3e06e9c", "value": "24576:TGo8xwez0rv8Un6k+Cv2yqneKQftVl7ZbTjZberaQxbJ+MPIj1m6CRPKJ8Kc3xJd:TGo8xww0rvn7Sdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210165, "uuid": "8791fb94-8bb5-40c0-b2dd-960a3b82fe62", "value": 10204473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210165, "uuid": "d0ac8423-7557-4542-b36f-457d368dbfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210165, "uuid": "e96eaa19-45b2-49ad-89d6-ba4f22f83268", "value": "0e5e999b26f5da1b6dd1d87161801a23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32c43f5-137a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155340, "uuid": "b6ab9fa9-a342-48be-a102-63804c55c672", "comment": "Malware payload (Mirai)", "value": "8f491930da96ce4665bf1c77e0c84946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155340, "uuid": "d008d4e1-b1e3-4002-a0f4-b30e700fb161", "comment": "Malware payload (Mirai)", "value": "a5f56a69331c0dc18ee972ae929595129b04a2025a70b44246a8db1006ee5664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155340, "uuid": "35019b35-47ce-4308-8d68-e4dc7adaefc1", "comment": "Malware payload (Mirai)", "value": "b8f70d12bfe3abfb8b50635f57472afebcf7e3a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155340, "uuid": "9c4261b6-f012-448b-a94a-b091e347ffef", "comment": "Malware payload (Mirai)", "value": "197b954da6a1311e9165ebd088af8ffd39a21a609a9179cc9dfc4a87ff700ff5ffef055ef8ae3b0e5df26bf547219ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155340, "uuid": "cf67ad24-9381-462a-9ee9-dbac98fa1123", "value": "T1ADE34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155340, "uuid": "81365120-5089-4904-ad78-947933bb9482", "value": "3072:8NMcOPLZDozjynfoHwreWu1gSa0lI7TEy6KuImkq:IOBozjyfoHWuOSa5F6K4kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155340, "uuid": "84c1da5d-307e-42fe-b666-af4a1ba4c7ea", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155340, "uuid": "b1085777-ddb3-42f7-8093-7d02ed6ae160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155340, "uuid": "ceb121e3-7770-46fe-b76e-799f2e008db1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a51ed06-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223937, "uuid": "877b2793-7b0b-433a-b330-f965573f7fb7", "comment": "Malware payload (Mirai)", "value": "eee552ccc80f270d63855cc792667acd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223937, "uuid": "5c229df5-218e-40b5-8b31-84380bac09fa", "comment": "Malware payload (Mirai)", "value": "a65a5c3f10bef050b6b77ba34256aff7b1fbb4dd424d633ef2809e453a42c660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223937, "uuid": "e840e896-1010-4b55-8895-52e374c82ad6", "comment": "Malware payload (Mirai)", "value": "78bbdde60e31f66d62710e69a73b0a7cde2618ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223937, "uuid": "1b5285ab-2eb1-498f-9570-1ffde61feebb", "comment": "Malware payload (Mirai)", "value": "bc03fc495816154add1df290296bc1c18d932be4d9528b9190ccea9dac491f51fab3c0cad874bc4b9b5e46cb3588a3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223937, "uuid": "9d35647d-48ac-4eb5-b3f4-b42a8718ad3c", "value": "T1AF03F1B5B9300489E97CD07C0F9C0B219DB81FB5945A4C2675D3E6939FB20B234C6AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223937, "uuid": "60e370ad-2bf1-4022-a406-b58c6a3ea34b", "value": "768:HyI187beFSc+RX4qCw7kwGDGRfHB3JtmH79wJgGlzDpbuR1J7:Hyf7beMbIqCw7jcGXZK5wVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223937, "uuid": "b1231b2c-579a-433a-b333-7337ef7986ee", "value": 38124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223937, "uuid": "84c27411-2c77-40c6-aecb-62ad246657d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223937, "uuid": "89d0a2ed-846d-47f3-a150-32bdff3c3fc3", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa5a534-1395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772166931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166931, "uuid": "1abdc2bf-34b4-4809-bdd1-7201047a5786", "comment": "Malware payload", "value": "6fc6d8cfe0092bd96c5b67c5b68ca187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166931, "uuid": "d23bcea6-896b-454d-b42a-42b8ee37d191", "comment": "Malware payload", "value": "a848250a51b0edfd49b50173e9207199864141a4a390d43b0e1328b94f51bad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166931, "uuid": "e3a920d2-bf6c-415a-858f-c0ff48c12230", "comment": "Malware payload", "value": "c264f95f88c1fc3abdd886db6659f4f558a267f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166931, "uuid": "4bd430a9-f498-4f67-a228-df9ef0304111", "comment": "Malware payload", "value": "494b33f57e53ac9da57bacdb75ae7bff1eecaa271e390a816d9cdb9d6647b6ac1202190d7fe00a9ed9d33219ec84fb98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166931, "uuid": "687a4450-dfc0-4ce8-8b75-3fea57917a05", "value": "T16A865A47F8E60894D4FDC2B08A7A8226E971784D0B7923DB57A0B7302F337E1597AB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166931, "uuid": "0663f6af-7cd7-4100-8cb0-684d75241f26", "value": "49152:Z6ZL1OZFnUD2N5+HsYpzyKuvjTfzqquicdqZg/wzIonflHC3WMEbkSdrhGYwoh2S:oYqa+93y2mcQ1peEMFTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772166931, "uuid": "826181ee-6503-4288-9d9e-9255e313b538", "value": 8265863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772166931, "uuid": "acca89f9-8575-4d81-a240-f718b5a5b8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166931, "uuid": "62d2b507-1a5f-43d3-bfcc-26c1d3bff62e", "value": "gitlab-runner-01_1771942130_elf_sol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188f19fd-13b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179965, "uuid": "2cf716c9-d3b0-41fa-959b-4e1212771025", "comment": "Malware payload", "value": "c2fff79a75efb2da7822d1d4efd1f8b6", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179965, "uuid": "6c9df48c-5365-4911-87a1-db0b9ac78ba1", "comment": "Malware payload", "value": "abd03b3846e7470770170a42f899d3c0943d9a26d2623c5f57bf2506ffc6c078", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179965, "uuid": "64e49bee-6a18-4fcd-a8b2-50ee52b4505c", "comment": "Malware payload", "value": "05ff1a6fdd571d0c587e59ad50d76d199f621d7e", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179965, "uuid": "2dd279b2-e119-418a-a3b8-0b807880a464", "comment": "Malware payload", "value": "d29798466e8cff8d01c69ea8111fbddf2f0c06cdf58da917e38c8decaf9cb00f44d41b18859f5160dc416493c9f93fe8", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179965, "uuid": "db999c00-6603-4eeb-9a85-cf84f6ede6db", "value": "T15AB34C1637E1447FE4AC9A319422D3E0017E775A6B933F0F91424E910EBDB85EA18BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179965, "uuid": "71f22765-2464-442f-8230-27efe2ba0b69", "value": "3072:1ZZ1MJnaZ4TAcbF/als3tDvwnhrzR6QAyJy:oZaZ4P/UKjwnhnR6QAyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179965, "uuid": "ec1ae838-43b8-4732-af1c-ddaa247796ad", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179965, "uuid": "59fab58a-6142-487f-98a2-bf9c6e2be22d", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179965, "uuid": "a7df2a05-d913-4aa4-929c-e2f7b91747ce", "value": "temp.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d62ed-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212284, "uuid": "6372120a-4c88-44b7-94f9-d134193aa45b", "comment": "Malware payload", "value": "5c71beb41a3d41b079d902f1cda12903", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212284, "uuid": "99c1dae0-930c-4715-b271-2bacc89d3574", "comment": "Malware payload", "value": "ac1ff0fedc382ee28f4c732c8cf5d9737a86485a90941b73f4cc2035d52e0512", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212284, "uuid": "c50d3bd4-9c43-4f46-957e-0edfbfe227b7", "comment": "Malware payload", "value": "709ab82857c2b2433948f63f1375ac95fb250408", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212284, "uuid": "7e5bfe41-358a-43aa-b5c1-15c2cba36889", "comment": "Malware payload", "value": "cf59f8b4ddb1ab5ee92ff17dd5be4bdef02d251aba3a91bcdcbd02ad8314f87ee0a0d7ee1a2ebf39c60cc832242380bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212284, "uuid": "570d4cd8-d76f-44b6-a9c7-a868ed0c0899", "value": "T1F5C4FEDD2EC2F26D4F81A933F60AF06DE4F488F053695C69A0DC2C48F8A16D5EE65235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212284, "uuid": "45253fea-10a7-44ab-a28f-04de4faf109b", "value": "6144:2r2H4QGUz/XqaRinRSvsQXAqjPRPo0Ymr2pMWpfJFa:2rs4QGUbXzaS0JQwlmKpMWpTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212284, "uuid": "345286e3-359f-4b3a-9be9-66d764ff5672", "value": 558222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212284, "uuid": "60298c83-d7ef-4d5f-8cfe-0ac979fc3add", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212284, "uuid": "b03d6814-7a45-426d-9cc8-dcd08bb3e181", "value": "5c71beb41a3d41b079d902f1cda12903.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba72de4c-13dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772197846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197846, "uuid": "6631e7c6-c763-4b53-976f-1efd55b05923", "comment": "Malware payload (Mirai)", "value": "b29e72b551265cbe8dabb766b9fef836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197846, "uuid": "e2d3db94-ca0e-4a82-8c0b-e50deea4ed61", "comment": "Malware payload (Mirai)", "value": "addcf578d5290ff2b99a8ad23d9e075d8087e2abed1a789818566e0ee499e431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197846, "uuid": "7a26d22e-157f-4523-bf2c-6ab975c7c6c6", "comment": "Malware payload (Mirai)", "value": "c8416503321bf2fa78fbeaa4c1cf98fc3dedf483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197846, "uuid": "7168a06c-24ef-4e22-881c-d0c935f41c06", "comment": "Malware payload (Mirai)", "value": "005734a8c82340d12a21331f119e90ce1546a99917db10cf796fd5e0316191b1b1bb871423c260941feec27046207af0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197846, "uuid": "a3680fdf-6c50-4052-a22c-37fce06d30fa", "value": "T1C6C35A77D82A6F18C255D174B4618E792F53A29182575FBE29B7C3B18083CCCFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197846, "uuid": "d2499c3c-6ea8-4fed-acb2-9a4f888b21e0", "value": "1536:6exZGq/IUcH9QZysUi1hmpNumC6dKgEdu09vawdhbW1fypgOiSNfhJNi:6exLQUc/sUoKNumfEgqvagbW16pgOJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772197846, "uuid": "a3560630-1699-48f2-aa6a-d98782ae2461", "value": 129888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772197846, "uuid": "b4b1d9cb-6b58-4c7a-991d-4b2dc375e7a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197846, "uuid": "48a483ef-b05b-494e-8f92-06d7fb95d2da", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801cf775-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175414, "uuid": "019991a1-5f02-4a4e-8a07-459c907ba398", "comment": "Malware payload", "value": "16e8d1e8df7daa7d9fbd5e3a8e418ce6", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175414, "uuid": "5cf9b449-0585-4a81-a5b9-cc5941692a0c", "comment": "Malware payload", "value": "ae5bbb7cb9cc6da0947f65add264d421f90bd3ea04bc85035f23b615cb7be56e", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175414, "uuid": "55b9c85d-df77-4cb7-afb2-b64088024d1f", "comment": "Malware payload", "value": "fc5328d006d5512cc486e9c66508791e0fc8cf92", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175414, "uuid": "01e8ebdb-78c1-4308-9759-a8faa809c8da", "comment": "Malware payload", "value": "08c536e18c9782646270bed6f4af982787af65ced34f22deb53aa42f669473e66e18066450a8b4ee059badc00347c756", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175414, "uuid": "ec8c455b-0d5a-4db0-81fc-922b01f24f57", "value": "T1D22723C295C417F4C393CB089197138B97D02567EEAB5B0E39C598036793E5B2B8BE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175414, "uuid": "5f928c16-bc9d-4fd7-ad00-225e74da804e", "value": "ae581b25c729a8f3360ac49ac8eaf2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175414, "uuid": "ec5e795c-2d76-408a-bfb9-e780a3e2950c", "value": "393216:uMUQWlGc8igts4t4WmhBIZ1xmNmDSN9FGFmPyZ6H:uDQSGcbX4KNIdVSNemPyZ6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175414, "uuid": "0d181651-c022-457c-9ec2-ffbd242f8c0b", "value": 22013440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175414, "uuid": "236b7e95-ef46-4238-9864-1e9b30369197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175414, "uuid": "42019441-efa4-465b-88d9-7919d1650368", "value": "ae5bbb7cb9cc6da0947f65add264d421f90bd3ea04bc85035f23b615cb7be56e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57301384-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212282, "uuid": "74ef133b-2037-4565-8104-e8f8d2662ece", "comment": "Malware payload", "value": "b880f3e104d4aa46a4be47234bb570a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212282, "uuid": "ea98420d-3f16-45ed-b3c3-c5872e1ae735", "comment": "Malware payload", "value": "ae78a1cd69a593a2d6be20364de99ace8d8f05c5284380b8d5ee17521cb421f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212282, "uuid": "a9bfe4cc-7da8-4c0d-b64f-36ee24407ccf", "comment": "Malware payload", "value": "4ee62fd0ae5d7745acee056d57ae56d30949342a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212282, "uuid": "2c87a33b-146a-4bb0-a01c-f3c60659e0d5", "comment": "Malware payload", "value": "3224a23b096a70ceacf13bf542304a235f15ca252dd6ad3317068ac7f0fc4e047d14edd6e7595e8cd2d863c3a1346a58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212282, "uuid": "d711f6ad-d446-4b49-9294-1ad48c9875a7", "value": "T1D767023007028C5844A14FF25FAD55AFD99ACD1973D7460EB26F5D8BCD26CAF04AB2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212282, "uuid": "2b5191fc-8c69-4cae-ab54-33475c086f1e", "value": "768:9JDm4whsayOx0jkTusKK2BDYUVymlRa8jGXZSuy1ps+XQwXFzF6xShJuymMjhhOO:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212282, "uuid": "f15897b5-0291-4184-a151-50b895e1e021", "value": 32515872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212282, "uuid": "f5867aed-967d-46bf-b0fe-6486ab4b17a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212282, "uuid": "c5773bd9-5616-41fc-a49f-3aa7158d5bc1", "value": "b880f3e104d4aa46a4be47234bb570a9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2623109-13ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176841, "uuid": "f18dd2e6-128c-4613-9da2-064b40f5b19c", "comment": "Malware payload", "value": "b5e62202b9ac1f2635a78ab24de09d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176841, "uuid": "3ced6606-856f-408c-b75e-c1d3400b55eb", "comment": "Malware payload", "value": "ae85580e7b8b78dc7a95c42967f3c9ec870894a72233059ae23107d72734c285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176841, "uuid": "eb8ffef9-f41c-44c1-aef1-0d7aca0ac8c0", "comment": "Malware payload", "value": "b1313bb9636db535abe9602eee1097bf1a03ed89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176841, "uuid": "e47f3cf0-4c64-4bf3-96d3-f7521580a034", "comment": "Malware payload", "value": "c4963e445272bc6976f5581e4e2f48925eedfc76f88329b3d91d29beb75f9b3acbef19d0c0335bf07a7a8887af70fef1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176841, "uuid": "d7ba79f5-99ba-4c27-83a2-e1747075d032", "value": "T1AF44230A1B054056DBD9933BBB1CA305923D6B3BC7D620C0CB7FA64B484CEAD7916A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176841, "uuid": "ad643df7-152e-4abe-86c2-dfd883ec19ee", "value": "6144:W+hw5/dXT2nhhM+GUXRAu6slAP+mjz5ycjKyeBy7s/bpHPz+uiM3S4A:W+hwBdyn3tGUXRAYlAPXjzxKqOzTi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176841, "uuid": "b1cd8693-7205-450f-9e0b-951d1abe92b4", "value": 261984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176841, "uuid": "f0a78386-6785-410e-9a6f-e41c77657d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176841, "uuid": "0edb87d1-0f63-4091-8de7-621dc9a3292a", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c84d81-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216578, "uuid": "53aca58a-0a8d-4fec-b1cf-1dd82b4e1907", "comment": "Malware payload (Mirai)", "value": "f099245e9c79d96acfd94242eba8b76a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216578, "uuid": "4b31dc0f-4459-47da-8691-fe830ae739f7", "comment": "Malware payload (Mirai)", "value": "aeab3bd18290ddcdf68924c4478216c55e5a967616ae2e1d07f7d90f48c27176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216578, "uuid": "7b1265f9-ef17-44e8-9d75-d60f296678af", "comment": "Malware payload (Mirai)", "value": "b1933288c09d0bdc0d24de5dba513f3e819cdba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216578, "uuid": "df017f21-7adb-4771-a3ff-975545e352ac", "comment": "Malware payload (Mirai)", "value": "e97eef1a67107a1b38b1f1b7505bdc993e484ac6add836f8bed4a7d251b08aa0e9992942ba75ec18c62c0249aee6eb7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216578, "uuid": "a972d4e6-f3fc-4f85-9f4f-dfe6b9bb81f5", "value": "T1C0E3FA06B9419F12D1C221B9FF9E415937136F78D3EE72029D24AFA0378A8FB0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216578, "uuid": "1752c056-9b58-447f-92b8-e051a75497d4", "value": "3072:uCIU+T3GAvXmgvNLLa3upQGj6CpL0BYMs6YXzmQy:uCI9VvXvvNvapfCpLws6YXyQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216578, "uuid": "a265ec98-95e9-4186-9872-239eeec92908", "value": 147840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216578, "uuid": "f1d9909f-6ec3-4a98-8dd3-275e9e5fffcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216578, "uuid": "94df3894-ce31-4230-b47d-af907580ee48", "value": "kirk.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63459ce6-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216597, "uuid": "1b516f0d-bf34-4f1e-b2c0-695b5c2bde45", "comment": "Malware payload", "value": "d8adc5237e42493aa4de250f46ff85db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216597, "uuid": "44cee096-2ab8-4e76-8f66-90866e163d40", "comment": "Malware payload", "value": "aec67a04828f1ac418f35a83ffa7d9fda2627e0190d81156c7943cd658463ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216597, "uuid": "3cac555d-d9d4-40de-b98c-0579a2e0fab4", "comment": "Malware payload", "value": "50646d893bd780478046c4076c7ad0d9d0ebcfec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216597, "uuid": "35927416-373a-453d-9d30-44d30d13d1dd", "comment": "Malware payload", "value": "fcc46e5141d74ef6a142374d76621671271f94f831ee772fa8562df7d0783c9af1898d7887d1dfb112814848727ab599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216597, "uuid": "a1227e5d-c54c-42f9-a028-61790773e4b3", "value": "T144D307026B0D0E03E1532DF4277B1BE1835BAD5228E9E680B51AFEC99771DF25506ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216597, "uuid": "dd0c0c06-3616-4949-b65c-5a5f8eb70b01", "value": "1536:bHD3cbBLpf8d46xjwCuYQQqCHk4NK43MDZrPI9i4vAjsmjLB/kHBoqF6C4q:bHDMJhcfxsRjQqkNK4sZrBNjc4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216597, "uuid": "e1b110cc-9596-42f0-8010-00efcd26e60c", "value": 139060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216597, "uuid": "4cedf1ed-13e9-40a2-8017-0b0053e6005f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216597, "uuid": "6c490d44-33b9-48ec-bff7-2de4fb53d474", "value": "kirk.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c707cc-13a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772175447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175447, "uuid": "88c6527f-fff4-428f-a51e-247c68559144", "comment": "Malware payload", "value": "fc19d526115bf784450d70af69bb8271", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175447, "uuid": "ca20ed94-5020-48db-9b5f-13b5b8e6454b", "comment": "Malware payload", "value": "afd0a94a867e4bb4747c263116f45d2473463dd14657c1091f9a8d39100677f3", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175447, "uuid": "72412581-919f-4507-9031-92e389d1bc79", "comment": "Malware payload", "value": "0d962cce68e166649e73bf6ab30aeb91be9b5f92", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772175447, "uuid": "971f0cf9-a18b-42a1-980a-de74c51d7ee1", "comment": "Malware payload", "value": "bb0cf8608294e0531c389dfba26e7adf5578d7fcf4ad68a8a2e14f5c55b0c4e0f3b037dde6e0aaee642407e2a7c20d24", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175447, "uuid": "1701604d-0845-4934-b539-e5eb4dd21cb2", "value": "T19047238375EA61E8DBC70E50F64621CA7AC121BB8EAE965D16C54C032520EEFCD4DE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175447, "uuid": "7760ccde-d859-4e57-9f6d-9a722d441eaf", "value": "ae581b25c729a8f3360ac49ac8eaf2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175447, "uuid": "2a7bdd70-aab2-4c98-ab96-e793e4ffdefa", "value": "393216:5qUo7SbhVGQJpB+pOTQ0PS6g7z3flRhjM9lEa0kq/+a6sIC+J:5qTSb3R+AETzBjQCa0hWa6tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772175447, "uuid": "7b7e8c67-829d-450a-9310-10dc5e1dc85a", "value": 26487808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772175447, "uuid": "871adb6c-1238-4f86-afdb-9f8a60dd71e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772175447, "uuid": "113a4814-87f3-4799-af38-1cca0744403f", "value": "afd0a94a867e4bb4747c263116f45d2473463dd14657c1091f9a8d39100677f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9efd96e-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772211669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211669, "uuid": "39f01dd5-aa46-461a-a734-7432797bcf8c", "comment": "Malware payload (Vidar)", "value": "9ca835a301131b75762e1f25d4479a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211669, "uuid": "3c74f648-4ea7-4c96-824e-ce41d9601ba7", "comment": "Malware payload (Vidar)", "value": "aff9e8042ec3a72576b6023c2e732e62b117bb4f785ecbc413c99e47ccfbdff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211669, "uuid": "67fca39d-71a8-4520-94a0-93baadc1d8b5", "comment": "Malware payload (Vidar)", "value": "b50fad3cecbdfcd5d1898684d4f6f121989f2208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211669, "uuid": "9e1a7b57-9967-4c65-aff8-2fec9626f3b2", "comment": "Malware payload (Vidar)", "value": "b4345b168a391c264ffa99458299698ded9d32856f684fcccd7f2ab2d56513a3bd154350236de24182b0c3e43a7a2607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211669, "uuid": "c1dfd10b-2414-4280-b125-93b526e18da5", "value": "T1E11413ACC1CEA24DDB8F1870CDA2D80D1D18DA06AF76CE986E64DC722724557E2F186D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211669, "uuid": "ad215c5f-747d-4ab1-83fc-835b4ca6a8fb", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211669, "uuid": "c610c96e-0c85-453f-bb61-54a0c38bf452", "value": "3072:BlzBuw2mR9FiZHepsHynFCbrGs+SFIKLQk+FrBpS3gec/KL70WMdH9B5et:BlVZfgbsFC+/iGrrS3QiL7VMdxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211669, "uuid": "38622c59-ce5e-4ad0-b2b0-28c2b53c8ea7", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211669, "uuid": "87285c88-638e-442e-a77f-6280087c01b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211669, "uuid": "256f8f6d-afe9-45fc-aa7e-67be606d675e", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fc45c1-137d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772156330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156330, "uuid": "6ab0ce0e-27ce-4c3f-a117-8f7db7215a64", "comment": "Malware payload (Mirai)", "value": "fdea23d7fea3e87f0a75657a64723c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156330, "uuid": "52f8bc07-ded1-45c0-9e35-4e5c12d7350e", "comment": "Malware payload (Mirai)", "value": "b11aad9b54fa5faf9e2d5911ba6f0d0abcc1fbabb67d418ad2211084861deca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156330, "uuid": "408b7efb-f87d-40ba-aecd-ca66a1da376d", "comment": "Malware payload (Mirai)", "value": "306398939c2bc59ad5b9fa42befb324980ae0cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772156330, "uuid": "6655f118-7b58-4707-92cf-9c96bf63b094", "comment": "Malware payload (Mirai)", "value": "07469f4d31a7b55a458d3daae67ca9c7ab01316ab88532b621257524e24fba9c69ffa89d60778c42c3a92a781429be2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156330, "uuid": "58dadc70-b4f2-4d3f-9247-2b0f554f8432", "value": "T1B293E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156330, "uuid": "cab55f66-516a-4434-8e26-de955d3b4596", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNCsOLYMhR:PO+d8zBWLac0yMNCBph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772156330, "uuid": "4a253a38-20b2-44f9-8c8b-56ab5499ae46", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772156330, "uuid": "51e2e9a3-67e5-4f05-ad2a-f8777fb7f169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772156330, "uuid": "ff11a0d7-f3bd-41d5-9929-74c5be3f8fa6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab52b8bd-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179781, "uuid": "b1dda4f8-0a26-404b-afbd-e45cad794730", "comment": "Malware payload", "value": "7d6828271dc7bd76360a9c255f00a5fd", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179781, "uuid": "e1df7627-67f7-4a19-9a5e-5b7f30e32815", "comment": "Malware payload", "value": "b32e609c00614486f6ced399ebcf870c43b59d0e299e9431dfc36e39b390b2cc", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179781, "uuid": "4bc37bc0-0056-4645-9953-2f2902118b15", "comment": "Malware payload", "value": "b613e6b24fad4c18ff5e04c195b6f35b64cf93cf", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179781, "uuid": "d49589fc-f218-4037-ad44-ac34a22f898e", "comment": "Malware payload", "value": "728c144253ff1338cf630f0a80e95175ab2179d4dfcbf5e23f24edc353fcf44ed5c1c6f5eca4ba1d7fb8c16ebb4ebf0c", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179781, "uuid": "f8089bba-ff67-4248-816f-f838be13ba4d", "value": "T1D1039306BBC5CE16F26285324DD7D799F62CBC18AE46C30B32447B5EBCB2A708A19745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179781, "uuid": "d1774589-6e4d-469f-9a17-0de2416b84c0", "value": "384:DciS8px8SMDYXOHQ6mtv/W5Deg9wFgd20vFmU0j2R:j3yGEQe6g3BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179781, "uuid": "e078e8b1-1108-4ea5-83a2-577830d767d5", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179781, "uuid": "d7701dbc-7d04-4344-b2c3-6883798a649d", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179781, "uuid": "671d052c-b59a-46ec-bd98-d7e10648d34d", "value": "b32e609c00614486f6ced399ebcf870c43b59d0e299e9431dfc36e39b390b2cc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478cfdfc-13bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SilverFox)", "timestamp": 1772183050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772183050, "uuid": "fc21e54e-da4d-42e0-9583-0f19a04e828d", "comment": "Malware payload (SilverFox)", "value": "f009fd3cd98b986c03adf9a940ed46da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772183050, "uuid": "f30732e5-47f8-498d-a2bd-433ff86d52d2", "comment": "Malware payload (SilverFox)", "value": "b403a4b946c7fbed1151e2377b55f471bba10897969f8695fbcb85fe7b06065e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772183050, "uuid": "937daa51-4e52-4696-a052-8ede607529bd", "comment": "Malware payload (SilverFox)", "value": "2599fd1cb19a3357e773df734c786253a613029b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772183050, "uuid": "376747d1-bd1e-4e81-b408-34a4d46c851b", "comment": "Malware payload (SilverFox)", "value": "1e3a8d9cb8829e79f9da15155240b7d69d9b048c2cdb6faa012908704f85bec20e37ed00e4ed27a6b4fc269a11ee3823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772183050, "uuid": "4a846f08-3c38-4063-a88c-6479e9abeb35", "value": "T1A1959D1762E841F8D0BBD138C9978A0AE3B1745513615BDF13E04AAA2F27BE15F3E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772183050, "uuid": "fce97d85-883a-4ecb-a537-541c1f458f39", "value": "6403d58d9c23fa194849df0d8f8c7e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772183050, "uuid": "69bec44f-63f3-40da-b279-84fd3f362ec3", "value": "49152:UB0ZltT+KUav55ITC805rpjQtZRTETMoIbGb16Hzt2a:J+uk859sDbGb16Hzt2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772183050, "uuid": "452b2b68-c054-4746-8d89-21186d401278", "value": 1907712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772183050, "uuid": "a3e7ea1e-d6b5-43d3-ae5b-c6e165b20d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772183050, "uuid": "c8091614-528b-4a02-ade7-7b0a61052415", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684f3b38-13ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177092, "uuid": "4d06ef03-037e-412a-8b72-35a26544b1f9", "comment": "Malware payload", "value": "37cf0604775e0b45d57d22c7b9ede499", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177092, "uuid": "263a0371-7d49-4688-a995-5d6e03d9e0db", "comment": "Malware payload", "value": "b42c64d0bbccc131b2109012c4124ed26a5df80029b52368982a1b5c2b75ec8b", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177092, "uuid": "f765637b-7c34-4d4d-9591-085b2c1a4b2b", "comment": "Malware payload", "value": "0990fc527f272abf6278c3d0ce67388dbba219c0", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177092, "uuid": "a8d76e24-ef44-4af6-993f-83cf10712baf", "comment": "Malware payload", "value": "1fcfaea6ca72ba1ad94fa145fa1dde843c34b97c388d0677cfbf7a1899755e75a7a39247f722f003c3aded5f645bc464", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177092, "uuid": "627f5bfc-aa4d-42a4-8eb1-f5021fe88a96", "value": "T118F29C06769F960870B34A885BAF02744F2F7A5F1E3E4049418DEA8A8FE3515DC977B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177092, "uuid": "fc4e20db-9c29-40ec-948b-38f5706004ed", "value": "384:gj9p3PAtjWjTjTjTjTjTjTjTjTjTjTjTjTjTjTjTjTjTjTjOj7lKYEdIa4QvZIf7:ip3PABlKYEdp4QRIflMmftzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177092, "uuid": "7b3ac3b9-d42e-4924-8a71-677af7ab01c5", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177092, "uuid": "b07b4dca-df3d-4fa4-8040-3accaa83c47d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177092, "uuid": "8d3fadca-2e80-4bd0-8d3e-ecfc6a768376", "value": "b42c64d0bbccc131b2109012c4124ed26a5df80029b52368982a1b5c2b75ec8b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983240c-13bb-11f1-a769-42010a9c0008", "comment": "Malware payload (XRed)", "timestamp": 1772182946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182946, "uuid": "46498cd5-3148-4ff5-b5a8-201bdf8a0aea", "comment": "Malware payload (XRed)", "value": "17f9f21ed23c68b5452945d6595ba589", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182946, "uuid": "d1e3facd-6f2b-4395-a9c5-884242195c10", "comment": "Malware payload (XRed)", "value": "b511d6e13c1d4b90ebff10d21c6f6d689b9c07b8377a21f63d1c6895525ffbc8", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182946, "uuid": "6b466427-dff9-411c-bed5-9d53a483b78b", "comment": "Malware payload (XRed)", "value": "0dc1b2aa1b7e628c2c85dfda891683dd13af845a", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182946, "uuid": "396d6acb-3de2-4ff7-a119-c0c441fc36de", "comment": "Malware payload (XRed)", "value": "4a381e5c35c508d27ed241288d62a2f5eb89065c74a4018c0f6b4f9086ee26da1197c774a38894064238a85a1db00254", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182946, "uuid": "3842584e-9c3e-4084-b7f1-f17e5dfadae6", "value": "T139469D266B924172C3613738CC76A6A455252F031F18D57A6EB46D4C7D3238EFC23ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182946, "uuid": "81467229-ebab-4b05-ace6-a4ad6b8bee17", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182946, "uuid": "7e1d817a-390a-4e2d-aa98-2c2c62fdbab7", "value": "98304:Rnsmtk2aiskDP1dOcdGnsmtk2aY1VVv28DO0r:tLxOVL3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182946, "uuid": "96c83c26-baff-4afa-aa4b-5c6956ece1d3", "value": 5571584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182946, "uuid": "d17607e5-e9a9-4eb5-8c4b-317fa656b57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182946, "uuid": "cd09633c-c62e-4d13-8e3f-6ab6e5bab8f9", "value": "SB360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7635d094-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223931, "uuid": "2d003a41-ca69-4d29-87da-de2ac8a8c0d5", "comment": "Malware payload (Mirai)", "value": "bbc4e829e5a8e7c7497b3a59a99f2a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223931, "uuid": "a2981336-a152-4965-9bc0-97124ba52ec4", "comment": "Malware payload (Mirai)", "value": "b64a26b7a5bd7e6433a43a47324e6099bbc3739fe074c9aeb935061bac3c29fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223931, "uuid": "83e21d3a-2764-4012-8a2b-e2e88d72a2bb", "comment": "Malware payload (Mirai)", "value": "454d4309fcb0b29ee2f8667cd9ab1e21aa199509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223931, "uuid": "a755ed77-5c90-4751-affe-4045f6b50a90", "comment": "Malware payload (Mirai)", "value": "37beea0dff44c66e757783e1f12a8c6da8df407c24fb59e1522fc5018f7e3a485bbecc827b31da722615f3dffd240ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223931, "uuid": "9bdc85c4-1cf7-49cd-8b88-a9ac5d764403", "value": "T1CD734B31F9390927C0D4917A61F74B23B5F287CA20A8861F3E720F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223931, "uuid": "547077ec-795f-466f-b830-c5265ea82787", "value": "1536:U2kN6QCXbqt5guvvF7tR7SYm5BHxS1H1tTvfT:HhilL7SYOBR2vfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223931, "uuid": "27453515-5ff9-474e-b49a-c611ca1576b6", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223931, "uuid": "498fc7de-522c-4925-8551-5fd4e9cd9de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223931, "uuid": "2f8f6cd1-1feb-4380-a10f-a549f154774a", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dd80f8-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772210540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210540, "uuid": "ff344694-18f9-47c2-a3fb-308f8018243f", "comment": "Malware payload (DiscordRAT)", "value": "c0a66f99952e11d29a9ac364c2644e48", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210540, "uuid": "097cd9a1-af15-498b-9afc-0f6e5f50731c", "comment": "Malware payload (DiscordRAT)", "value": "b656bdabc2d75cdce6ed4b9c9e42e6acf60097570d737a59db1717a7c77309b1", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210540, "uuid": "e05803a6-f20d-489e-a8d5-0d035c3d2705", "comment": "Malware payload (DiscordRAT)", "value": "6dcece7fe577e658e99dd4456b14ddd19b9d619b", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210540, "uuid": "c548099d-ae1c-4817-98e8-63f44329db3d", "comment": "Malware payload (DiscordRAT)", "value": "4f73611b63110fd813ed27883df260f97668017c475f40064233949b3e7939b969f82c08be918870f97bd9290d426e75", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210540, "uuid": "d27d8048-b375-48cf-ac43-4e5a400f6ede", "value": "T1B773C8C877AD8903FBBF5EBD147141424B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210540, "uuid": "9342e198-e7f9-4db8-ad19-3da52aa770ba", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+QPIC:5Zv5PDwbjNrmAE+UIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210540, "uuid": "35cca2c9-7ff2-4eed-ba3f-f6b05f39b637", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210540, "uuid": "f72f7943-90cf-43a5-b342-e78645ec270d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210540, "uuid": "b327fcad-dc56-459a-bb5e-c180f491b5a7", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9bcad5-13b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178572, "uuid": "dd483316-454e-42d2-b463-3b25da3bda7d", "comment": "Malware payload (AgentTesla)", "value": "0a2f8bb7f15c88777dbec6891e01e098", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178572, "uuid": "bb0976ae-def2-45fa-81ca-7f3acb22060e", "comment": "Malware payload (AgentTesla)", "value": "b6ac2d0bf7fadc7a61d662f75df4a3f883ad459e6b90c43bd30b811422e0804e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178572, "uuid": "793ed40d-24f8-4fd2-b5b6-884f43cc1a29", "comment": "Malware payload (AgentTesla)", "value": "3e90e78f8df06cdfb274e96e2f27e7b92b45b372", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178572, "uuid": "0b208e5c-c922-47d7-9bc0-7c396d211279", "comment": "Malware payload (AgentTesla)", "value": "d4847dc8e68ed8a536ff7563a7dc462784c91feb9d1e24a92fb81fc3c099f68568da11e7ae0cb664b8cfd56b42b54b45", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178572, "uuid": "7bf03fbd-9859-4dd5-9a45-7f275c38fcb5", "value": "T1E231A0552BDA0729D7B2CA3B54F5E3524A23BD50E9739F8D0290929C2C65600E836F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178572, "uuid": "2b16cb6d-f1f2-44bc-ae00-790bd555bb48", "value": "24:8VuJI5UmtJ1TAY8P5J+/2ryJi5iFfM0q4A+U/FIP4I0aA3yUUXQaR3+9h/LnU+YH:8x+1F8Ji5FdNxfIPzXv3WzU+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178572, "uuid": "b1bbc206-c12d-402e-a896-b14bbbfdb300", "value": 1722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178572, "uuid": "8fe3f60a-6911-4761-af06-fb6e50e6f44b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178572, "uuid": "b96908ed-618a-4cbc-8fc9-1b6c4e50e2a4", "value": "RankupServiceFreeCleaner V11.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c444b63-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772212613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212613, "uuid": "65d2a61b-ed65-4372-a95b-dfb316103484", "comment": "Malware payload (Formbook)", "value": "a73e6ee2a0c448dd9cc5c2628357676c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212613, "uuid": "b6171f98-3cdb-46f6-82b3-b56f86975c70", "comment": "Malware payload (Formbook)", "value": "b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212613, "uuid": "e12aa211-f17d-455a-95c3-c8e2868a3332", "comment": "Malware payload (Formbook)", "value": "8f028c1dea53e0405e613bd234c614bb80afe461", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212613, "uuid": "68d15805-bff3-47cb-a21a-89bd94684621", "comment": "Malware payload (Formbook)", "value": "e33928372e216b4df26991af3f13881425b16d0676a16e88c3b93b7fe841d175f3a1a73670fc531c6b0ddb3fca17155d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212613, "uuid": "98b8efa1-57db-4833-9ea1-4a844f53e50e", "value": "T1DF45D0E06744C826C56B42395872E6BB9533AE9EEC18C20D3DD9BF5B3E377020553A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212613, "uuid": "5c423c15-b033-4bb1-bb2d-f75f39bf2d6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212613, "uuid": "38c1aa8d-f997-44e9-a9b3-dbd2ed01a906", "value": "24576:8GK5HxLWJiabrTejTVs5ZGvs++03G3umoSekBvP8PkNI5aOgA:8GAxLWJiaKjps5QQcIjFH2URA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212613, "uuid": "264517f5-0171-4594-8b63-980ced8fe331", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212613, "uuid": "332f32f4-481d-498b-abaf-f263eb988a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212613, "uuid": "073e8bdf-1951-4f67-aa6c-ec9309b443a6", "value": "DHL - 1ST PAYMENT REMINDER - 1003634115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f032fd95-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216834, "uuid": "aac5ce5d-c8e0-4faf-bbe2-a9ac144eb6cb", "comment": "Malware payload", "value": "97df4d8537ee5b25009fe12e58c6ee6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216834, "uuid": "61402212-a9e0-4817-bd8f-be6d26d4dfe7", "comment": "Malware payload", "value": "b70b0eb1ff2980a84bbf185db3a9280195c6222ee9e77a12b4956eabed9e50f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216834, "uuid": "d7dd10c4-1e75-43c9-ae0a-fe0eb8f09596", "comment": "Malware payload", "value": "fb08785e80666e530ed04488d14ddcd26ab3eb27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216834, "uuid": "914066f9-e596-4e3f-9ce5-08e8f0c6d4ff", "comment": "Malware payload", "value": "35002e7bd97ae2ae7568b8f570990c4666b4beeedf8627515e591200c36be6ec8c3f0896637b2faa7cda3e2cac7f007f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216834, "uuid": "fa538a49-6342-4a0a-a8ef-f5f840aa14b7", "value": "T1E2E6332DF314EBA4EB32AE7815413108937C3DF91ED2CEDA9E141ADE113954B85722EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216834, "uuid": "744d619a-133b-4188-8e4b-7d698b21cbaf", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216834, "uuid": "596b74b8-d918-46de-8348-0ca9141642db", "value": "393216:BWWVnV6Drp1lge55EmStjnCrO7Ps+ZHMcgrRfwBguC57i:BrV69fbEmStjn8O7k+ZqyBpg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216834, "uuid": "a9fa6a2c-e119-4f5a-a487-89d0822b1a3d", "value": 14438400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216834, "uuid": "a5ce4905-5662-4f5c-8e29-b4c3be443cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216834, "uuid": "ae5d34c9-a0e1-4612-8dfc-0fb9da6dde8c", "value": "Installer_v3306_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505f8edf-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216566, "uuid": "4bdc2c47-1136-444a-ad46-fdc1c0e8dd2e", "comment": "Malware payload", "value": "1c22c08d93e78bc2d8f0c4b41588bf24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216566, "uuid": "29173586-6587-4d09-b9d6-0b1253dc4920", "comment": "Malware payload", "value": "b762960fc663410913e4ae91015a65fe450af57d2ca50a5b5c521010621f0b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216566, "uuid": "3e46442d-c082-4ea5-b372-139f78c83459", "comment": "Malware payload", "value": "584f52519a46a5c92b35c68a1dbdbee46684edd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216566, "uuid": "49c05768-14c5-4c89-ba38-dfe779db2ad2", "comment": "Malware payload", "value": "a7e0eb5e98b6713be2c4aead4e60a85201f99258cef36e3b5033dc88b5619dd4505dcca4449c525bc0879ed97f1176a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216566, "uuid": "1dac8671-1283-47f4-8df6-416ada1656ca", "value": "T1E6B24C2386B57F27C4D0377B11C3036594FAAF5925240B1F2F461C8E5EA93912B3ABE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216566, "uuid": "6aff4d40-eefb-4d33-adb7-a8a003c25333", "value": "384:k8Ns9j5z2Io2aa73kNQc4Lej9WW4PfHQKjR+U6mH0:B+9jZ2Inaa7UNyb1smU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216566, "uuid": "f996d9e1-0f8a-4e3c-83be-38213e65c96d", "value": 24768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216566, "uuid": "caba4c5a-118c-47d3-9c3a-7ed06b6c162b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216566, "uuid": "a5fbfeff-1cb1-4ea8-bf2b-9d08b292bd99", "value": "kirk.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ce24a4-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236337, "uuid": "5e296f72-0b17-4200-abce-1ecafc2fd330", "comment": "Malware payload (Mirai)", "value": "665d37b2ce060e27965654aac394591b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236337, "uuid": "0e4639c0-bc3c-474e-8d6d-a808db645002", "comment": "Malware payload (Mirai)", "value": "b7afc6608ce9059c18685c1d7824c8eae7acb3ae7d257955892512cfd4ef4c9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236337, "uuid": "85a0070c-b3f6-4c55-a6b8-bfbcb1e55235", "comment": "Malware payload (Mirai)", "value": "20da87eaba92d11d83520469092cf32cf6d484f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236337, "uuid": "e018854b-7aca-4b48-a196-43846ba6d7bc", "comment": "Malware payload (Mirai)", "value": "a96f21f228b8d6fd1c8f492a3e8b20829f24cc60ee0b5b3df66717fd791c8301242c019f9454e852b795a32d242f823b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236337, "uuid": "18f1f728-fdb0-450f-8e71-0f0d67922cee", "value": "T1CCB3F806BF610FB7E86FDC3745A91B45188C995622F93B32BA70C428F64B64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236337, "uuid": "4c922ea0-e45b-4aed-b4a1-7b2b14d94b06", "value": "1536:gYNzNMQpN6TlXQ+qXsBUFah7BIj1aBGm+Zxx58VLWG5UgZUwc6S56cqka10m:gYNzNjpNYlXQFsWFadB81aTWpgK5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236337, "uuid": "9b84b1e1-517c-4923-ad66-858acc72f51c", "value": 109876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236337, "uuid": "caf8b392-bc26-40c3-8093-3ff724190cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236337, "uuid": "b0f23d13-8aa6-4012-b438-8d437bde23c5", "value": "bin.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33780b5d-141c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772224678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224678, "uuid": "d7881bfe-3375-4d27-b66c-2e690077a54a", "comment": "Malware payload (RemcosRAT)", "value": "dbb42d91f214e9c00cf0fa9d735bad39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224678, "uuid": "a6408755-4d95-4979-ab43-8e6b995d964a", "comment": "Malware payload (RemcosRAT)", "value": "b7b336ac707a02409eeede986df2753eed36af85ac0b52dfe1d6b564c30a2ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224678, "uuid": "44cc58b4-8b53-4169-bfaf-a0659e12b230", "comment": "Malware payload (RemcosRAT)", "value": "13346d1c563655609905079079a7a18836416f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224678, "uuid": "36bb9ba9-f7ef-4878-8a9f-eb82699e1cc8", "comment": "Malware payload (RemcosRAT)", "value": "90e38505ebff5a1c6df931ecf78b1b53e4715be3b5d845c09b3ff3889d61eed2f1e345386f1762966ab84d982e3c0544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224678, "uuid": "b6c66050-53c9-4068-8b3b-2d46366ffc88", "value": "T15EE47D95A3D441F4D077C238C9828537E6B2BC056570462F03EB5E5B6F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224678, "uuid": "f7972cfa-d277-4557-8905-9f3e08302d98", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224678, "uuid": "63c520b3-6f5e-4567-9c3c-ab331837561c", "value": "12288:M7scoHvln/+iB9PQoYYUPGmdou5usyWVaMwmB:xcoHvln/+aPQoYDPGmd35oj7mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772224678, "uuid": "e1765b7e-430e-4262-9e46-28edc967e8d1", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772224678, "uuid": "1c8f48de-c807-41b4-99b8-1336d2e39fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224678, "uuid": "8c775bd2-98f6-497c-8724-065daf1ce813", "value": "20260227150340_mutacion3_c3cde5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0310ac9-13e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201345, "uuid": "934d05a9-4056-48ee-94b6-8ce1d91e72af", "comment": "Malware payload", "value": "b164e27ead011b07c9836987fe67f3fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201345, "uuid": "9e22209f-ba03-4fc4-bba7-4c9d2581bedd", "comment": "Malware payload", "value": "b7dd1e79bc7035ac1f9476ba3a41424492d768ef3b7be710be3bd44508c3208b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201345, "uuid": "c5a14ab6-5039-477d-9afe-5534dd4e378b", "comment": "Malware payload", "value": "8ae55e7e043e80bde5f4ca2c97936c01603ad79a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201345, "uuid": "4206fd49-01dd-43a1-89ec-e8e397959164", "comment": "Malware payload", "value": "80fcdbb1584d126bfcf0b16190406f9b2fcb07ece3934bc6715a4e7ee9b95d2bdbab4fe25ef743f095ee0e5c135728a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201345, "uuid": "fa6a7198-b020-43aa-8ac1-2d8e39af5e3f", "value": "T12E62573721F14A33A6D054C8A2771BA15F72D60785A720B8F4BE26369F5DE0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201345, "uuid": "b05bf365-84a9-4e5e-937c-50cb43131761", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6Ml6fz7+kxBhh:cCuhK6p4hvZ5m5FG4j4HKNphvIj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201345, "uuid": "ac89f3d5-ac58-4e73-a60d-a0c38236b066", "value": 15322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201345, "uuid": "37f8b982-20f1-45e7-b1d5-e34e5019ba41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201345, "uuid": "90281aad-2436-4767-a22c-2c1a07795664", "value": "b7dd1e79bc7035ac1f9476ba3a41424492d768ef3b7be710be3bd44508c3208b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a801e9-1382-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772158666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158666, "uuid": "5427b38a-3458-476d-9530-3a16844bd654", "comment": "Malware payload (QuasarRAT)", "value": "dd68d711b341a01fadc92f45ecd6eb1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158666, "uuid": "3a624939-71b1-4aa5-ba6c-7431a022ebfd", "comment": "Malware payload (QuasarRAT)", "value": "b807c38ee39c19386a5483070bdaf554dc3904658d25b6fdea79b49f3849e95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158666, "uuid": "302de0c3-0ff0-4ae6-8ff3-27a5bb187f17", "comment": "Malware payload (QuasarRAT)", "value": "006cc9c9b946521a889650e16381859fef5d3f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158666, "uuid": "df9e2d9e-3aba-4258-a001-7a0ada5ea0ff", "comment": "Malware payload (QuasarRAT)", "value": "a39bf31618100e96ae6a93668e584764e427eda4bba00f0327f9a7756d16ddad1d167631180f2de0ab13cdb2908f7e9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158666, "uuid": "9dba2aa7-1898-4d8b-b762-80b70a158b55", "value": "T1E8E54A1477F85E22E1AAD373D5F1541763F0FC2AF3A3EB0B6191667A1C93B4088426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158666, "uuid": "7139f67f-bc35-48af-af70-595dfffa714f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158666, "uuid": "39a078d9-6ea4-410c-a2de-747c5e96baad", "value": "49152:Ovkt62XlaSFNWPjljiFa2RoUYIWZuqbjmZvYoVdbQsTHHB72eh2NT:Ov462XlaSFNWPjljiFXRoUYIKuqbNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772158666, "uuid": "0998f3a8-d4b6-4d7c-a79f-6616fae50ac9", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772158666, "uuid": "93050a28-0fad-4b25-9646-04342bfead64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158666, "uuid": "54329da2-7d6b-4c6b-81f4-899d3a97c0d9", "value": "SecuriteInfo.com.MSIL.Quasar-A.18125156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7333484-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772211181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211181, "uuid": "9ecf0d7c-90b6-4b56-9c39-ab73c4afea48", "comment": "Malware payload (PhantomStealer)", "value": "7705126d4037eeb56f9d30817671fff9", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211181, "uuid": "ee625dc5-9875-44c2-8f63-c8f9ed31e650", "comment": "Malware payload (PhantomStealer)", "value": "b890816e65412f797f643ebf2426b497ee1921197d4fb237a2f75ace24acae3d", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211181, "uuid": "2d1ff12b-af7f-4d45-af79-814fe9298b36", "comment": "Malware payload (PhantomStealer)", "value": "d45ad7a5f9f48b38c5ab154afb04886e8e7d5f1d", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211181, "uuid": "bd381f58-399f-4fc9-8aa5-42b87fa4b4f5", "comment": "Malware payload (PhantomStealer)", "value": "9cbff0033b31d5616b1bb55bcb3f4d6a52042dde7a9adea1d88357f0a57634e1a9207f378fe428ced36ccf5d19701765", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211181, "uuid": "616cccf1-c1ff-40da-a7a8-e09c5d3eee45", "value": "T118268ECFB7C50F05480EB59D64ECE172465ABA4F6D7C4269EB39BD22C8D63EC610B428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211181, "uuid": "1710e8bd-cbc5-4b8f-a78d-febffb5a4406", "value": "49152:BnXCT0nNUum9pcxUFD0/KWjhePCDAO+HeyF:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211181, "uuid": "28c3d62c-ac51-43f6-87e4-79da1fdbda89", "value": 4604471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211181, "uuid": "d6c81ab2-69fa-438d-a059-84daa717aa31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211181, "uuid": "7e449dc0-2336-43d8-a7f3-68be4b7eaa99", "value": "7705126d4037eeb56f9d30817671fff9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f3fa17-13e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772200528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200528, "uuid": "9a15a6ea-85d1-4d5f-ae1d-423207d5bfce", "comment": "Malware payload", "value": "6219a7664a430954babcf97d9c7e8437", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200528, "uuid": "41b6111b-3382-4274-9345-b182412dc2a1", "comment": "Malware payload", "value": "b8a32c8a2298476b755a1d54031345abcb33f6b8f37729337dc73eaa14b93b6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200528, "uuid": "6838be26-a10e-4bef-a682-04b320df4c58", "comment": "Malware payload", "value": "916282e2b2a11a94c5cb0acae8758a28200ea680", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200528, "uuid": "0d8b4bf0-8e1c-4c75-9a4b-dfa22008127b", "comment": "Malware payload", "value": "5af2bf4194e6522bcecb9a84d336abb1b8289fec525b1835f08bc71c25a7915bb771f55e0051ab5f4a8e36c2241a6f23", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200528, "uuid": "bb59bd00-c651-43d4-ac89-f3978ca6e529", "value": "T1CA32563B21F08B32D3C410C993A61B614E72A70B852614B5F4FE67369F2DA0771E7B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200528, "uuid": "00730c90-4554-4a88-9356-9951cfb8e296", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6HcQAbAAFAAzHb:cCu34hvZ5m5FG4j4HKNphv5v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200528, "uuid": "5ec4125f-ac25-4085-9156-770c6cadfae6", "value": 10976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200528, "uuid": "e822a36f-b647-47fe-b21c-4205da59b8b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200528, "uuid": "7a137b1c-f6d7-48f4-9a91-35e605178bbb", "value": "b8a32c8a2298476b755a1d54031345abcb33f6b8f37729337dc73eaa14b93b6f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9110a29-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155860, "uuid": "735f1fd6-0dc4-4cfd-be3b-785ca9126071", "comment": "Malware payload (Mirai)", "value": "a5e23f6041a449415119d8313e346e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155860, "uuid": "9bac09d4-c681-4421-9061-fa0dbbfa7187", "comment": "Malware payload (Mirai)", "value": "b8dadb346e1fb945dd291ef4853d077227f3de0af063722798dbdff58a7204fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155860, "uuid": "0667ea19-d33a-49c6-8b8d-b57a8d4568ab", "comment": "Malware payload (Mirai)", "value": "e09f1c41d3ed1ed8e5cf00fcb366ef9950d4d989", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155860, "uuid": "9c3fed03-6594-4dd2-8eee-e3fbb3445e04", "comment": "Malware payload (Mirai)", "value": "2e1da8c8c14d48f36db4aedd7100885a889a1f8d65ecf71164ca374994f2484ed4f952cbe8c071a5de1fcf6153d61ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155860, "uuid": "af6b330f-c573-4c6a-88bf-a9540e0290cc", "value": "T193B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155860, "uuid": "87132854-2827-482e-960f-e2c1562c1a5c", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wHzSr9bMFflx:Pbj4doYGFB0/45gdL9ulx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155860, "uuid": "997edaf8-e0e8-415d-a423-36dfb8d0fc82", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155860, "uuid": "b1613fa5-dd3a-411c-ac9f-2c61158654f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155860, "uuid": "42d61aa2-252e-4072-822a-c19f65cc4050", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a381d32a-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772224007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224007, "uuid": "068db7a3-61a8-4c35-a7c6-a27ed887b942", "comment": "Malware payload (Mirai)", "value": "afe808dc5be2879466244e93b6a4da88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224007, "uuid": "34bb6fa5-c931-4d81-9a75-08aa092e131c", "comment": "Malware payload (Mirai)", "value": "b91c2babd11540f2bd2b7aba012150d1096af97893852752f9b895d825feb404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224007, "uuid": "8606a7eb-7d50-445c-a9ca-af0f9162ad2d", "comment": "Malware payload (Mirai)", "value": "3c3647826bc53b3c0b3038443385cd5aa0b5dfda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772224007, "uuid": "747d6e22-2321-467d-863b-b5f505ef32fd", "comment": "Malware payload (Mirai)", "value": "6098d2bb8e89ac8c16599d7d47fa4a95dabe55452f49deab284ef7a29389b373fda090aeb3f19b578f48173c1e5172b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224007, "uuid": "f6cfa648-e417-4176-b9b7-e14729072d03", "value": "T13A83185AF8814B21D5C512BAFA1E164E331307FCE3DE72239E24AF7137CA51B0E6A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224007, "uuid": "898d3027-e17f-42a5-ac13-f1168cc52d2f", "value": "1536:GpnQQmY6CpD2sAKv7isPtBBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYt9:4m0D2ym4EZCSHYMactW4Bi9gnS4V09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772224007, "uuid": "51382af3-a377-47c3-b004-f261f78c0283", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772224007, "uuid": "6d321613-fff5-446f-b509-82a199ca64e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772224007, "uuid": "fc7f181b-e46d-4f00-8591-347f09627a89", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f933ada-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236321, "uuid": "8c1085c8-9b7b-4043-a317-a5f840845559", "comment": "Malware payload (Mirai)", "value": "e3e242bca234908f7804fc244ceff4e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236321, "uuid": "61ce8e66-bb83-49da-a823-86a19d6b96af", "comment": "Malware payload (Mirai)", "value": "ba33df6a8370888d2c6a6503dff0977d1f2f423e46684ed104175ca6520d7200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236321, "uuid": "ba23ebc8-cdd2-4a80-880c-35f80f7cd350", "comment": "Malware payload (Mirai)", "value": "c607f4a3bc44cfc6e0a03fdb4c13d03e4525ef71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236321, "uuid": "60f6b471-6f96-4ef8-aace-66ec5deb68e7", "comment": "Malware payload (Mirai)", "value": "383228aad849269c9cdf62e31961f9acd010c4b1123f63b14851b85ac3e4332fc0cbdb253441c69e82515d58a5ea6d05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236321, "uuid": "cc3cdd2d-ea97-49d0-8af2-d657b1e4077f", "value": "T112934BE5F8019E2EF89FE1B5411E0E09AE7462901B930F37F6A7FCA75CB20957922D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236321, "uuid": "a06ba58f-ae0e-42eb-a128-beb5c2b75114", "value": "1536:1mC3Ga/vl0HFbI2y/zQGh9wwgvZ0Hpz5mZ5M5fxx9ZuDw81KGKSLEQxDh:1F4bqrQGh9wwgvZ0HpzQT2NZWPvZxDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236321, "uuid": "ae4ff02f-6249-47ad-b65a-5e90f3e85982", "value": 90136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236321, "uuid": "596151ed-942d-4637-941c-8c980ed94d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236321, "uuid": "099897c5-54d4-4235-baa0-4661e90558b8", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bfa648-13ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204086, "uuid": "cf7245af-08a0-4154-8ea5-22fe8669da06", "comment": "Malware payload", "value": "857e03cdb50c1d016554d64602b81d5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204086, "uuid": "af04fa85-113c-4e38-8dc3-d8ba683dd2f7", "comment": "Malware payload", "value": "ba3c1e72512aeab90ffebaf002c8702277036176315247bb3c80692666adf81e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204086, "uuid": "9eb33e92-5d72-4250-b4ed-9ac43fd39ef7", "comment": "Malware payload", "value": "ab487c9c5dd4b447f6a28921fc4c183834353179", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204086, "uuid": "c06e063d-07c9-4190-be4d-025103c12dbb", "comment": "Malware payload", "value": "f50d03b87118e0a66961e1391da08128e644fd588fc6e5109a088ce299468d6bac4f6cf017919c3cd6ba6b245b5ff01a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204086, "uuid": "91f673a9-bf23-492b-9984-514d525e5c20", "value": "T15C32453B21F08B32D7C410C9A3A61B654E72A70B452614B5F4FE6736AF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204086, "uuid": "50c26b9c-51d4-47b1-81e1-087060234270", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6y7OJgaqvlAAZ4b:cCul4hvZ5m5FG4j4HKNphvW/qdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204086, "uuid": "eb049bb7-485a-42b0-a7e8-b58d02e4eabd", "value": 10985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204086, "uuid": "a5c22722-24f3-4cdd-b87d-93fd968c9547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204086, "uuid": "d54bfc5a-0419-4230-b6f6-823c781c4d03", "value": "ba3c1e72512aeab90ffebaf002c8702277036176315247bb3c80692666adf81e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4cc8a4-1387-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772160694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160694, "uuid": "6515ac50-1b9c-4659-85e4-f27975a08ec3", "comment": "Malware payload (Joker)", "value": "e482e5fd89e79a9eda6833ba52be08e5", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160694, "uuid": "fe3c9eff-7cf4-4a31-872e-df138d7015c8", "comment": "Malware payload (Joker)", "value": "ba9d77f04fb8cbefeb2c7b62f2d66fa0080055ac160919658217ed10c53f1278", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160694, "uuid": "a216fa28-f291-44fd-88c0-0fe8e77c8f6c", "comment": "Malware payload (Joker)", "value": "1dec7f4523dd0eb8603810cf181897a48857f205", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160694, "uuid": "4de90b0c-6d3a-451f-8464-562e37c96823", "comment": "Malware payload (Joker)", "value": "cc54e9533d38e6b718af0b694392efec6ac20f341fb63695bc7564ffaf54dc983666d9af6259d2a52a9891382aaea475", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160694, "uuid": "0db0a238-f9b7-42e2-b294-077cabeab2e1", "value": "T1D237235AFB1CE42FDCB370B48DBA021396652C8A43429B13A915B11DBDB79C48F5AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160694, "uuid": "4b4e1d8b-48d2-4a9e-8b57-10d7ad292ec0", "value": "393216:WPLgXiODT06HXAi8C8IbE7iV6UhTLsoBB2Bhg7hJkjfs6ByYmZheN1D/e:oLODo6wNJEEOsUhPBYzgtJkjVByYmCny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772160694, "uuid": "ca4b0360-8392-4dd2-aec0-2e10a8cdbcc4", "value": 22469817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772160694, "uuid": "fa22e55b-2361-4dce-960b-08f47fba5481", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160694, "uuid": "4c2934ab-2439-4d71-8f7c-0e93b0f2d75e", "value": "AI+Smart+Cleaner_1.0.8.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a75da7-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236328, "uuid": "6fcf5e71-7751-4e2f-9c35-56c8129d44b2", "comment": "Malware payload (Mirai)", "value": "9eabd531f6e8ab23474257c1103380f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236328, "uuid": "2a3932b6-0964-4d74-bafc-9e4046592af1", "comment": "Malware payload (Mirai)", "value": "bc82e35df6672b1db8125f7c67c27db03640000329039c07a579c8a2ab51d0ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236328, "uuid": "ad07340d-18ea-4403-8bde-366dfe8cc660", "comment": "Malware payload (Mirai)", "value": "a8e1d935e4bef8cff89893a3602c7c97add6b6eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236328, "uuid": "3e0f5242-2beb-490c-9535-c6a8d0b10141", "comment": "Malware payload (Mirai)", "value": "9e4b93d7bc1e74618507410d40a4f0636eabb46d0bdc279ae5b9c1a9c9b4cd3a19a8fdb6b9f413de4809c9a572c7f132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236328, "uuid": "8c2c31a9-9b68-4d45-aa01-5a4a97919a57", "value": "T130732996F8915A2BC5C023BAB66E628C333163E8D3DB3113DD6017647ACA11F5E37E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236328, "uuid": "404272ca-f1fd-4a23-91d6-9b39680d36a0", "value": "1536://W8XdVIc38b+sahNwVeaJcq8IVpIkZ3vKgaLnJDX6Y54O6re6Aw60qka10Wc://W8Qc8+sahAHrrZ3vlAJuYgeLwag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236328, "uuid": "9bd4a5ff-e068-4cb3-8684-c80759352618", "value": 76640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236328, "uuid": "52ace3d4-31c6-4890-b2fd-ebbbbbdbf459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236328, "uuid": "996d21b8-ea2d-4d9d-8cd2-b49043b399e4", "value": "bin.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ead88b1-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772210255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210255, "uuid": "777c7c74-c874-40e6-8ef2-46255b5f9e9c", "comment": "Malware payload (QuasarRAT)", "value": "642ee887c3ee2c6feff28cbc1586a51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210255, "uuid": "550a2045-9391-45c8-a91d-65c405530c4e", "comment": "Malware payload (QuasarRAT)", "value": "bca01021e4c5f68d94c67a71e305e9230c3a69e5fb5da9854ae606881dd8bd76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210255, "uuid": "91c4d82f-596f-4356-8d15-2d6ce4f9b0ff", "comment": "Malware payload (QuasarRAT)", "value": "e242b9e7023b0836974ee1e11d6eac5f5229d1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210255, "uuid": "f771fb2f-9617-4e3c-bbda-9752ba08c7c4", "comment": "Malware payload (QuasarRAT)", "value": "52a0a3142f6172005bc4e7714d169ed1e0067b7b63aba7fb10bd978b189d9ea77367202f581c513840b961fa665ae9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210255, "uuid": "622d7ca0-33e3-4a34-82e2-b5018a969fb9", "value": "T1F1544920B591CC32F666357198A6FF65592DEC201F68ABC773802EEACD306C2673571B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210255, "uuid": "9294e209-fe92-45c8-809d-601f6a0b2e9b", "value": "c96ef060f93a8d636cabb300b6ba0c42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210255, "uuid": "29d3d1fb-d5d4-4341-b2dc-371bdc48214d", "value": "6144:jatKwLSGEsDQe0R1Rd2VJ6Nj6seXzSwFGlrgqTBs7EF0:ja5/Qe0R1zO6GXzergyBs7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210255, "uuid": "e977ae62-1f1a-49c5-8bc8-ad47cd6abbd3", "value": 295624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210255, "uuid": "4bb8a090-7ea6-4409-ab37-34f240f52865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210255, "uuid": "daaa6d82-4688-427d-a46a-ac39b7f74b3f", "value": "bca01021e4c5f68d94c67a71e305e9230c3a69e5fb5da9854ae606881dd8bd76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db6c3dd-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772211300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211300, "uuid": "732e2844-82b2-4c84-b8d8-0eb4fdb7cc98", "comment": "Malware payload", "value": "ae3c72ff34c661b2603d44402f3f7ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211300, "uuid": "5056407d-82d6-454e-abe1-34415188473a", "comment": "Malware payload", "value": "bd969d5884c89844dfc11baac9949daca1647819883f4010ae05b72e80ff4fa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211300, "uuid": "15016349-fe6d-4727-b8db-bfbab8715e3f", "comment": "Malware payload", "value": "a69a23dd1682fc6b1d6c1b0f4b89df46355a35d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211300, "uuid": "8fd912eb-b422-48dc-8717-6e519b62359e", "comment": "Malware payload", "value": "4a46da20ece948e9631fa516e0088fe077077c985f324afff12e9d0ae69ec72e062bf47e64fa110ee67ea2a211539a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211300, "uuid": "1b2f9aaf-0f1f-47ee-8f1f-4c3195f3bbb6", "value": "T1685302C7996A8B39F8B5C9BC4EEAC8845C97012D7147B0FF454CA1BC28397451E8AE4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211300, "uuid": "5a8c9fb2-adfc-433f-a2c5-0a34d4a56432", "value": "1536:m3LqE6rUQWzVQR7iAGEcUT5PIi7pLqBNs4LOjcwf4nB6Xuz2:mOE6PWo1T5bz4LVMXuz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211300, "uuid": "94bf08f7-af88-4690-9831-a443af6e7778", "value": 62460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211300, "uuid": "1b2afe0f-8899-4344-953f-70e97220825d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211300, "uuid": "15a08223-9ac6-4de7-ab80-caf502f4cec0", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad98835a-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772211568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211568, "uuid": "7fbb0c68-9dd5-4f07-99b8-61f4cc805701", "comment": "Malware payload (Vidar)", "value": "d210d17f5bb9a376a9a7883ea6dea3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211568, "uuid": "8a242bd0-c1d7-46ec-9b03-94d6499cc173", "comment": "Malware payload (Vidar)", "value": "be0f303dafc4ae539aed3c764c2056740d6d00bf8e044170a400f90e654d9c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211568, "uuid": "7cc9b6c2-466b-4589-b80d-b0f58dbdafc1", "comment": "Malware payload (Vidar)", "value": "fa9159fac854727ee11eb45471c8f2512374f757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211568, "uuid": "c2ac16aa-53e6-4ccf-9ec0-430c64dad664", "comment": "Malware payload (Vidar)", "value": "f9aa161cf6e49ae95128a372ee58c513231c89dfcfbef35e39faf2cac0ab7edbda9169697891fb4f2f3e301eabaf32a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211568, "uuid": "b095c418-d146-4bb3-8545-4be258e7ea72", "value": "T1C6D42BBDAC60E362F60DD0BAE286E7535F5178010236AA9309BED72412058739F577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211568, "uuid": "77418815-7469-45ea-80bd-038a5fbe364c", "value": "33ae1da8e7325d3e73d4a52bada9dc7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211568, "uuid": "5efb221f-17ac-45fe-9e08-352abcf53e50", "value": "12288:K1Z9H0I0Lqf0h0ewjUKlg8SIt14y0qSXWdH3ROr:K1bH0IlJXgBIt14y0qNdH34r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211568, "uuid": "317dc733-2d59-4b2c-851f-2cf2b4ba0e5f", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211568, "uuid": "b9b11f68-108d-464b-9872-ea492b8df328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211568, "uuid": "764af6cb-1323-40bd-b1af-226005ccbd2a", "value": "iXSdtjb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd98a8b1-1402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772213850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213850, "uuid": "93cfd67d-8275-44c4-b02b-3b0f95ae1689", "comment": "Malware payload", "value": "8a042a29c1e79029d5f7ffbcf1d2f818", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213850, "uuid": "8aef7966-14e7-4bf1-9392-55be8242f317", "comment": "Malware payload", "value": "bf8704229a81d26a3845dbbb987e1c0f8d97b462067ab4a2bac457808d7acab1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213850, "uuid": "714e0969-d690-474b-9453-8c8688071bc5", "comment": "Malware payload", "value": "ddc4d86b64f8fda324185079631050b9b33ff98b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213850, "uuid": "016ef154-3f3b-420a-8e3b-0dc01e196ea9", "comment": "Malware payload", "value": "5aff62ae16be6ca65e4cfa3e1350034597931f9f683a79c511c25b776dd8b006354d7293e64ff5bf754b5cf2d9e704ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213850, "uuid": "a0cb9221-666b-4a36-909c-16d7ec2c2e07", "value": "T159E04FDE30606A63D18CAD0464B6B841A0E3C9801B941E1E5DD90CEAC8CAB10770BB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213850, "uuid": "68700f6b-88e2-4474-a0a8-73fd43dcbd1d", "value": "6:LMFd6NHTG8/aMFdk8a6++c/VBiMFdEHTrgMFd9kbTR:od6xGARd6PHVDdkrHdOTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213850, "uuid": "bc373164-6db6-47fb-943a-2a0fcb312add", "value": 300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213850, "uuid": "d153b2de-0223-41e1-ae3c-e5208b9b03c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213850, "uuid": "00ef5036-3dd2-4015-9355-8b2f9eafa6b5", "value": "cnpilot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c253c4-13ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204087, "uuid": "f51d9298-b088-4807-a80b-e9857f5820cd", "comment": "Malware payload", "value": "10474373f4912217f5290e614c8f7645", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204087, "uuid": "26a1ba06-4bee-4231-b8ac-7dd22abcca55", "comment": "Malware payload", "value": "c038dad28a1f71fbd6c497a032cdff65e8fbd5830ef2e97243f4994c9052e38e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204087, "uuid": "38265ac2-7c60-4908-bee0-bcbf114daf58", "comment": "Malware payload", "value": "7a891b4137fdce531c969abf91ac71c4220dfe41", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204087, "uuid": "04ff7c1b-05e8-4d77-99be-68a98efd63d1", "comment": "Malware payload", "value": "0f5a3e2e0176138bac039a0598b3064139535e97bda8692f1223cb3ad780c825bcf260352c0bec2666c81671eba64e28", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204087, "uuid": "ada39c32-7ec6-4532-b2df-1c2b96e6fe7b", "value": "T12E32B07125F14C333A706944B3772BA6ABB6D95385E3318C35DE2E266F86F02B1AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204087, "uuid": "a2f6baef-e7f5-4136-8373-a50e62c3a4de", "value": "96:cRuKB6es5FUJRxG22lQxfafW5SKSOSCgHSajmYmFZ6xz6fN6f/U0:cRuu6ernThW/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204087, "uuid": "ba9aaabc-e328-4ce3-b341-3502c29bd4b8", "value": 11863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204087, "uuid": "e9f595e0-59e8-458e-a613-c8e5ea256956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204087, "uuid": "6ef956d0-b669-4c50-a365-d8583d9d3c44", "value": "c038dad28a1f71fbd6c497a032cdff65e8fbd5830ef2e97243f4994c9052e38e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c52530-1406-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772215442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215442, "uuid": "15367471-0081-49c6-9108-8a59c9616e90", "comment": "Malware payload (PhantomStealer)", "value": "3fd712c4c45ad9bbeaa46bfc0c9b32ba", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215442, "uuid": "d969c9b5-00ff-4f2d-81fb-6d5158f0f26b", "comment": "Malware payload (PhantomStealer)", "value": "c29966f812a4a6b5db08fc8926aecafaa24395caea1213a8f84da02987a6ff6b", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215442, "uuid": "4abc5b7f-c910-4f92-8d0c-3588dc98d8a8", "comment": "Malware payload (PhantomStealer)", "value": "2b73a86ca7fd16506258a191172c46644528d93c", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215442, "uuid": "d1a78707-b59c-41bf-8f4f-699c067a20c9", "comment": "Malware payload (PhantomStealer)", "value": "67025895bc1abe899f972e2fadcb0dd69ff95ad916bbc093c111fd3d51408d04af63de910a705147374732e6edef2274", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215442, "uuid": "1c18976b-66c9-421a-89ac-73bfa81ce31a", "value": "T1C5F58E524225DE0FC108E9916D350FECEEAEA0F544B062B4E6C125574B87F5FB0FA9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215442, "uuid": "086fc475-728d-4220-ae98-35c0e8d77065", "value": "24576:eysdNljH/bRp4AjYpOsBJ+6x+1ZRpqNrvdFBtxNjahYZtcSYqooHTXJ56YnC9sCH:etfNUB3gmFlFbLehBRnkXJJPGw4dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772215442, "uuid": "a5266c9d-599c-4dd8-8932-a4e29af7905d", "value": 3462245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772215442, "uuid": "6de2ad30-fff1-4381-bd27-dba0d1437672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215442, "uuid": "863285d5-173b-49b4-9881-94476594ac54", "value": "SECURED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61935f9c-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191254, "uuid": "11ba5f26-d61c-49f6-aa43-39a661a6b9ab", "comment": "Malware payload", "value": "b6480aa6c364715a21ba28c4d26a5b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191254, "uuid": "684d2835-02c5-4c55-9dcd-9d021fb89ba6", "comment": "Malware payload", "value": "c2a4212573d7566acf5b610b4ce3598237acd37459670daa1b6950f107d50e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191254, "uuid": "b3ea4d29-d620-43fc-9010-8b659833f9df", "comment": "Malware payload", "value": "ba7ea733843809388a8b0e3039ed2ed3a5d1ce3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191254, "uuid": "763ea059-c033-4185-a679-beb79b1231da", "comment": "Malware payload", "value": "2cbba91b406c39125b62e86712972f6b2103b92eae742ab96057eeffc1727c0583f0923c18905665b4151d898e0b16a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191254, "uuid": "9db951fb-dbff-4510-a8cf-90bbe4d9c378", "value": "T100058D07F3A980ECD46AC274C7569627FBB2F84A2230B65B97E04E562F53E706B1D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191254, "uuid": "e7e0a94c-09e6-496f-bc7d-547a9f9eba33", "value": "fb180ce28045fab64f03eb559bc0961c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191254, "uuid": "5ae53423-087d-45a1-ab01-26e77a19f6b0", "value": "12288:db8OM8KIcHN90RoyS7tsyQ//HtrBE+h4aj2N:F8j8HcHNSobGr//NlES4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191254, "uuid": "33ba30f3-ed07-4488-92d7-329d82c880d4", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191254, "uuid": "7ec476ea-d9c1-4f21-9e34-fe4cd5c5f8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191254, "uuid": "0a443cda-0127-4f5d-a924-0ef498fe6583", "value": "updateV3.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc11be98-13af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178145, "uuid": "b6db9a84-d659-46b1-92ce-c99c10b97de3", "comment": "Malware payload (AgentTesla)", "value": "9eae2b230bf5dbe13906c73f111e4d9d", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178145, "uuid": "18601f52-a729-4d70-889d-664655b07715", "comment": "Malware payload (AgentTesla)", "value": "c32d6a1c0329ba7c40c3dc59db7dfb7b2a97aae7d25343d1533b43136b3ccc69", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178145, "uuid": "87de0190-e1a3-4b66-974d-6c4d71d79b58", "comment": "Malware payload (AgentTesla)", "value": "23ce1b845698a0bd6ff94abe3e0fef6ad8f31205", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178145, "uuid": "0681bacf-9f63-46ef-a5d3-bca25e3f6fb4", "comment": "Malware payload (AgentTesla)", "value": "41152eca2c533794b209ee1623282f5dc58164b2c29dc9c9ba551d1b0aa22a2dccb99d3bffd0849137189c1a2cd81c54", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178145, "uuid": "6af99b69-a92a-44c5-8bb8-2cd6893f2734", "value": "T1D6A42354F13C50238A318A0A53BAD21A1AA374DD409F39D8FF85DC5E5C9ACF9A1D87EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178145, "uuid": "241ccf1e-6221-42b5-922a-d1cb32d24fae", "value": "6144:njWscqbxHF+yMg/X8b0ltYKAgi+zQt75QDTEhMYhb3RW1oip7eIqCxD4WnuNdTAY:nasN9ASOKAgi+s5mDInRW1XkWDuvPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178145, "uuid": "87d79aa9-d795-46c1-b8b0-2c1c0945c19a", "value": 458002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178145, "uuid": "020ca219-c401-4a2b-b2a9-24238c5a75c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178145, "uuid": "bbad3255-5dbc-44a2-9b83-e0dc0a4b941c", "value": "FreeTempSpoofer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a65a44-1403-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214132, "uuid": "6e8a50a5-4787-4fcb-9ae2-2ddb69220c55", "comment": "Malware payload", "value": "82c1ede52d87eb345226ff7667fef282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214132, "uuid": "7c10716c-6338-4731-b59a-ef3e2640de04", "comment": "Malware payload", "value": "c44660ea89c20d69e7751d5a19bce83ea0686d02979c2a436d1d3799f36571c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214132, "uuid": "788f8a25-7d95-4aa8-84af-bb20c2744c80", "comment": "Malware payload", "value": "9eb238138043027136e81a207de4e09585d31057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214132, "uuid": "276db6ae-610a-4b21-8227-3fd62de63158", "comment": "Malware payload", "value": "0320a8883e55b9a51f44eddd91b6abac3ead2003b68518a69fae6daed6c40415ac0eb65e9306b85aeb71d777f2c42104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214132, "uuid": "0a66b1b3-14b7-4a50-94a6-c26510ae90a7", "value": "T114F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214132, "uuid": "089abdce-a94d-4484-83f7-f82973b310e2", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214132, "uuid": "f5a5364b-8ca4-4d94-95b3-eaed4adc314e", "value": "393216:Pn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:P1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214132, "uuid": "64cab3d7-1277-4c91-93c1-e1f38741e631", "value": 71415296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214132, "uuid": "873d4a75-e096-46c8-81f7-f6de7afa1426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214132, "uuid": "b3495774-90ff-4295-8cbf-d4f192cdfa3c", "value": "SecuriteInfo.com.Win64.Evo-gen.86737763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5991aaa6-1405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772214863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214863, "uuid": "d81d5983-cd14-45df-a6b1-6cfbdec49087", "comment": "Malware payload", "value": "f9b07690ad44ee01a6e356872d9fd89c", "object_relation": "md5", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214863, "uuid": "caf2b8c5-99a9-47d2-ac09-0ef3bd736071", "comment": "Malware payload", "value": "c53ebe90ef8540744cf135a2ac9e94b3df4e7fb1cadd0a0bf5ff3177c49b37b8", "object_relation": "sha256", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214863, "uuid": "7203b6da-63f1-47bd-b955-1802cefae264", "comment": "Malware payload", "value": "215930ff817c815241130683947136a34e990f66", "object_relation": "sha1", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772214863, "uuid": "05a75663-39ac-4878-922b-7716b3ec974b", "comment": "Malware payload", "value": "aacf1d4ac51b6b087c668024ae9989eceb60c6ff14c7bf534fc6f12bb5033f9427af00b97d85d7ccd0e19e6c8b4d86b9", "object_relation": "sha3-384", "Tag": [ { "name": "45-128-118-140", "colour": "#21266F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214863, "uuid": "87dc1f71-ac27-4f02-9157-e3b8ce282b3a", "value": "T1E0B6AE03E89114E9C5A9E230CAB79253BA717C495B3237D32B50F7786F76BC06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214863, "uuid": "9d58166c-4c3b-495e-87d3-cf53b0ce53aa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214863, "uuid": "feaed2bd-7cfb-43bf-8723-a21859857456", "value": "98304:ejwvkrhZ8cbvIOCLjb9DklgEZhMYZ3nn/NHHfigXcJLzOkxpEQ0sWcEIewH:ejmkNZHADuZv3n9fhchzbzPEIewH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772214863, "uuid": "627db82c-d84d-4079-a9b1-3a53535a69ba", "value": 10656256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772214863, "uuid": "1b71911d-4f40-44a6-8ced-1a720e65c10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772214863, "uuid": "56ba3b53-49dd-4988-b1fc-c320bfd9dd3c", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be78503-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772212209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212209, "uuid": "12636d24-cb26-4722-a29e-efdbfb6b7793", "comment": "Malware payload (DattoRMM)", "value": "be5eb06e422315ece1cd5b9429aa20aa", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212209, "uuid": "8a2940d4-4741-46d0-a2d6-28b64a3d2517", "comment": "Malware payload (DattoRMM)", "value": "c5573703a9ad2945e3545c91c5571bccc60941499bf3162c1bb08716fcdf92ad", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212209, "uuid": "51d5cee5-07ed-4a92-be7e-4cb34ce5f33b", "comment": "Malware payload (DattoRMM)", "value": "d498695e94c22ddffd91e14dc9ec0647c1cf68ab", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212209, "uuid": "b5690a07-bc1e-42d9-9e68-11e425fc5389", "comment": "Malware payload (DattoRMM)", "value": "ab42e084e4f789a67fb56cbbaec21d4e41b5b0c62b8d31195afb93e0dcec017af0c2a36970c8993bca8f5431e3793f28", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212209, "uuid": "8df030e5-4817-4c12-a23b-cdc7312bf2c9", "value": "T170B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212209, "uuid": "a7ee2e9d-6e28-4a4e-8b54-26cd5c093f32", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212209, "uuid": "73ca8f93-121c-4602-be82-b5e12518582e", "value": "196608:raZk+wDP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:rnSmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212209, "uuid": "b134d180-4f85-4dbf-8158-b4178f72ffb8", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212209, "uuid": "ce2ae053-f43b-4e74-94c0-9941d24325a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212209, "uuid": "1d0fc0c6-bb26-4143-804c-1e086ec6290b", "value": "PaperlessPost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2139f925-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177832, "uuid": "94c552df-09fa-41a2-8deb-858c38a82321", "comment": "Malware payload", "value": "431b4775ebcb6b346a0583916b18c50f", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177832, "uuid": "fc550c87-96c8-46bc-ac12-2d21a33ddbac", "comment": "Malware payload", "value": "c5b130dc95cda83351249586dad341142d26127c570b56c5a3cc224f38f4a632", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177832, "uuid": "365b9d10-e9ea-47c6-a7e6-bf88efe2c169", "comment": "Malware payload", "value": "334de94904f8e5df0c69dd84f9f9f14bbe56a0a8", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177832, "uuid": "b7747728-0b09-472d-8db6-481008fffd99", "comment": "Malware payload", "value": "663a897a69120f40c4a8d1e585528f98168816f71aa88a544036739684f433cdcee15610ecfec4763aca32840f1bae24", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177832, "uuid": "2a8d65b9-96f9-4754-b5f2-9caeb120cd2f", "value": "T1F7F29E1172AF8608B0A3478D46AF06744BBF799E1E7D8189018DFA8A4FE3415D94B7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177832, "uuid": "ea086efd-dcfe-47c9-b6fc-1e745a7dfdb2", "value": "384:ElX9p3zAHXoXHXHXHXHXHXHXHXHXHXHXHXHXHXHXHXHXHXOXF2pYEdIa4QuH4rx5:6p3zA32pYEdp4Q+4rxM19K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177832, "uuid": "b872abf0-1613-4aae-8432-80133fb5ee3e", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177832, "uuid": "c2e19e2b-16c6-4c4f-8e3f-328b341a1315", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177832, "uuid": "b6c8b580-c1f5-4881-b3f6-2b50f6619df8", "value": "c5b130dc95cda83351249586dad341142d26127c570b56c5a3cc224f38f4a632.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d47f4ec-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177825, "uuid": "01513354-14e7-4c90-880b-bc5128901fbe", "comment": "Malware payload", "value": "0bfc22b3a71409c5665eea5568c58bdb", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177825, "uuid": "589f6966-cc08-4363-95fb-62644bfc0a61", "comment": "Malware payload", "value": "c5f8bd6bd2e5ea223b30dc92a2766948601ccfed0d1eb4d90c769e8e95504983", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177825, "uuid": "e6227c46-0d9d-4c5c-b07f-cd5f3aeeac4e", "comment": "Malware payload", "value": "6542916e92d95ed99acfb81f8437ff2365ccb0ad", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177825, "uuid": "3da11ecf-cd05-45b6-9e35-6b09c54d0e3d", "comment": "Malware payload", "value": "6f8ce5a92be88e57493dbaa84585bef19bd2ca4e8237f3f0220c5a89a8d8f4e547f433a2b4b60ee4308da3a877dac9c1", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177825, "uuid": "a8cd24fa-5654-4fd9-8648-1e2574343b21", "value": "T140C16A006AF95604B6F3AF15A9BFA065493B7A9D5E36DA4C0089C54E03F2A40CCA7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177825, "uuid": "b8df94c7-a430-4f56-aa80-f60c79c6848d", "value": "96:WyEBs5sZ54BfOOF5yFwFiOD1hsZ56vHAttCEznxdelwdLR1xHYHAmxsBAvr44/jq:WyeWf4qFictQCEznxdeCv1kUzijX0z0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177825, "uuid": "255e6e1e-e498-4da7-87b8-adf249c6cfa6", "value": 6030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177825, "uuid": "5e4a55bb-4150-4a55-a0fd-3d52ad04c13e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177825, "uuid": "67b7fb01-4a62-4d47-a55b-89e384b82f2b", "value": "c5f8bd6bd2e5ea223b30dc92a2766948601ccfed0d1eb4d90c769e8e95504983.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aea38d-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212459, "uuid": "fbca82cb-165b-4c4c-8273-2391497435cb", "comment": "Malware payload (PhantomStealer)", "value": "5bb090d5b6ca0d73af4c86844ca2b99c", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212459, "uuid": "7fe060cf-a569-4673-bb6b-9da87b4b076d", "comment": "Malware payload (PhantomStealer)", "value": "c5f8fd48834eb238614b5a3817aeff16510a749d51fc0da922e3b7fcca8c2af7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212459, "uuid": "adce25b2-7d80-43ce-82f9-418c2cb186e2", "comment": "Malware payload (PhantomStealer)", "value": "a939a1c10e34b98e45d34cfce13d6e6fc68d44b5", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212459, "uuid": "2feb9996-5e57-4675-b2f6-0008d68adae2", "comment": "Malware payload (PhantomStealer)", "value": "093bfa35374240873672d49ffe483156b41e7418254b7dc6f393513ff70f4dac71638157a7e483da55d08a4df8c0dbb0", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212459, "uuid": "fc1a034d-3c6a-4504-a806-db855de3745d", "value": "T18733B574194C45EF2493EAB4B084A7E3FE6C0A5C9FED6A4F925487CE163EA8734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212459, "uuid": "aa06163e-175e-45b9-b660-2c5cd063ce33", "value": "768:iDgsMzlXIAk7xdKq/IzjlvThUwVh7oCGYm:CMhjAHMxhUwVpoMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212459, "uuid": "bc3f3e9d-cbba-4e03-81fb-1fa73a1373f9", "value": 53281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212459, "uuid": "95612d16-fadf-45b0-bd3c-59875d4c0f16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212459, "uuid": "b010b3eb-b2a4-41fb-b4ae-20aeb4612cb4", "value": "5bb090d5b6ca0d73af4c86844ca2b99c.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b767de2a-13fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772211155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211155, "uuid": "2c02b822-49d9-4a9d-9e43-50521447f804", "comment": "Malware payload", "value": "07a34555a9f59b5e61c76638af5887f8", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211155, "uuid": "887c515a-ae94-4007-8dae-38f83d7b863e", "comment": "Malware payload", "value": "c6d1092e3f39218baf167992afbe020d713b47483e87b64f20dd43a35efe2903", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211155, "uuid": "23cc1b82-d601-479a-b9a3-85145ab3f305", "comment": "Malware payload", "value": "f78cce107efb6c60c04de026fe80e2265ce3ee17", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211155, "uuid": "19a33063-8f48-4497-a265-978aec649b1a", "comment": "Malware payload", "value": "374f21c3284811e8d03a4812e3af0d6832026a6c24c8fd7dfe6e13944032faa51c74c47faa5762e3db65189463dd76e7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211155, "uuid": "3f91af98-1cc5-403f-a53d-4e627a55a16e", "value": "T1CC2412ABC84BCCE6CC3EE03E62348ED9B215794BF2567839182A646D35117DB314CE67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211155, "uuid": "2b3ac1fa-f3eb-4fd1-b57b-b3cd37713070", "value": "6144:VR725geUsZIUbbuzuQjzbU23umBhqkW4A9TKlf6WWLqc:fMGaXCCe0ou2aQiuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211155, "uuid": "2d694dde-5049-4409-ad5b-e42bdb968072", "value": 229375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211155, "uuid": "9ec5243e-fbac-4b5d-82f3-515c3dadef6f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211155, "uuid": "234420ec-6716-4551-bedd-70bf274da90f", "value": "PRE ADVISE BOOKING NO. TGBU6052537 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c73dc8-1396-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772167295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772167295, "uuid": "bcb98199-9f25-4597-8fb7-8367bd15ffe5", "comment": "Malware payload", "value": "e6b174060290e6b18484634e819d8bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772167295, "uuid": "0d3520cb-2e27-4ce6-a761-677df4455c9f", "comment": "Malware payload", "value": "c7ee62ee9fe25bf304609c9d5d464cc1f23a089a38c08f4824f16c0a21840784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772167295, "uuid": "3d6dae56-c47b-4ca3-a8ce-e2d663b3c77c", "comment": "Malware payload", "value": "84ea1cd3d876970e0ced69e19c70b1ec9cec2ba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772167295, "uuid": "49d39769-6406-45df-bf01-f3c72cb5d7e7", "comment": "Malware payload", "value": "3497a6e4a67bf0aae23007379149eb2057431d0e4a53a6ccd3f9f625aa2a643fdfda61e82baa9dd45c1b306f008dd3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772167295, "uuid": "050a8c38-4fbf-4454-9159-bb1b8b40eded", "value": "T14C863397F603D9F5C6E5A0F41DD4DAA123B0A12FC21285F22A85E3CBEDB53901FE6491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772167295, "uuid": "91ba6591-92f9-4aaa-9ad7-4bb335138d0d", "value": "196608:1htRZcuAPF/h4PMJLjiB/jKTjSJkHYKq0lcYJf:1Dfc39/iPqXPHCkHFDlcuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772167295, "uuid": "3de74fb0-c6e0-4353-9912-75bcec79a9ad", "value": 8060928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772167295, "uuid": "05ac54b2-ff6b-4ac7-a5a7-0d1cf98e493a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772167295, "uuid": "db35e9db-6cc3-4c36-953e-3cf8ddebe7bc", "value": "syd-api-01_1772148238_elf_IjSXGMrA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b6d8e0-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236326, "uuid": "64715577-7821-4dcc-aefa-de467b0abf4d", "comment": "Malware payload (Mirai)", "value": "30624fb1a6b85cf3a82320846e06408a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236326, "uuid": "50fc5014-2b4a-4196-acee-73a7e5a590b9", "comment": "Malware payload (Mirai)", "value": "c8d65b23105de729fd8373f2a4bb1b6ec46456010dafad8c96631cd94f35cb8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236326, "uuid": "7dba44ae-47de-44eb-89b4-c3ba08bd3c2c", "comment": "Malware payload (Mirai)", "value": "f8e91e644205c22b5e4c4765661fc9579b770002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236326, "uuid": "8fe69b4d-874e-4620-9901-889ede8e5794", "comment": "Malware payload (Mirai)", "value": "6cd62395ebd73f918b7216f881f1ed99414534188f95acfe6de6f37b904451538f003f917de08c25fea905c252798e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236326, "uuid": "d83cb2f3-7d34-468a-a073-837c25af5147", "value": "T178833A47B5C289FEC019C27426AE7D3ADC22F5BD0339B1AB37C0BB253C5DD611A1AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236326, "uuid": "37ecce95-7736-4df0-8216-853914999d8b", "value": "1536:NVPBJZWA+QIk4dD3p4E3MTTgc8a5YQJLH0uoGJcO60qSLA+Zz2sKg:XPBJAhQIk4AEtcLL5JcObfz9Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236326, "uuid": "2ed4c848-da8b-4abc-972c-baeebaabc105", "value": 82608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236326, "uuid": "ead7ec23-1d7f-480f-980a-00a6fa2813aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236326, "uuid": "5592ded5-2738-44b5-9092-56e514efe9a7", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba69273-13b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772178413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178413, "uuid": "a3e270d5-c51d-409b-a03a-c766a848ae3f", "comment": "Malware payload (AsyncRAT)", "value": "01b57db0a8c70ce26680f27601617674", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178413, "uuid": "8edec835-e0a8-403e-826b-27534666eb9d", "comment": "Malware payload (AsyncRAT)", "value": "c91eeebe190c5758097978ce3748d86dc6f4ef3a8d0ea24ac2be1d87ae6af030", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178413, "uuid": "1197cba9-6c6f-4941-b89b-9952ee28adb7", "comment": "Malware payload (AsyncRAT)", "value": "78f87f75f97d2565326f5ced0ae9cee8c5b0d79b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178413, "uuid": "c22f5961-e810-46c6-8815-d0372bd349ac", "comment": "Malware payload (AsyncRAT)", "value": "d7ab6ec6e684e493c0bffb54e6692ae0ac37c98aa5122bfb438d640da28c4759513393e4cdf81df07747cb9f4836b64c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178413, "uuid": "d6da8a54-1b5d-4625-aa28-9c4e3538c5ad", "value": "T14B319D652BD90329D3B2CA3B54B5E3924A33B950E9738F8D4290D29C2C65600E836F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178413, "uuid": "4f96aea5-e5fd-4c15-8b4e-9d149c5cd45b", "value": "24:8VuJI5UmtJ1TAY8P5J+/2YyJi5iFfa4A+U/FIP4I0aA3yUUXQaR3+9h/LnU+Y+/e:8x+1FXJi5NNxfIPzXv3WzU+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178413, "uuid": "f2604f49-c9d2-46f5-86a1-6404080d9f88", "value": 1656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178413, "uuid": "713b8890-ed88-4386-a869-121dbd2756d3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178413, "uuid": "05b8e885-6ac9-4c00-8e0d-2775b45ca514", "value": "freefn.cheat V11.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52023830-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236325, "uuid": "8f6cafc2-c05f-4e1a-b6e7-2d392d1a195a", "comment": "Malware payload (Mirai)", "value": "856fdddf0efbf47ca918589f0ac48483", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236325, "uuid": "665262fa-0f9a-43ac-b0cd-dd440ef3f997", "comment": "Malware payload (Mirai)", "value": "caaa9c9e7970d2b215d718f14caf3e7a5af4c640b94dfafeb59fa5aa86dc6af0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236325, "uuid": "9e9441c0-e07b-4afc-95ed-099d9ee5502d", "comment": "Malware payload (Mirai)", "value": "b0315e281ad278f1eee1ca14ea5b09f7894f8b4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236325, "uuid": "4ee7cd36-286b-4902-b8f5-cdf527a2476d", "comment": "Malware payload (Mirai)", "value": "9b6fa63d86f6476ae5ad94de49fd1abe3d5fc485bd12a12c1796f137ec4cc438f5bb09d3121a72edd2e8fb6ff35e426d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236325, "uuid": "548bea2f-906f-4724-a352-ffbb437ece76", "value": "T1E8515A99037711712EB2AFBBB2A4C4067381D4AA7CD37A09EEEC3CB4499CE483145B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236325, "uuid": "45c521e4-4fa3-497b-8daf-c6d7451bc8ec", "value": "48:vId3IJMJWIrzsuIeyFlIcnoLIlFNJIGFGsvUIKoIX3IG8IndIz5DIMt:vId3IJMJWIHDIB/IcoLIlFIOcIKoIX3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236325, "uuid": "db10e318-d84c-4bf6-9775-b0b91f963648", "value": 2492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236325, "uuid": "ef967b62-192d-4c5a-9818-53c6a3698821", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236325, "uuid": "a62a716b-9c14-49fe-89f3-fb692e86b7ed", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17895df5-13da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772196284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196284, "uuid": "d70ebedd-83d7-4103-8a97-659f01831af5", "comment": "Malware payload", "value": "201cd971b55e0c16c6664be2087ced5a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196284, "uuid": "64698d48-bf36-4dbc-9be1-8a84826fe098", "comment": "Malware payload", "value": "cb9ae60f2b8c5cbc89dc5703c09dce596cf82836ef57540b78c45194654045ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196284, "uuid": "6315a5d3-a6db-4cfb-8a88-1dfbffd4188b", "comment": "Malware payload", "value": "19cbffbf976f98eed6489fce285317274068e66c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772196284, "uuid": "c66b9cf0-17dc-4f7e-ac62-5185900bf3af", "comment": "Malware payload", "value": "7f8fc09a2278413ae6d1de7e0918231d121f0a74976a3fc5352a7877706ad1b708ba2e48d3475e6bceb49dc7c36bce86", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196284, "uuid": "f361343c-db31-4091-b472-a64bb61258f3", "value": "T1E621BB7021F148731D541940F23727A6AB73D85745D3614C34DE2F39AFA7B03A5BE012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196284, "uuid": "86a2d2cb-d2b4-4f0a-9a23-867e75b54eb0", "value": "24:cnnRUR8fARVNvoslc9HHYbxtNuPl/Ha+iUyfEYul/HVeN:cnRu9RVJoslwnYbxaPl/BiUnl/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772196284, "uuid": "43243736-b2b1-4f4c-8208-195e1d7ffd08", "value": 1429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772196284, "uuid": "c86d909d-8d97-4d8d-82c4-67a3e7153df8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772196284, "uuid": "fd922746-433c-49c7-9bd3-dd2dfac13c4d", "value": "cb9ae60f2b8c5cbc89dc5703c09dce596cf82836ef57540b78c45194654045ac.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394930d7-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177872, "uuid": "96a5ceaf-2ff5-4508-8a0c-ed782b7bfd32", "comment": "Malware payload", "value": "dc8c5e7e5098cb6031e9147f996b99d2", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177872, "uuid": "809ade30-5be6-45db-aa91-85738249d0d9", "comment": "Malware payload", "value": "cbfc7dee55203a0bb9eef1451b065e817c079ef2d108d7e2b4b6739db4b4030d", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177872, "uuid": "83e97a39-1ca6-4dd8-a4a5-d51f569a7497", "comment": "Malware payload", "value": "80f1f7d33777ecdf193a10d6052bf1a065c9bc63", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177872, "uuid": "5d4c0895-d292-457f-be60-dacdb2e0385c", "comment": "Malware payload", "value": "7d0200c74f26b35c5e7b2b4f224dcfcdf249d5b211228f7be9cf384e72bf53d94e59c936297c532a482fb5886b5b0a08", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177872, "uuid": "75788889-5414-40f2-925b-ac5280e6e738", "value": "T1CBF2AD19719E860870B30B8C57AF02750B6F7A6F1E7E408941CDABCE8FE35119D967A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177872, "uuid": "5e6bac3a-0f86-4bbf-90d4-f094892d9044", "value": "768:lp31D2Dree3wA7Dggggggggggggggggg7yZGYEdp4QufYnNMgRHu:NUZsTyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177872, "uuid": "6a7f93ae-5663-47e2-b317-1c87c471bf42", "value": 37302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177872, "uuid": "18993147-c75e-45a9-ba8e-f337793ff6e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177872, "uuid": "ce0992a9-938a-4ebb-9f13-2be2156af98f", "value": "cbfc7dee55203a0bb9eef1451b065e817c079ef2d108d7e2b4b6739db4b4030d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986514f8-13ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772176314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176314, "uuid": "f74b376f-06c0-4cfe-8b90-b74d726488d1", "comment": "Malware payload", "value": "5193cfa0ca028e4eacb5ec7a8b3a6867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176314, "uuid": "a4a121f7-9dcc-44f6-a7cf-4c2bff25032b", "comment": "Malware payload", "value": "cc2e380a1688e913b4fffef3d4ff6d32d34e1873e1141820484f23d17d384700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176314, "uuid": "24d95ec9-cc5f-4a1e-8aad-ca19b020212b", "comment": "Malware payload", "value": "9dc8604a45e205f381486c32049fc9f9fa416deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772176314, "uuid": "f106b0e5-c7fb-4615-bc49-1f3122842f53", "comment": "Malware payload", "value": "f3a2853735d11bae8cedad323184f41262feba1d69fa7b265083fa12e87ceddb29ed933645c432eafca3fcd8d297da0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176314, "uuid": "580abae9-5671-414b-ad29-4be332bd9b59", "value": "T1D964B0D30646D6C4EEFBA7B990334E559365E417EBF991BCC9C3B5220BD228985E3803", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176314, "uuid": "95015693-9a9e-4e53-9088-53e25532d2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176314, "uuid": "ff53e7bb-fc25-47d3-b276-dc6ce7d59355", "value": "3072:SZV43upA25SgEFaQQWpK7Z1VuFxC9iU6LPs9:SZV43upcQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772176314, "uuid": "c0f08f37-fbc0-40f1-8c64-903273bfdda0", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772176314, "uuid": "6c026c18-8d58-42f5-9487-bed467b8f28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772176314, "uuid": "efd81a81-4f07-4cc9-bf6e-0280ef0dc7d4", "value": "Photoshop.exe.virus", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622fd379-13b1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772178800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178800, "uuid": "854967d5-2699-4533-9d1b-a71ac237cf7d", "comment": "Malware payload (AgentTesla)", "value": "7eb3f0ecb1037603470dbf4d527b03dc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178800, "uuid": "e7114475-26ab-4f43-b4fc-6b778dffcc27", "comment": "Malware payload (AgentTesla)", "value": "cccf83c3141436f65c9c54c82a9a03e7658e250df1cff95380600582e689bf41", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178800, "uuid": "122a38f3-f80b-4a54-9274-0388097a6ae8", "comment": "Malware payload (AgentTesla)", "value": "9af61936781a6567610dcbf49ef0a61fbd758d72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178800, "uuid": "8392e1f3-d7f3-4cc4-be60-793a91faaa9a", "comment": "Malware payload (AgentTesla)", "value": "30af160e96a124f45ffe7c55d0584a3b3a9caca977a34bd03f6e35b04c459eeaf7a9b3d36e42129d45ca0e8666d0160d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178800, "uuid": "f7c1a860-6295-4a2c-9585-fcb90d5de05b", "value": "T12231AE652BD90729D7B2C63B54F5E3524B23BD60E9739F4D029092DC2C65600E836F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178800, "uuid": "b773bbfe-2251-48f2-96de-4c9ac2a7a8f1", "value": "24:8VuJI5UmtJ1TAY8P5J+/2ryJi5iFfdKy4A+U/FIP4I0aA3yUUXQaR3+9h/LnU+YH:8x+1F8Ji5cKyNxfIPzXv3WzU+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178800, "uuid": "8bfa9e40-f11d-488b-859a-7eb3559cdc57", "value": 1722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178800, "uuid": "6ae8eccc-dd43-4fc7-b3c7-4630b9a41c4d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178800, "uuid": "9ad10fc3-46ad-4214-bda2-c0e92c914946", "value": "RankupServiceFreeTemp V11.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8c7366-13b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772182070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182070, "uuid": "2aa57740-d65b-4e41-9f45-f66b79758f25", "comment": "Malware payload (Mirai)", "value": "e2f3076721a957569d8a2a3b8915585e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182070, "uuid": "2cdf671b-1793-43ec-92aa-9ac29b0d9e7a", "comment": "Malware payload (Mirai)", "value": "cd25915552a5845b5d14e39d791c39f199dea8e3abe15dd4660298e9692234d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182070, "uuid": "b5b5fb96-a2f8-4e86-a76b-e2fd0603e045", "comment": "Malware payload (Mirai)", "value": "ea1a6985f44ac9494af2bbd04cc13930b99c607e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182070, "uuid": "613956b7-4b64-4d20-b3eb-2d9f423cb82e", "comment": "Malware payload (Mirai)", "value": "82cd345977ffd1d00b39da4820dbe36c74adab67fb2ed19d3c65e2056c2019e960d6f4ccee58a26061b54fdc1a55d4e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182070, "uuid": "70515acc-2020-4a3c-a757-946349a6951c", "value": "T140E34B17B5C194FDC4DAC1744BABF53BAD32F1991238B26B27C4AA261E8DE305F1DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182070, "uuid": "47f34b3a-3873-4d21-8807-3191002627f5", "value": "3072:2XK7w433c9QwvffU28ykhhMEzawjtH4g1lNCuzjkPd1oGBhve:2XK7w433c9Qwvffv8PRVOkHk1Lve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182070, "uuid": "ee1a6dc7-8d2a-41ce-9cdf-2276043614f0", "value": 152104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182070, "uuid": "fd158f7b-472a-4f00-8057-42f02699757b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182070, "uuid": "a60d7c31-39db-4dc8-ba30-e8e3b81092e8", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632481fd-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179231, "uuid": "b6952527-f723-4e56-99bd-dd01828cafbe", "comment": "Malware payload", "value": "1d5273ba7f1b28f4d723377fb9e2a0e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179231, "uuid": "1c883db2-7e9a-47f5-a9bb-6508a4ba9ab7", "comment": "Malware payload", "value": "cd351b01a774787db1d60071edda6851909e7c6059bb65e943e860e8547ee987", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179231, "uuid": "52c39106-a926-43e0-ac02-0061f8d965da", "comment": "Malware payload", "value": "360e4fcb57026c862587e2ddc982b34dedc63a1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179231, "uuid": "58f81804-7069-4d79-b4c8-69206f4f1f1a", "comment": "Malware payload", "value": "6754ae21136247ba4c94aeee414f82591258837e5cab366563639588281dd2b0b1a3efb4de192e191565708b33bea7cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179231, "uuid": "5a1aec7c-3566-4e0b-8fa6-b5738ea469cd", "value": "T1E7C4C8DD2EC2F69E0F42A937F20AF06DE8F448F0536A4C69A0DC6C48F8912D5ED51679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179231, "uuid": "32f4e18d-a8ff-450e-b840-8f7a6e977000", "value": "6144:mgu94h2KRDGs+wJLLpCJFxSSlBpzhOwbb7dwyHY8xOTDvT6iP+JgR/I:jh2/bwJLLwJFMoBvfJw6HOX92JS/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179231, "uuid": "551e2fd8-7525-4e20-bef9-c0a27b83c51e", "value": 565563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179231, "uuid": "ec0982e8-8e0e-4f54-8458-a1ee296214fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179231, "uuid": "4a7c083a-c477-4d31-8123-80a85b3cb7a8", "value": "QUOTATION2026115.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d8d01e-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772211525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211525, "uuid": "7d697ed9-3114-4b16-9ee8-89e56348a404", "comment": "Malware payload (Vidar)", "value": "f9fce1e03c3e5521122d20b33542a27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211525, "uuid": "bb95ee59-629d-4092-b0c6-eda0d96873c8", "comment": "Malware payload (Vidar)", "value": "cd4bbd671e59dea7aa3602e403326169e81ad4ba81523ff7d519666ea7eba954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211525, "uuid": "c0126825-9abc-4541-b7fa-9b044ffe3dfa", "comment": "Malware payload (Vidar)", "value": "f142398d76ee21ab7231a7524aaec704452991e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211525, "uuid": "f189427d-39b4-4eaa-a7f1-a45a69abd55e", "comment": "Malware payload (Vidar)", "value": "2622a990c2d85aba992c52350b607967b12cf144ffdb8ae68aaade2fafd51e640926a4ab721801bf2027fc31314976e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211525, "uuid": "04a474cf-43c5-4fc2-8a0a-c6d658c96209", "value": "T14A2422C7DE5ADF43EAAB053200276B5EAAF05E7F4FB4121D4C3B93AD4196C6214BA704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211525, "uuid": "6c6b54c1-2e33-4dfb-a5d1-118f4a39a427", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211525, "uuid": "b2b20aaa-a76b-4bd7-87b8-4afc05d7f962", "value": "6144:mDUozo0qBbeUZSIzEj4heP/6JvQt0heZ:GtF0SrIg8heP/84aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211525, "uuid": "1ec84d1d-52be-4875-8af0-4bfe160c67b3", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211525, "uuid": "f2b4593e-29e6-4903-8ac6-d0104d04f523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211525, "uuid": "80090221-ee4e-4a74-ba72-7710ff9e7d37", "value": "iXSdtjb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9504a9c9-13cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772190052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190052, "uuid": "28e128a9-8c0f-4491-ba39-337fba0f4dd6", "comment": "Malware payload", "value": "6c62f85cee38e0bfd47823f4503c731c", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190052, "uuid": "b5c70285-2989-4939-b614-523691c09285", "comment": "Malware payload", "value": "cd973f4aa8d847341e0aac04ca5f4c2e06ae22a8e5ec7dcdbd0d281f3dbc9cc5", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190052, "uuid": "55707e29-34e4-4bb7-828a-a068ee70bfe0", "comment": "Malware payload", "value": "861879c65a98255ff9103dbb3245af24441eae94", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190052, "uuid": "95c220a0-ab36-4289-bec5-6dcebea34830", "comment": "Malware payload", "value": "cc4b414a167ed2927872425107282e462173103e0f5cfcb7a88c2016e729692ee1a52abdfaeb333068cd7fdd06d7caea", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190052, "uuid": "d72eec68-3fb8-4dc3-b486-5aab8f006afe", "value": "T1FCB38C4267FB0148F2F36B486ABF45744AB7BD55A939CA4D419C684E4BF3A00C861FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190052, "uuid": "5c002991-2c51-46bc-b898-be79ebe462f7", "value": "3072:bCrhYf01z32f0nCkmlfrbAMhrlr9jWTxJAJNegKPY8gI3QicEFztD+UahePwKZ/C:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190052, "uuid": "c3dd208f-5ac4-4b9e-8e32-b75bba946c5e", "value": 108650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190052, "uuid": "4da43622-fb65-41b3-ad3a-871ba2bd8fe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190052, "uuid": "69b5c95c-2742-4e6e-8d6c-79a19ddabed7", "value": "payload2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f527764-141a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772223758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223758, "uuid": "59d41ace-f69d-416f-abb1-94aa00aaa9a6", "comment": "Malware payload", "value": "fad85fa485164eac374b2369de0ce4e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223758, "uuid": "e03eeea6-fb90-4b84-a13f-746280423405", "comment": "Malware payload", "value": "cdeeb067e932558071b0ca6e1c52262c5e9b531979a21fed1f79dce44eb50d9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223758, "uuid": "dddc5fad-2ee2-4a93-8643-c73c91ec0187", "comment": "Malware payload", "value": "605bf07e82fad3d1311e05a4c6940669ec281be7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223758, "uuid": "811e181f-7e59-4f41-9771-e7f348efacc8", "comment": "Malware payload", "value": "9e0ca4584d5387a4a3ea03e812db3701bc9257f4d99f95d406ec8e9eb5c069b65eb6205ce8d05dd5fde8f86144e92ffe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223758, "uuid": "15e974bd-e942-475f-81a7-d9bc1f840c44", "value": "T130E020AB427104B57F54545B3777EE80B44C30319445EE4D60DDE6A4468D64C7343A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223758, "uuid": "e962f275-1a61-49c5-bf2f-c23d22bf571d", "value": "6:hrC1jlB0y6dzErbeiOnFfljMbBSfW+1TJ7Ld+1T858/AqFxFXw9d:ZCtMy6dzEEUs++PLd+Y8bFrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223758, "uuid": "01b513b6-1e77-4c8b-9b9c-7a481ebbea07", "value": 339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223758, "uuid": "da5754ce-9a2e-43bf-9a8c-813b25490357", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223758, "uuid": "ba396e62-97d0-44bf-8933-e2de1879ebb0", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7048c3bf-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223921, "uuid": "5ee58858-601a-4adb-af6c-0f5245363c0e", "comment": "Malware payload (Mirai)", "value": "b93a79854b9c7c4323bb9019fba30923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223921, "uuid": "b303c016-0b77-42e1-a5b2-9a485881a0c2", "comment": "Malware payload (Mirai)", "value": "cdf30a2045b791d262f9e6fafd95bffc5e7290cd0ab8a64667a64c3e2d6a1b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223921, "uuid": "bd7055e1-f6f1-4281-a557-f06f2aedc831", "comment": "Malware payload (Mirai)", "value": "dbcd77a050374b11349653061e4ae60fc3a5ff01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223921, "uuid": "9510f516-5c6e-48f8-8947-f7440dc1f374", "comment": "Malware payload (Mirai)", "value": "4b7f0486018bc178f0521693a2cdfd91395e604c370e693974cd2ae835fcd65374e24437619cae4cd92d68589a1bc0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223921, "uuid": "fd517faf-f808-4202-a3dc-b19939d12cea", "value": "T1B253F1D2A080E1E3C75A06BB6694D847FF551BBC69DE306A39798248A0D2D487CD7EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223921, "uuid": "29ff8631-3e81-402c-9824-7b402e85bb18", "value": "1536:zVQSmwtMJXmejtPfCLTM5Tfv83KJ2crl2EWQ:zVywt8XZZKLgTX83KHl2EWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223921, "uuid": "40e66488-d114-4de7-9b67-f7a00bfdfb13", "value": 61844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223921, "uuid": "0c810367-626e-4c2b-b5ff-2c8dd698f0f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223921, "uuid": "77f32003-3cc4-4121-8c98-2c4991c5150e", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f79efb9-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223919, "uuid": "23a09b70-fc1d-403a-9780-532e3c95a05f", "comment": "Malware payload (Mirai)", "value": "326c251edc5bc8b2b2e2a38657abceec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223919, "uuid": "ea11cc50-6468-48c7-b473-1157ef3cebb8", "comment": "Malware payload (Mirai)", "value": "cec5f8634be78a5ffb625c7ebf9b7692740b4391f5ad3aaf93a784daff522edf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223919, "uuid": "01faedcd-e606-4e93-8c16-44a473254ae0", "comment": "Malware payload (Mirai)", "value": "ca8fe5064028f9117034ad201b61a79461396172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223919, "uuid": "de6be73a-7e27-45cb-8853-d7de493cad92", "comment": "Malware payload (Mirai)", "value": "e2b27beb8196012dff51e3b2bad9d0af5afacfb73f12fa174b38ff2356c90ab1dd346a148420c96b9a9a97f2cb44c838", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223919, "uuid": "de81bb84-ea11-4405-82c5-1d436ff55990", "value": "T131F2E043C988020FE47E1A354CBEB38E0A91E55DF9C4B8A759F170774812B1D6E5DB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223919, "uuid": "0836b5d8-2392-472f-983f-c51d1c53b95b", "value": "768:mzbGjwng3vdO5994SKAT1M1bVnykwtYcCrV53hF8sfGgVw4nbcuyD7UHQRjE:WdnA4994SuTykwKcUP3vw4nouy8Hy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223919, "uuid": "2b81033a-e439-499b-9533-0d26dfce3dec", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223919, "uuid": "d7d5759a-2b65-4166-bb3e-2705aab70716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223919, "uuid": "b8776b15-316e-4e6e-9141-b5f30e0b5a80", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78946836-140c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772217922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217922, "uuid": "d6854f49-26c8-4d6c-867b-cb6e56e074dd", "comment": "Malware payload (Stealc)", "value": "dae7ea07675741e0291f8877a01124c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217922, "uuid": "fef224f0-a4c2-49b1-9201-1952f0cbb947", "comment": "Malware payload (Stealc)", "value": "cee05a00aeacfc794aebc293a1c03bfc93b05cfd8d7da0d2a8a2d792894fc3bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217922, "uuid": "5e02f2c8-f611-441d-aa7d-4c359b08b5e0", "comment": "Malware payload (Stealc)", "value": "99c397419622a1c47c02eba0b7749fcf8c1b6b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217922, "uuid": "0edd4b8e-59c6-472c-bda5-d84f36985fb1", "comment": "Malware payload (Stealc)", "value": "851cb072fd67dba7143cbc41b503d553097036eb51ccba562ac032ded4ae1becd0449cab454d2bddc8c3d3dae0aa35bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217922, "uuid": "aad997be-a89b-4e5e-9d8b-fe13aebb9074", "value": "T17DF48D5AE7A502F9D0BBC178CE424553EBB2B8155770978F03E10AA61F372A06F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217922, "uuid": "a6ffaf9b-bf7d-4554-a7eb-aaa671411f2c", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217922, "uuid": "a4b50b40-86b6-42a8-b088-956547c67fbf", "value": "12288:JU8VHX4ZPBuvzkOkW7UE+YTRqwJ4rO6ALSQTbAK4lVA:5VH6BuvbkW7xXVVmrOzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772217922, "uuid": "1840d752-78f5-4753-98f5-c34e88876986", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772217922, "uuid": "370aebef-524e-429a-bb68-e1145a364ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217922, "uuid": "397e14a8-29df-4e97-a998-cfcb105b55fa", "value": "cee05a00aeacfc794aebc293a1c03bfc93b05cfd8d7da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29cec40-13e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201671, "uuid": "0b3b3b95-cbef-4686-8eff-3707b0a9b737", "comment": "Malware payload", "value": "e89c97793cecc0288b0c56d404b90e7f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201671, "uuid": "cac00b68-d5a7-4084-a022-b98493470883", "comment": "Malware payload", "value": "cf7187570cfaebab52d02fb4ea128e415604b32c7654c9b94e9b9a33745b038d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201671, "uuid": "a58273bd-8114-4be3-ab96-a4b3b4d8454d", "comment": "Malware payload", "value": "2253739b8ed97ce04e31ac7f2e131017d282f783", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201671, "uuid": "7fe4aef9-5597-43ec-a224-26d1ac2dd4e3", "comment": "Malware payload", "value": "275a59eb852ca76140f1710d305ffc95fc80be916a88a7778b4ec456fab3744ade90ad8593f993a1f11d4b7db34a77ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201671, "uuid": "4e0e6e9d-dd40-46f8-a102-19cb3e0579b5", "value": "T11E62893721F08B3397D055C4A3771BA54FB6A61B456720B8F4FE1A259F1AA0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201671, "uuid": "60055dab-91c8-4c4b-865c-8020ec7374b7", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6mkQdG/NBr+E+C+O/:cCu34hvZ5m5FG4j4HKNphvUZ/lxuP+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201671, "uuid": "d9c2363c-c7d3-4319-9e12-4446606c2866", "value": 15894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201671, "uuid": "bd442584-1f87-410d-9ba9-44f1df945cfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201671, "uuid": "bc1619fd-f7b3-4503-85e2-2be84d1e4fa4", "value": "cf7187570cfaebab52d02fb4ea128e415604b32c7654c9b94e9b9a33745b038d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9772a9e9-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772178030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178030, "uuid": "b379dfd3-bcb5-439e-9334-e8eb5876360b", "comment": "Malware payload", "value": "4356cdb3d2d70869f23136402dc199e3", "object_relation": "md5", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178030, "uuid": "1e059a1a-c2cd-43dc-a2d6-b121130ec72c", "comment": "Malware payload", "value": "cfb097c7fc50e2d0b4b402970921c051f4408974345ffc7e511f445eb9dd4784", "object_relation": "sha256", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178030, "uuid": "e99da79a-04a1-4cd1-9086-03c22bb7b3a5", "comment": "Malware payload", "value": "4af59f64baedba864008ec6fe475095173be2e4b", "object_relation": "sha1", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178030, "uuid": "a24aca73-0654-4b73-ad2a-12a65a9f5e8a", "comment": "Malware payload", "value": "9c9c22278914f003da081ed30b6a10098210a9184d23674349e20b1f06a3d0b48fa2105ce4ff9c4d6bc60c52a0e5f7ea", "object_relation": "sha3-384", "Tag": [ { "name": "1031taxology-com", "colour": "#6E8ABC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178030, "uuid": "5e825c2a-1099-45f6-93a1-941b87c24227", "value": "T1DBA25338614F8C9CB47173B7910F7F95D4E27BAB40428402748A559E2B605AA1BFBCFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178030, "uuid": "864ea6e3-35e0-4b69-872c-9d9bd0e519db", "value": "384:9Ekg2VCcnnalokNkrkQokNkQokNkQokNkQokNkQokNkQokNkQokNkQokNkQokNkZ:9pJzoxzxzxzxzxzxzxzxzxzxzxzxzxz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178030, "uuid": "5b7ea72e-423a-490d-806e-dbe0437c9914", "value": 23099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178030, "uuid": "380e8c71-1d57-4db4-b46a-4f77f5967128", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178030, "uuid": "bd744da2-12a7-403b-8e53-1dce6de9e4d0", "value": "cfb097c7fc50e2d0b4b402970921c051f4408974345ffc7e511f445eb9dd4784.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e5df73-13d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772192491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192491, "uuid": "b80311c7-5140-49d4-815d-eef8eddc04e6", "comment": "Malware payload", "value": "db619a640c2b1d4ac541ded7b10d5ef7", "object_relation": "md5", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192491, "uuid": "3e156377-9de4-4b7c-ac91-6f2493ce254b", "comment": "Malware payload", "value": "d0325940ec6f08e4dc556b4d79ed5aeb1f15f65dfb58e836c8703830452ff003", "object_relation": "sha256", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192491, "uuid": "46c2e5a9-ba1b-4865-a476-caf0560fd06c", "comment": "Malware payload", "value": "f343f05b1e61888dfffff18aa4d8dbf7473deb0c", "object_relation": "sha1", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772192491, "uuid": "d249e676-2720-4cc0-a0dd-5387dab86f63", "comment": "Malware payload", "value": "07af47f4e47f13d0a23173c381fef9b94b2786f7e1ec15a5cff35cd88c453d5b07f79594426a68b1e739d431afc568a7", "object_relation": "sha3-384", "Tag": [ { "name": "bot8705156458", "colour": "#46332A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192491, "uuid": "4c868a73-722b-42f8-8da1-59f55b8b258f", "value": "T1ACD5AE4573C05AA9C056EA358727E632C1B2B8124BB6D1CBBD9AE70D1E73F814F39B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192491, "uuid": "5512c013-b020-4a20-9faa-54c8c6e4f8c4", "value": "2ef23627ba09baefb285e9cc90b8256d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192491, "uuid": "7eb36247-c696-41ce-9909-3732d6efc68f", "value": "49152:AXF1o+bmvvvvGGGsSXDa2zeNGnyEprRBQ7fW/bM9bRgne7sh7FsUbCtrfFZ0aLi:kFbUayuBQ7fW/bM9bRgne7sh7FsUbCtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772192491, "uuid": "ee47f447-0621-4ecb-a093-ea93cab16acd", "value": 2773504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772192491, "uuid": "534925c8-fecf-45dd-8937-b74e0cbefc79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772192491, "uuid": "742115d1-f0d5-4710-8a08-61d8adef3c90", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551431b1-1381-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772158162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158162, "uuid": "40968582-4f2a-4576-82ae-6e3bb5b8e7ee", "comment": "Malware payload (Mirai)", "value": "0e78c17b714c229f03cc2d572934baed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158162, "uuid": "99003b8b-4dc3-4b30-ad98-ffbea28117c9", "comment": "Malware payload (Mirai)", "value": "d0d2a62f0d69409b4e2b4e728aa4ac05a1f9a001443783ad633cf4e840cb346a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158162, "uuid": "7ebd3da8-1846-4d37-be61-2256edd05ed2", "comment": "Malware payload (Mirai)", "value": "d64377f463a7cbbd261a4203e562e094efbe6f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772158162, "uuid": "da5ddbc0-4680-45b2-ba77-e43482f138a0", "comment": "Malware payload (Mirai)", "value": "9d52cee60a9e054d35a50d14d209ab0d5cde6ccc08be143d87d5d7dcdf875a8f07c2b713cc3835da351e7eb2bb73dbdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158162, "uuid": "dd16ceef-4f5c-41f8-8acb-5f41386e1442", "value": "T1B8D33845B9829A27C5E123BFFA6E018D332563E4D2DE71178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158162, "uuid": "9ea586ba-3cbe-4505-9a83-ba41b224c0bf", "value": "3072:snFif7apx6XS+kUgpjWXlsmMs0u29wzulziQSS:sn8ZS+dQWXlsm5s9TeQSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772158162, "uuid": "2a4c9ba0-b04b-464f-b646-25d098785ad2", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772158162, "uuid": "cad312a1-c9a7-4dd8-aeb9-c0aa92254a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772158162, "uuid": "c79309a4-e132-4146-9f86-84c8f6bc6623", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c534b3-141a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772223900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223900, "uuid": "7f3ee816-03e8-4a97-98c2-ee60f5431cd5", "comment": "Malware payload", "value": "7f1e54e476355ae278575b43b4813246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223900, "uuid": "e9e2aa41-52a9-40d7-b913-dcf0d11e7c7c", "comment": "Malware payload", "value": "d11c78727a857e783f6d85f276d9785239f24cb9546c2accdc38deeed5fd537e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223900, "uuid": "e3fa0309-c369-4e62-8849-05761ac0cfe0", "comment": "Malware payload", "value": "a7aaf1847704ee91f9ebfef75f62ff3223ea6e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223900, "uuid": "550ca1ac-de46-4a1a-963f-5ed3fee99596", "comment": "Malware payload", "value": "b60ba1cf0ca1de55f721864168a6ee37d9fd38e3e970b5d68c70f2e7fcd3be7eef46b97e7d9a68393f89cca565fcc41a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223900, "uuid": "6e496130-f36d-4d53-865b-121c3ec3b3af", "value": "T1C676D013FCA169ABC0A9A23189765292BB71BC052B7023D72F50F7782F727D4ACB5744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223900, "uuid": "1e98e32d-c4db-4a6e-8604-3687ec197b85", "value": "98304:cm6bIb1zvOQXes5DMAFu8jMyrg2b+eVcFq4rViu6oH2LlQjZXJXX6Q7FXhhfH:cx0wrUD5njXrD+eu00Vf32lQjOQ7hDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223900, "uuid": "24264c90-043a-479f-8250-71c7837feae9", "value": 7164493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223900, "uuid": "b2ad5334-552f-4394-ae05-e76d2c2c25d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223900, "uuid": "c07703fe-75c7-4ae9-81bf-1630f244e340", "value": "x0j0qsyma.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56002a91-1437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772236332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236332, "uuid": "1738324e-54eb-4784-9ecc-699b681718dd", "comment": "Malware payload (Mirai)", "value": "4e0b2d6dd7f2533eaf01a1bfb39fc102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236332, "uuid": "1037e4d7-d6fd-4db9-8c04-6dde98f27567", "comment": "Malware payload (Mirai)", "value": "d21846945212a64a6e921718a883f68689456108c97d70a09fc6cb058abc5bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236332, "uuid": "4ddc0a6e-b25e-4ed1-951c-1727b5fb1d31", "comment": "Malware payload (Mirai)", "value": "cb25c7c80f99ae1222828aa1abe53d4882ed7c8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772236332, "uuid": "46f7bdf1-6c18-47c1-a908-39c010799ce5", "comment": "Malware payload (Mirai)", "value": "39be72c87fe3e74c07916c9728f110a5117e02ce24f4adcf078fd49f83be8986d252fb233fd95f88b2786debbc9e7e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236332, "uuid": "5c10706a-e07d-4fee-8398-ac98d5c5e439", "value": "T183737DC0A683D9F2DD02467030B7FF329A32E2BB1156EAD7E3D89573AC51502E507A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236332, "uuid": "0f4f4eb9-3567-43ad-859f-8a0a42c68eaa", "value": "1536:B4NGZbUN0cOrmE2H4Ay9Y2NVYuZ5GDbf8EJ60qSLZu:vgN0cOrmE2HyhVYccDrJJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772236332, "uuid": "d459767d-0a8a-4d0e-9c26-964ef9f6c42a", "value": 76500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772236332, "uuid": "ae2d83a1-ca3c-4301-81ec-1ed19d96ce95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772236332, "uuid": "c0a8b8d2-d75e-4ae5-8bc9-47ab61806924", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce8f954-13b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772180858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180858, "uuid": "9a3a14f4-8912-4c1f-b1a4-5e0219d7c2ae", "comment": "Malware payload (Mirai)", "value": "047bc6b7fa31078739a6b62d5250da77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180858, "uuid": "549e93fc-0cfc-4f4c-9357-25fe974b3ce0", "comment": "Malware payload (Mirai)", "value": "d21a18bb2bf6195c81274399d8218bb0890a6a7531ccc133b2ca910676f802fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180858, "uuid": "839d2512-4a58-4c68-ad85-00a790f9339b", "comment": "Malware payload (Mirai)", "value": "4b0d4b245f7e9f3d44e8e20242344ec0aa16f545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772180858, "uuid": "ca0442e0-e39b-499e-9222-f200c8da4f10", "comment": "Malware payload (Mirai)", "value": "382daabcb0eb26ec48420b3a4748e1bbffc9abc2aa0408907344537e4094235b8aa94508a33017408f3be67b719a92ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180858, "uuid": "47dcc905-6cb3-445d-9e5d-39b71afd4ba0", "value": "T1E2A35BD4F383D4F6E85701B02136F7339B32E0765229EA53D3A89A33ACA1541DE1A79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180858, "uuid": "271be208-1e9f-4b89-ab76-a132aaf8e988", "value": "3072:r2uqDep2ABzPY3pwvwED0vZsLJfqf58b0SdvY81:r2uqDewAJPWpuwED0B83vxY81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772180858, "uuid": "dd08f5e4-5de0-4614-879e-d349e4882913", "value": 103180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772180858, "uuid": "da37e5b1-a122-4580-98aa-ae709f1e3171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772180858, "uuid": "df2323a7-f438-4b8e-a011-cf3887286223", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815b99c9-13b8-11f1-a769-42010a9c0008", "comment": "Malware payload (GenesisStealer)", "timestamp": 1772181859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181859, "uuid": "401d29c6-6933-48d3-a1aa-f09ef92d0586", "comment": "Malware payload (GenesisStealer)", "value": "09cf1fddb08051f5be72245b00638358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181859, "uuid": "c087bbbe-f7d7-44a3-a9dd-5c2ac7d0f8d4", "comment": "Malware payload (GenesisStealer)", "value": "d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181859, "uuid": "beda8dec-7c64-43a9-8a29-b84951833e4c", "comment": "Malware payload (GenesisStealer)", "value": "8c2a397e0d7a1eae7793b0b06d40b175999de58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181859, "uuid": "46bec2c0-dadc-4d8e-a46e-e0d2ce7a8d21", "comment": "Malware payload (GenesisStealer)", "value": "e36b2326358e4fba8884ccc1e0864816317eaf426ac37008ee942e554dbdfafbdc30c5c08def1a8d9f5a8cb091e1d016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181859, "uuid": "96c1c553-29a5-4ff3-ab86-cab16c8f42b3", "value": "T12D1833577DD1FAABC04DB37A97F5F27414E989827F522B3B4202C59B71B8D842322982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181859, "uuid": "bef57a85-f44c-49e5-8977-e09720bee8b0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181859, "uuid": "c17a1897-30b0-4373-995f-94ca960ca074", "value": "1572864:L7+BWMFDe45kuObGJz6hDRz7PMqjJTlLMOJD2Z13nYcxWqQ0OQhw7lO2c:LCBFle45ZOjhDRz7RjLwSab3YFQmp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772181859, "uuid": "f9f8210e-77ce-46d6-9793-5f09e68ec021", "value": 88745878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772181859, "uuid": "61501555-dfdf-4b77-b297-225da5579af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181859, "uuid": "39301f59-ad98-49ee-80e3-6303ce1c8fb9", "value": "CyveraVPN Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a05b2d1-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179645, "uuid": "6152fa72-627a-41a0-bd7f-177eeb9e8a14", "comment": "Malware payload", "value": "b67530ef2420d45ff61b27e609d1e6cf", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179645, "uuid": "da9dd2a9-9ced-4ee9-8cd9-419a2ffc4f57", "comment": "Malware payload", "value": "d27d9f1ab137335e307a29e4bd5700fdfc2b694fb4e84d4fd9e72c3639af7ec7", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179645, "uuid": "fcf653a5-0d57-4f84-b475-bae8e070bea2", "comment": "Malware payload", "value": "a12032a48117e1e276b7e083563bfb92092e16a5", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179645, "uuid": "51985237-5014-49e3-b201-0514dd9a722f", "comment": "Malware payload", "value": "056c5fc89d7666fda6e635551ec0b2fa83d91791c06ee414bbd4bb5d0f05be681815b8565d0ac50dfdac0f0d4d479662", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179645, "uuid": "dced9fd6-2a2f-496c-b139-b306e47ece93", "value": "T136B33C1637E1447FE4AC9A31D422D3D0017E775A6B933F0B92424E910EBDB85DA28BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179645, "uuid": "2a40997a-5f62-4f18-a8b8-bfb50e0dade9", "value": "3ef10934d629fc28c006784a1ca1e57e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179645, "uuid": "1ed4b38e-b63a-4450-98ec-be7c66cc5966", "value": "3072:RZZ1MJnaZ4TAcbF/als3tDvwnhrzR6QAyJy:cZaZ4P/UKjwnhnR6QAyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179645, "uuid": "2823523d-578b-478a-8899-da58c787161e", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179645, "uuid": "80f5ae51-7b9a-4e71-b58f-1869f441ecfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179645, "uuid": "8d9112fe-f8e0-40f5-8705-1b7b28e86a55", "value": "d27d9f1ab137335e307a29e4bd5700fdfc2b694fb4e84d4fd9e72c3639af7ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2758edb-13cb-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772190155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190155, "uuid": "c6701e68-fcf6-4191-a48f-44fe1a557675", "comment": "Malware payload (ConnectWise)", "value": "b1d8971ce791ca7167fb4a219409fa66", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190155, "uuid": "d34be8d1-6ddc-415a-bf09-e504b78f7810", "comment": "Malware payload (ConnectWise)", "value": "d2859d74989e1dcd447b3c9799b5507aef69e3f7b3a38751b0a2c88ca124432a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190155, "uuid": "6bb99520-ddc9-449f-9d01-c22aa2f0a4be", "comment": "Malware payload (ConnectWise)", "value": "ee1ff81425d40034330fdae45f81f30ffe27558c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190155, "uuid": "84071f61-ffa0-4143-892f-a769f5328914", "comment": "Malware payload (ConnectWise)", "value": "8a93799985500a044354ecde9b886e2244c59b6a2d01ae2c762b59016e69e4e4b1c57195da51c761863f7d7624c78dd3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190155, "uuid": "ad33f553-30d9-45b3-935d-ba76e6d2b934", "value": "T1B8F6230463FCA109F1B72B3AED3A56F15C7A7C228D62D15E1658364D1AB0EC19EB2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190155, "uuid": "a425d75b-6589-41fe-9172-cd15109777bb", "value": "393216:kmkEdt03NldFmkEdumkEdqmkEdCmkEdhmkEdpmkEd:sE7cx3EAEAEYEREtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190155, "uuid": "b9290289-8dc0-47a3-aa58-0cac3fecb46a", "value": 15298560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190155, "uuid": "cc54a4bc-ca98-44dd-9ae5-51dcfed8981c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190155, "uuid": "0ab7d263-d823-459d-8437-a745cdd1dbc8", "value": "AcrobatUpsdate.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa21fd7-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155594, "uuid": "eccaaeb9-70e5-44c4-89da-98c3cb2a089d", "comment": "Malware payload (Mirai)", "value": "10516069bc241c566e2a812112a3844c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155594, "uuid": "421d1d35-5ecd-48b3-ad11-d6564abcbf1d", "comment": "Malware payload (Mirai)", "value": "d38c1df45304f7eeae94d436ba660601251cacd112c2e375f0f97e91d6c3c4be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155594, "uuid": "35e74d1e-d670-4db8-8f1a-16823095be0e", "comment": "Malware payload (Mirai)", "value": "b94ffb8a1d3eeac012ec792e68009edb07233dc8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155594, "uuid": "f3398cca-aaa2-46ec-948a-bade7b7e7510", "comment": "Malware payload (Mirai)", "value": "0ef6a42ee1d1d621daa8f69d9ebda71a45c58ee96756087bcc495ecd392d46db4104e5cb2f9b5e5769a87a6f28ce37ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155594, "uuid": "ba849fe6-4c04-4b2c-9131-3d594093a9cb", "value": "T16731AD9246227E7C3CC661D9F1AA4095B045825F15FB6F7474C9AEF91B0D040F268FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155594, "uuid": "b4f43398-90cc-4057-8c31-e0716e632318", "value": "24:VUeYj+H13UbXDMK9CFdYhEnHQ6Yl60mOD+nl72tg2UbrIJLHg9I5TUb7UbrRLQZl:VUeYj+H1CDMK9CnYhEK0U+Eg+yjSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155594, "uuid": "884fd99b-a8cb-41ec-8f6c-71791a826cb0", "value": 1577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155594, "uuid": "a571a2d5-e408-4620-bc05-e0bfe617a6ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155594, "uuid": "e59e8989-5515-414e-9b6a-c66b4f9d2b88", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fffe8c-13df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772198675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198675, "uuid": "ffd8e578-1db7-4462-a284-e528afd4fd4b", "comment": "Malware payload", "value": "f8cd6c86612decff1bc2d716cff36c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198675, "uuid": "ea0b6d40-7457-4537-b415-4ff7655b9fa1", "comment": "Malware payload", "value": "d4b79a3948c105effecc4292facee0106645f53dcb0960b6858977b5643f1290", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198675, "uuid": "4e9ff74a-32f0-4339-a30a-3d09699f3541", "comment": "Malware payload", "value": "105f106d18174db19ab5bbe4444f6dc8784ebfc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198675, "uuid": "d35c48be-dbb0-495c-ac2a-94d11ce80dcf", "comment": "Malware payload", "value": "37638f105e2acfe40aac2f3fe3cf5039b804a214bf8a06b55600e285d4b0fe608cb04910300fc5a7ec51c16f73f8ef2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198675, "uuid": "67d20da0-fcd4-4f10-9ab0-71fc6a5eb350", "value": "T116C423A6D8ABC6C696B3F73D8440CEBE6927117CB946210BE51CD2B0A50D93A1F4F532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198675, "uuid": "024ddbb6-9917-4c6e-92b5-89eceaeacb2f", "value": "12288:NjuxpD7EW9dVbz340Wy3w903mEp8LCNqfpdr+XSpbbP:dO7EQb5XgACLCKdjpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198675, "uuid": "dd96b36a-0a11-452a-9a9b-e77e102f6a08", "value": 562792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198675, "uuid": "ba7b6d5b-c3fa-41a5-8abd-dfed5819264b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198675, "uuid": "35809813-cc8e-4473-a1ac-7885658eec88", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ec07e1-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772211696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211696, "uuid": "9fa7711e-d89a-431c-b1c8-ce6333108d65", "comment": "Malware payload (Vidar)", "value": "31f806662751b5d04144cfcec93cd251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211696, "uuid": "124472f8-96ff-42f7-84fe-8089d4bee89f", "comment": "Malware payload (Vidar)", "value": "d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211696, "uuid": "a0f52dec-eb4c-4c6f-829c-5da5ba1558c8", "comment": "Malware payload (Vidar)", "value": "27f04e55516170d95f8767c989d9ce60528ddcf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211696, "uuid": "a212de19-84bc-488c-a34c-4ac3320bfb7b", "comment": "Malware payload (Vidar)", "value": "dd203591191ae57d59c35c71fcd9d430180fe4d720a4901180c09d9595ca8e2379eba8504e798e6a9fe50951328237d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211696, "uuid": "7ab043e2-6ecb-492b-99ae-2e31f0ce5f76", "value": "T1FAC42A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211696, "uuid": "dfd2722b-baf9-4a2d-938a-30db6168069f", "value": "fc960b9f00b5c476474282bb39f86c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211696, "uuid": "10b29bdb-d8e2-4ebf-ad2d-0005003d9b9d", "value": "12288:GcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:GcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211696, "uuid": "384d5d3e-f055-4e1b-aa8a-1fbce8f50234", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211696, "uuid": "246992bb-5083-4da3-85c6-75d881eb5983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211696, "uuid": "0fda540c-116f-4828-8c25-0c51561bc75a", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1188c695-13e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201857, "uuid": "001dc040-a5bd-4446-a2d2-f778fd2a3d95", "comment": "Malware payload", "value": "e46b627feb5f17679baff4042a70af53", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201857, "uuid": "106c3f81-00f1-4744-8d2c-639868fbc3da", "comment": "Malware payload", "value": "d4eb9acff3465171b3290d6e3eb44032054f3a3a16a44b2262da49054430a7e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201857, "uuid": "8cb45a81-5f9d-4a7c-9744-9e7fc1d07677", "comment": "Malware payload", "value": "086f1d436ab4ba074ca33912031c8a48786c6920", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201857, "uuid": "76e85a15-5d21-4a56-82c3-82efc11fbe06", "comment": "Malware payload", "value": "7587dbf2b4aa4992c9a850a72724c093fb979d009cdc4fecaa97818424027a629f53272b3893646bd373be2a59399f0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201857, "uuid": "2a0f3333-aa74-474e-8073-d57c68433f77", "value": "T12E42337B21F08B3297D010C9A2771B614F72960B456624B9F4FE6735AF2DA0371EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201857, "uuid": "76c31cb0-58f4-491e-8a0c-f4020fa8edc7", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjxlPOSEgXYUcFn0N8F:cCuhK6p4hvZ5m5FoKNpivOXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201857, "uuid": "01f22cc6-9b3b-4805-a100-51615bf1832b", "value": 12549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201857, "uuid": "0174a1bb-12ee-4ebd-a641-092bbc186cb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201857, "uuid": "85bb52b4-bd05-4856-8978-37927059a258", "value": "d4eb9acff3465171b3290d6e3eb44032054f3a3a16a44b2262da49054430a7e3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db4a0d9-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772212400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212400, "uuid": "773c8d43-d583-408d-8849-170845b7ffe2", "comment": "Malware payload (PhantomStealer)", "value": "bb7adfbe25fa1bafcf881b82eca00f4f", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212400, "uuid": "4c75ca01-40f7-4bba-8fea-3617303b99a6", "comment": "Malware payload (PhantomStealer)", "value": "d5d9b2142e05eb70fb147646dbdd7232e4fb82ee8c3fd3654007805964b3ea13", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212400, "uuid": "0ce1f69d-a458-44cd-97dd-a5b4dbdfcb78", "comment": "Malware payload (PhantomStealer)", "value": "3ff0d12f62a782e90f43849ecf27925d28987a3c", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212400, "uuid": "15802456-3f9e-4159-8115-61c12234dafb", "comment": "Malware payload (PhantomStealer)", "value": "28dca309adf1b4d1070197b44825b87db5a89be410a1ba945e373e4f66aac498786dbd8e3d16e7eb80642d2539f9a029", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212400, "uuid": "ed43200c-0d23-4aed-9f3e-ac89e8d9a45a", "value": "T18672A716C91ADFF00A3D3654A69B6816A4004366F938398C7D8FC5AE3F7A610CFD25ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212400, "uuid": "445f521d-45d1-4a25-a169-c76c61f6ad75", "value": "384:KyaBA+X6Fbm6OHNT09iycqhJHvcIFElRjbhFrWJgX5qjr:Kr8MD7HAJMWJgXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212400, "uuid": "0f2a7149-9b3f-47a2-a623-dae7266fa89c", "value": 16123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212400, "uuid": "7198165b-9be5-4fbd-898d-f3b78ed6a3bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212400, "uuid": "534480d3-222a-411e-b699-f65d9b79a2ae", "value": "bb7adfbe25fa1bafcf881b82eca00f4f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4662e3-13ba-11f1-a769-42010a9c0008", "comment": "Malware payload (SilverFox)", "timestamp": 1772182840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182840, "uuid": "e1f8755d-25ea-451f-9e83-ce7dd1bd83f7", "comment": "Malware payload (SilverFox)", "value": "5761fcf81d92108362afd223b812a89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.c", "colour": "#46F7BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182840, "uuid": "68e1783a-6722-4a2c-a9ff-3290661dff1c", "comment": "Malware payload (SilverFox)", "value": "d62ed041dfc60b5af31df905830684942bd99c1ff934959d094118eca9a74732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.c", "colour": "#46F7BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182840, "uuid": "ea3c0d9b-250d-4fa3-b7b1-5210097daa33", "comment": "Malware payload (SilverFox)", "value": "2365f027740c0055ba2216321a41725588b67782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.c", "colour": "#46F7BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182840, "uuid": "5b796646-113e-48f7-837f-4fedb00acda6", "comment": "Malware payload (SilverFox)", "value": "cc5f2b42465c0d13ca1bd21a3412e3f679557ebd63590b17263e464522b1c63def526179d2ad84ab7c7e65b8a9eb9f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.c", "colour": "#46F7BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182840, "uuid": "ad88fc82-a72c-455b-a992-df5977ea516f", "value": "T162B48D82B25818F8E47B857E99A645F29A313C14073193DB12D0AE5BFD776E0CD3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182840, "uuid": "104aa4ad-9cdb-43b0-a782-3c0e56f3a5a4", "value": "edbcf406a8aa02103cb050ce49c5e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182840, "uuid": "a37f5c9b-81da-4230-9c4f-87136229a492", "value": "6144:AzHeFCm8yQwDHDkwKsXLqD9kZTyAdYXgHZOjXDwgMZKv5Gs08MvW+iNHJuLj:A7eIjyZDI0OCyJXgHiXDkc5GsT240", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182840, "uuid": "ca4b2652-37fc-4265-b429-a39690cc6774", "value": 524992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182840, "uuid": "7f1cfbea-7c0b-48fb-bd03-932fd20bdc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182840, "uuid": "f7862693-2cda-4325-b2a4-183ca245818f", "value": "$RU4EMY7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7635ca7b-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199879, "uuid": "50970383-c4f9-4b88-9033-623f5341e426", "comment": "Malware payload", "value": "89c788f57c31cde58de62278af1d06d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199879, "uuid": "0ea7eece-f5b3-43e9-aa71-d7b90be2cea8", "comment": "Malware payload", "value": "d6b8ef0b2ef52bc8eafcdb5e76e3789b56dc6605422443905dc619b25abca805", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199879, "uuid": "ed3ea1bf-753e-444b-a656-c5afac3c3c9a", "comment": "Malware payload", "value": "ce2642c5bc96021e8f24c78b67649ca9b407e628", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199879, "uuid": "9bf6a7a8-6c6b-4ec6-93fe-682943f9971e", "comment": "Malware payload", "value": "61812102d8da3bccccfac7a7167cfac9ccc23cca5234bbf6e8a1415e9284a1197676b88c02140f8cef8e542fd0c65956", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199879, "uuid": "c47d481c-a7d8-46c6-9621-4a81b880b9b0", "value": "T10653F1C5324F08F2E0630775DE5AE96CB7709CF545B80A8B7B848E06EC6AD6278BC754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199879, "uuid": "0c3bf3eb-9325-4b1f-a230-a9d1acf34624", "value": "31ee44564b785ae16dbf2468803e1d68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199879, "uuid": "1ca6c1d6-2900-4291-841b-23c3899e34ed", "value": "1536:jwl88RWmwuQxwjMLaa7tuljos266VL3T5AOPFgB2:cqHmpQxOJsyjz2L9HM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199879, "uuid": "aa483284-c325-4f42-9a5e-d3177d0b444e", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199879, "uuid": "07c19f94-7844-4b86-b7ca-ef8c6ba56061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199879, "uuid": "ef0a11fb-6750-4303-9766-7e17e3e18ff1", "value": "d6b8ef0b2ef52bc8eafcdb5e76e3789b56dc6605422443905dc619b25abca805.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da3f16f-13ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772204481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204481, "uuid": "67a98508-e76b-409a-89b3-b8a007b27459", "comment": "Malware payload (Mirai)", "value": "16322cdf78a0e33827cdaf96f5e2bd69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204481, "uuid": "f12dbe93-609b-4a86-8fce-b52d8dcd9181", "comment": "Malware payload (Mirai)", "value": "d6d5dd4d717ae9b2812b24267247e4b6170353114c90f70e985f4c8cf8104785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204481, "uuid": "ee0de956-0b7e-4195-8078-f754e34a4a5a", "comment": "Malware payload (Mirai)", "value": "cf94f5ea7a8d4af786ea3c905daa0e47ca46da1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204481, "uuid": "216ddb87-8619-47ff-9a34-df8cadf1a925", "comment": "Malware payload (Mirai)", "value": "8b64db4061b0bb35a587599cfe8e886afa9f839a3fbdb0b1698901641662dd172770c6710366ed14663466aa72e80e65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204481, "uuid": "401f9030-cf8c-4b63-bd4d-7bde12808a93", "value": "T16E343B45EA418A13C4D117BAF5AF418A3332A7A5D3DF730699246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204481, "uuid": "e419d867-0f7f-4d59-8eb1-b22a72858e58", "value": "6144:Ego/jNuTqzHzakeqacEp1d4n1trmbf9ihM/9+AU:EDhK2HzakeqacE3W100G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204481, "uuid": "92f8b311-4ab3-4b98-9617-cc2e653e5013", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204481, "uuid": "f6a27cbf-b659-43bb-bc03-c6e8faab27f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204481, "uuid": "175ae8e8-0286-4f49-ad20-b2868eec83bd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2343cbf7-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212195, "uuid": "c0cde127-d31d-427c-8fed-f219b2df6d81", "comment": "Malware payload", "value": "d190071e18f1e62d94aa5b0db74c1789", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212195, "uuid": "52ce30fb-7534-4d2b-a068-28dc7adecdc6", "comment": "Malware payload", "value": "d761d4e70590ba7ef3e816a2749b58d1805d882e7c2b57dcfbbf3d68d673fc49", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212195, "uuid": "0c46cb81-ad1a-4f31-90cf-8aa5a72a1d5f", "comment": "Malware payload", "value": "439790f438efbfaa7b2a6ddf41acd672f8b92d0e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212195, "uuid": "9e5f18fd-65d5-49b3-b50a-063898094e46", "comment": "Malware payload", "value": "ed12fc62c5c3fa050839ac5e28267c89172ae3cd3ee85f85d87aacd55d35d7854607e26a0344af6e7223beeeb5d2f50d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212195, "uuid": "f02eadd6-83b9-4525-902f-c17fe8f6fbb9", "value": "T1F291A582778C0BA5BA5848D64258B90780F2D47D3A2521C9FBF17643F43DAB6FC68774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212195, "uuid": "2e5660fd-eb6d-487a-83ce-42aae86b4bbc", "value": "96:nFxnFl+i/mQV7N02UctXWSNVuPi+cONTS+UH0ddxolS3bAx2:nDnai/mQV7N5tXHXkiUPdbN62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212195, "uuid": "9828ac77-6b7a-4d6b-91d8-5f57cbeea08e", "value": 4442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212195, "uuid": "7c9faa50-5c5d-4496-9bbe-1b148cce35cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212195, "uuid": "d6f682cf-db9e-47f7-be13-87143d52566f", "value": "Scan_Document_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce3aee9-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190683, "uuid": "fc5e10c3-93e2-4299-b284-7b2f463b3450", "comment": "Malware payload (Mirai)", "value": "089a149d790851bb0d602ee4f9b07249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190683, "uuid": "ec97e40d-4355-4b7e-8e07-d8fa4c6ea439", "comment": "Malware payload (Mirai)", "value": "d84d2cf0613613fcbc963c0257c78c6ba500274d5581a2771d2b790c4a265321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190683, "uuid": "dd8a2cdf-c21e-499b-a713-7b0925b6c918", "comment": "Malware payload (Mirai)", "value": "1d948307570978630efcfa7d4ffe63403aa2597d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190683, "uuid": "4157b2a6-501b-49c0-a22c-55f15d8fb61b", "comment": "Malware payload (Mirai)", "value": "b36d242ca99a28ad7b964493b31e3575a6f2d88f8a2da327b28286a936cf3c6953532cd9ad8998123b9db1a2829edeea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190683, "uuid": "a40bf8f5-18f2-4161-80c4-3542526a28ec", "value": "T116266DA9BC6DA452E6C87BB07F2482D47239FC48DF81832B6611FBAD99F535C8F11211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190683, "uuid": "be386952-6262-467b-a06c-4d23dea2fd90", "value": "49152:nXNayIgcfrOnhCFJ3kTW32WIU5EI6uHMF76CxzB1:XNayIgcfrOnoFJ3kTW32WnEn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190683, "uuid": "97d78ee5-d2fd-425c-b81b-52a15d6dc56e", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190683, "uuid": "164bcc69-3b31-4c44-a4ef-fe1a83a906d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190683, "uuid": "09ce4ee3-59d3-4b90-9eb3-b710cfc0aa31", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d86293-13ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772191229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191229, "uuid": "33e3d9f5-7620-4765-a371-2d4454e207fc", "comment": "Malware payload", "value": "2984e78be20c61788baa5f188d3be932", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191229, "uuid": "f785a423-c170-4bee-bf69-fb4516a86da6", "comment": "Malware payload", "value": "d9067a50029d7072dd24b128ce70a1d303e3031cf15521ffe027c828a7f5feef", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191229, "uuid": "2227cf4f-40dc-4f90-b249-7c5bb6620ac4", "comment": "Malware payload", "value": "ade6844bcc7fe7bb33b83637fd1663165924d216", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772191229, "uuid": "af8ec04c-2c21-4bfb-a456-7c30d6743311", "comment": "Malware payload", "value": "eb5d9701bf83f19c716edb82daa591bc9ce5e20c35fe99297e1e738c4f2b30f46c17fdd3747368197af45dbc190cda8c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191229, "uuid": "01271c8a-a66e-44e2-99fa-5d20fda58cc4", "value": "T11F9733A79C1C8B44E47DC133D92E02A8461D7C157C5F092EA25635EA4BF3FF271B988A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191229, "uuid": "fb1356d2-55e7-4540-93c5-5a6029e27dc6", "value": "786432:WB3SsJuw6r7b/UmR9hS5F+SYeEv662RMKDkZBvDvqDYePFAyRupNyUR:WRSsJUrJRiPBY2MfZBvDvGYnCupl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772191229, "uuid": "9b04d61e-5fde-46e4-b19d-12a503348de8", "value": 42704896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772191229, "uuid": "9eb674d8-51b1-4457-afdf-30e06928005b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772191229, "uuid": "a74c2f65-90e8-4826-8ace-adf1c3b04510", "value": "9fb2ee90-f18c-4206-91ea-333a467c6863.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301a7e44-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213075, "uuid": "c40c399f-9824-4232-9654-8197923ab45e", "comment": "Malware payload (Mirai)", "value": "3af495850a89ca901eabcce83779d508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213075, "uuid": "97c75595-e074-4af7-a721-85f8fedf4207", "comment": "Malware payload (Mirai)", "value": "d9a9e674d37fa2381f0eff49e9bc5ad9683b8bb122816663d1cdef14d358e033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213075, "uuid": "3658390f-ff0b-4533-aef9-ffb0bcdcae1f", "comment": "Malware payload (Mirai)", "value": "719820c8fabaa620385f9136eab53e077f192cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213075, "uuid": "6d4f4822-9f25-4c16-9036-8a65eefb55d4", "comment": "Malware payload (Mirai)", "value": "766bfeea8e06ad533fc2c8300b043df49d521a4b964e7f8c2bd555206c6000ccfb87d257d4c4b8ac9a339b627cff154b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213075, "uuid": "765dc485-11c6-4b81-a36b-d7faefda15bf", "value": "T11BF33A46E7808A13C4D61B7ABADF820633239B64E3DB33069918BFF43F867994E57505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213075, "uuid": "ba112626-33d8-454b-9e0f-4c176f72f18a", "value": "3072:vfBUZc3Nw8mOIGlWKtBVFtaattSpKu1byM/9XOLmew8qTiF7:vfBUZCK8mOIGcK/VvaaWpKu1uM/9XqmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213075, "uuid": "6b286858-b97c-4fac-ade5-6b6ff34b2793", "value": 158993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213075, "uuid": "b36f3e25-b771-4229-b34b-868ea6e5ba53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213075, "uuid": "0856b5f4-4c42-4d24-b7b0-d4a16713e621", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776e1233-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Dorkbot)", "timestamp": 1772199881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "1c2dd301-e92b-4c0f-b811-9051a5234cc7", "comment": "Malware payload (Worm.Dorkbot)", "value": "b6d49e0fdfbcc910a3d229b1f15380d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "1cbaec0d-b5fd-48a0-8f57-f4e63802001f", "comment": "Malware payload (Worm.Dorkbot)", "value": "da6f4a31eaf3bf71c3e26398d791246ca4bcfb919b412d32c22509d87f765e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "9d152009-e56f-410a-917d-105450e804c1", "comment": "Malware payload (Worm.Dorkbot)", "value": "6a190d46eb822f4e9283502e6d2afeb564619234", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199881, "uuid": "00deeff7-aea4-4644-b213-50ba885ae31f", "comment": "Malware payload (Worm.Dorkbot)", "value": "c5840a467ec3bd6963a9f2b3f79f8b9d1e823507ae84ee6e0af517d7eb291654d7629b78406ae520adbea4c9fb9968db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "c69d5ef6-5d82-4e61-ba98-b3b7481410af", "value": "T17EE3022B258792A4CAD645F35627D163EE379E41CBB08367EB931910C9312DB8FA13CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "b5198aa8-0580-4368-8102-ef06b30e3d9b", "value": "d11ae554cf8e06ef4cff41a05efb87a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "9762c7a2-4910-4d5f-8744-6707fefcdb22", "value": "3072:g4dvsKtWmih5gvP3R/QNR0HYrmWW5kPeDHeRx1q0JRJalQVs+8NDfx0:FdvsKtuh2HGv5rxW5UTEwbalwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199881, "uuid": "685eb323-a5ed-4c70-9b28-a48554187757", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199881, "uuid": "db9f5977-c6b9-48b7-bdc0-f3108f18acfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199881, "uuid": "5d492f3c-6fc1-4377-b634-498847c0a4fb", "value": "da6f4a31eaf3bf71c3e26398d791246ca4bcfb919b412d32c22509d87f765e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bb7a53-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1772199885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199885, "uuid": "2700ee76-9073-4534-9c8b-a7fd711025c2", "comment": "Malware payload (Worm.Ramnit)", "value": "32b6d74310c5ba3ab9b219432c54e58b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199885, "uuid": "2d68f3ca-a660-43ab-8eec-fe48714839cf", "comment": "Malware payload (Worm.Ramnit)", "value": "daab555005f02f7eb817d159d13c4c23c9bc7075fd9f856e43268760d6456e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199885, "uuid": "970ac294-3e0b-4d7a-aa14-f8b5fe9c76db", "comment": "Malware payload (Worm.Ramnit)", "value": "5a00b970b9b9539a5ce62e1c5f9bad405f465928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199885, "uuid": "6a6ff616-4b0d-4f4b-93c9-b4a51dcd7005", "comment": "Malware payload (Worm.Ramnit)", "value": "a93ac4a5c0631b59b2e1fec07f51adf925af76f3aa07113fba077db10c5cc89b8063ea21f5517058a8489170c3f8a527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199885, "uuid": "b48bea67-279a-4e97-abb4-c1188de679d2", "value": "T1D053E0F98CD969A7D0682B3A46D28BEF1876EC180432D65FD45B1B8A479F00119DCBFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199885, "uuid": "dfa4b853-d954-4600-bdbc-dec87c017bfe", "value": "235e4caf15754b2c090efe8bf5146912", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199885, "uuid": "795b45f2-dcad-4e03-b0a8-0baa92d3c23b", "value": "1536:TiaiUk2Va0vwZzRXk1OJjV5OcI/j6/ju2yjEoXJKXX0JSkRxWMSC7jGN0f:TTdkMa8usOxTBI/j6/aBI8uiSiZjGqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199885, "uuid": "5f5e89b3-134d-4e6f-8ee9-bd8d6636de3e", "value": 66574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199885, "uuid": "815fe6b2-5f17-4af3-b379-08e6089d2c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199885, "uuid": "653d56b4-c7dd-4730-9bcf-8667b8b4259f", "value": "daab555005f02f7eb817d159d13c4c23c9bc7075fd9f856e43268760d6456e41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566bd180-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216576, "uuid": "14f9e53d-6051-47c5-bcae-2d884c8e2cf7", "comment": "Malware payload (Mirai)", "value": "a731c38c7cc0d661d23e42adc1ae854c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216576, "uuid": "34e2db89-1adb-4444-9c56-69fecadc20b6", "comment": "Malware payload (Mirai)", "value": "db395bc5a0fb8c46f3bc7135def9d3550b705800f507efc471a67bb40bc6ba96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216576, "uuid": "255f4536-fdee-4483-8950-7d77b368a87d", "comment": "Malware payload (Mirai)", "value": "3e41477b447e0b03e13afab88730ffc9cac501bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216576, "uuid": "74ae7f8f-e4cf-4b9a-b936-4f5d4541e948", "comment": "Malware payload (Mirai)", "value": "1dcf2fe693b8d00b5aaaa8c43235a7408b8541cfc5e44196810fe3799fda81c8189905be40178a7398e6ea13d53e77e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216576, "uuid": "628caa22-3d3a-46d0-9318-4df9eb6aa619", "value": "T117632985E753D4F1D987197002E7FB398A34FE620124DE5AEB94FFE2AF316817046229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216576, "uuid": "62eaa895-da58-4a1b-a16a-7f4ae47e281c", "value": "1536:xsRUQ16e9QTW6z5T61lq/4JogUJj8XU131AcxT9q/srG:2IKfeGsgmKAoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216576, "uuid": "80f7e793-c2ec-4cf8-8111-fbf323d0a8a3", "value": 70776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216576, "uuid": "1c989167-91dc-4e7a-ad3d-c3e3479c4eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216576, "uuid": "3a6836f1-cb6e-4cc3-9cb3-9e0e56c717c3", "value": "kirk.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af36193-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190706, "uuid": "7969d867-8248-4771-b871-11159964cfe0", "comment": "Malware payload (Mirai)", "value": "20330397ea1d1d39467bc8158e91b08e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190706, "uuid": "ca5d322c-3e0a-4891-b0c2-354fe22d226f", "comment": "Malware payload (Mirai)", "value": "db4c8b7d0cd176397b2a42ff2902e2661be614842dcd9b3e5cd427ab43a44d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190706, "uuid": "2a44ac9c-92bd-4791-8864-c77d657d6a6f", "comment": "Malware payload (Mirai)", "value": "9c8eac2cbec98ad19b22bd870845acef2dffcd8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190706, "uuid": "92299e8b-42c4-4791-bc51-88d4037a2419", "comment": "Malware payload (Mirai)", "value": "3a3e8680847e49f813bda96db7142536d93f793b0a187d54de1b37394f70a8ed892d1895f5c49a28d01601e862035152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190706, "uuid": "995f5e61-7c10-4a54-90c4-a03b5c3ffe12", "value": "T1AD3618137E18E70EC625213049B2CE94676A7C8946DAA613B391F31EE9F206C5D6FDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190706, "uuid": "39397ea2-f57d-46c4-96de-e5f51e91fdbc", "value": "49152:GEYDSqfAhPpGPmNUo4HIpCP69QIUHPzDKDixRJOSTD0UJxH2P7lP4pq96KLl5tDL:MAhaL/OdXDPcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190706, "uuid": "df21d05c-2996-4129-b5e1-d82c907a7c4e", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190706, "uuid": "c11370af-5d48-4a77-b4ae-b8cf5ac86ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190706, "uuid": "0289ad80-8f7e-431d-9211-6374941aa154", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275db761-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772212202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212202, "uuid": "8cb545d5-5f04-4193-acc9-ec60346abfc0", "comment": "Malware payload (DattoRMM)", "value": "f109d5a80d759c1c5395a50db9f0cefe", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212202, "uuid": "9406b67d-1e25-4172-9b51-9e41adbe18e7", "comment": "Malware payload (DattoRMM)", "value": "db66da2c9accacb6d68d22077fc8d1fa58f8cb9ee8b53a9953857346b18d7eb5", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212202, "uuid": "0a51a899-bc40-4147-83d3-8d04869f94c6", "comment": "Malware payload (DattoRMM)", "value": "890bf730de9967802f4ea644316a6b1f5b6f38f0", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212202, "uuid": "6d36b6f8-3e2f-4dda-a232-97a4f71d5693", "comment": "Malware payload (DattoRMM)", "value": "2ca30da0cfd786fabba3ddba755ce393d3dcbecc0b3a8497bd81861511dafd83cf780a9a4a5091069951be0c0c729daf", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212202, "uuid": "55aae277-2420-4e54-bdf8-dc0556f08d8c", "value": "T14FB63347D9778DF0CA330A3890D2196B3205980E485BF4C9F609277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212202, "uuid": "72ed713b-cdc2-461c-a136-f2bade452744", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212202, "uuid": "bf96af7b-1b59-4e20-9afc-a3efb6e345c4", "value": "196608:3aZk+wAP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2L:vn3mzZFw5S9pE7Asjp29qIT0jarlZr8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212202, "uuid": "171c3e7e-0692-4968-b6cd-57e1089dd06b", "value": 11056048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212202, "uuid": "606f4ab0-cc13-4ea2-a929-514a770ff0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212202, "uuid": "1ac7ec8c-8f2f-436a-8093-5158325d33d0", "value": "TacMechanicalInc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8c185e-13a8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772174925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174925, "uuid": "5d768f41-31df-473a-8d9d-05c83e95b1d1", "comment": "Malware payload (RemcosRAT)", "value": "11d28c6a9f2ee7cc6ce1528af48d0664", "object_relation": "md5", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174925, "uuid": "0e088068-dc28-4fbb-9ec3-c1589ed4f972", "comment": "Malware payload (RemcosRAT)", "value": "dbbe57125f33467c8ead5285622b4336bddc19c54bc14324ab9b15e937c6f357", "object_relation": "sha256", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174925, "uuid": "84cc29a8-8a1f-4e39-bdef-07910d64d5d8", "comment": "Malware payload (RemcosRAT)", "value": "c2620962805d534f706d6d090656f224bde864ee", "object_relation": "sha1", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772174925, "uuid": "0413796d-0a9d-4139-bf24-9995b1659666", "comment": "Malware payload (RemcosRAT)", "value": "70e6b2eef9fa47781c38f725624b432349930d2a59a7c9eeab4fb73118932136ea854b7b45d042159dc121a82537b965", "object_relation": "sha3-384", "Tag": [ { "name": "186-169-75-221", "colour": "#D4FF0E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "oficialrem-duckdns-org", "colour": "#A4FB88", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174925, "uuid": "00a96a74-b9a1-49a9-9be2-8721f0293a95", "value": "T1F3E1837BD5B1B8D487AB337079D6E0C9204AC647CEBB4A98E54808991FE4315FFE818C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174925, "uuid": "f1908cc1-371b-4d9e-a8ac-b3de7f028512", "value": "192:T4QL3tlTUiohbHV43h+YCjAcGXnVe7lI+7FuUq6EkbcR0:T4s3Miohb1u+BjAccnQ6+7YURJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772174925, "uuid": "20e8ce53-7c84-491f-8569-02e9f7f4120b", "value": 7190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772174925, "uuid": "d78e466a-b30e-4d08-8c61-6a3ea2d02644", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772174925, "uuid": "094bc508-fc5b-4c00-9f5b-dd050377823f", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d2b9db-13d8-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1772195709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195709, "uuid": "852d1eac-e495-49cc-a287-6bbe14a12fdf", "comment": "Malware payload (RedLineStealer)", "value": "4ef583c9ee908c829a31e64b917c7b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195709, "uuid": "800640b5-152a-4200-ba35-810a2dff3aa0", "comment": "Malware payload (RedLineStealer)", "value": "dbda6f421976910cdb3ddddf728dde8d7544516e2bb6510246ebc5d9a37ef5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195709, "uuid": "ddf89581-89be-4286-9a34-16ff63b28be5", "comment": "Malware payload (RedLineStealer)", "value": "7637f89b03d5db9404c6206bd55ebb2fde2294c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772195709, "uuid": "92030f58-b1cc-40f5-bcaf-7c45b5ebbdea", "comment": "Malware payload (RedLineStealer)", "value": "e4b6f03fe3c719a1397252f4efd2aa0f3b10e696272ff9850b25465bc59d17015ae7b36765128edc164d31c833ee4525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195709, "uuid": "c6713f80-67d4-4787-bafd-8e577ec4a222", "value": "T18E247D2823EC8716EABF8B34E434106482B5F75B7925DBAF1E8594DD2D36781D201BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195709, "uuid": "af65ac7f-2ed2-49c5-b1b2-5e706951ee0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195709, "uuid": "089af52c-447d-4606-bd66-5f43ca23c4f6", "value": "6144:Qf0WW2rSFHSpln7sK259/dBRbdVeyxQBhj0qDhq:2zSFCh7sKA/dHqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772195709, "uuid": "9457e374-4423-4e86-b666-11fd03a054e2", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772195709, "uuid": "4a028016-13ec-49e4-aefd-f19763e6d6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772195709, "uuid": "ea14ab65-f5c7-4c2b-b83f-b4d763f79102", "value": "4EF583C9EE908C829A31E64B917C7B30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c794cb-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772209993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209993, "uuid": "e8f7d3c5-bd9d-4fb3-a68f-fa899fcd41c4", "comment": "Malware payload (GoToResolve)", "value": "b8a4b883def07ed1899ec7ddf0afec25", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209993, "uuid": "8378fba3-a585-4d62-939a-ab4caeb7d0e8", "comment": "Malware payload (GoToResolve)", "value": "dc972b649df9362fc603699f32ddef1147c6e7f969716ef9f7921714ac102e39", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209993, "uuid": "bd1fcad5-3685-4f61-a7cb-45018fcc9a6a", "comment": "Malware payload (GoToResolve)", "value": "ccdf69b18d290d2f03873e4d09082caabe27a8ea", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209993, "uuid": "591aff93-49dc-4566-9b71-e032a3c2f03c", "comment": "Malware payload (GoToResolve)", "value": "33a2de9b222606ea7cd164249b10952483ac39d6afbd6065ebd201dd40e61c37d687b4f58f7a6069df4efa2624ad2da4", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209993, "uuid": "3ec210d5-20ce-435b-b33e-736a25f3c9e6", "value": "T16F3733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209993, "uuid": "8d21b259-d5a6-4a43-95f9-b1477d894072", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209993, "uuid": "2ec5d443-657f-4e1a-8ebf-35c51a35b482", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209993, "uuid": "34175286-9966-4bdc-bde1-5a7474a5ee3e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209993, "uuid": "7b47714f-0982-4f4d-8739-fc88b1c89813", "value": "SSA_Statement_pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a25ec7-13b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179639, "uuid": "6427a95f-25bf-4fa7-8ada-3eefeff6fd24", "comment": "Malware payload", "value": "947edbaadf96b1bd38df447fda0a99b1", "object_relation": "md5", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179639, "uuid": "f72a34cc-67f9-45e0-9085-f42d3d265e73", "comment": "Malware payload", "value": "dca350d99859070626f54ddae441d1a04e3dbf2a5d46c5a3e49b3eaecec24b95", "object_relation": "sha256", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179639, "uuid": "5023f1ff-c20a-4f4c-82b1-ad7e4a75531f", "comment": "Malware payload", "value": "530ce60978e77e8b7e07e902043205cbe8b57800", "object_relation": "sha1", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179639, "uuid": "65045b5a-3f12-4f97-8dd2-523e6083be7c", "comment": "Malware payload", "value": "e0373c0afcd3fc2d9e080fb7576bc0026ad1086e06aba8d256105d8929d86185534d39f4e42ae64f812d7e26e6a766b5", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-202-150", "colour": "#911766", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179639, "uuid": "d9fed94a-9367-4945-8e47-c3f24def1c90", "value": "T141B33C1637E1447FE0AC9A319422D3D0017E775A6B933F0F91424E950EBDB85EA18BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179639, "uuid": "5141789c-0e51-44e1-a4ff-6212ae7fd1f3", "value": "3ef10934d629fc28c006784a1ca1e57e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179639, "uuid": "e8724589-14df-42fa-8d79-505378ac0b75", "value": "3072:RZZ1MJnaZ4TAcbF/als3tDvwnhrzR6QAyJy:cZaZ4P/UKjwnhnR6QAyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179639, "uuid": "e5e9b19a-72f2-49f3-a7f2-8b620c0de6d7", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179639, "uuid": "da8adbaa-b97b-421f-8547-87a5c461ef58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179639, "uuid": "afb3579b-58a0-487a-b586-f287d9590343", "value": "dca350d99859070626f54ddae441d1a04e3dbf2a5d46c5a3e49b3eaecec24b95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b107c5-1425-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772228552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228552, "uuid": "62ea52c7-7593-4d1e-b730-657e6562ca15", "comment": "Malware payload (AsyncRAT)", "value": "34ddac39753b6e5ea7baf9d4866fb757", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228552, "uuid": "18dfeda4-6e3f-4d19-a929-bff87196b66c", "comment": "Malware payload (AsyncRAT)", "value": "dcb2e5ddc7ddaeb34335ede8201dd6fc69c76deee8d0075f6b08d713080a05e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228552, "uuid": "e84023f9-9ad0-4b41-9e9c-f21ef784df0c", "comment": "Malware payload (AsyncRAT)", "value": "43fb2781158dd977d92cbd550796d43fa76d2e0b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772228552, "uuid": "78fde66d-dd3f-4a97-bc38-746102777fc0", "comment": "Malware payload (AsyncRAT)", "value": "26b7e05186e6ebe87ecabd45caa41053fd6dbd7cb579d8c7acf1b5353867e77ccd5172eb2ff0dfc19b149e71328eb789", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228552, "uuid": "167e8bc8-7b33-469e-89c4-b037d7544682", "value": "T1C5E24B487BE54327D6FE2FF229B6A10102359507D923EF5F4CD885AB6F67AC146003EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228552, "uuid": "4a7415fa-4d92-4e72-ae1c-dd2dc3289469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228552, "uuid": "4b3ca12c-9f9e-4062-acb5-8ec7ca186c25", "value": "768:laVCsFJpXzXsMYAoRFT2uBFE9RnOqhRbC:oVCYJhiT24FE9RnOqvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772228552, "uuid": "857ea84f-c204-4de6-9b0b-fbd65cf8ae2b", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772228552, "uuid": "c0b7a22e-e491-431c-b224-8cd0c94d2282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772228552, "uuid": "4a9a666a-c7d8-4895-a60a-bf1ed4ee37ef", "value": "IRAQeClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece3604-137c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155977, "uuid": "ce877464-0a0c-4948-ae75-9d833d025117", "comment": "Malware payload (Mirai)", "value": "ac311ae3458694b951c9461aaf48bfb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155977, "uuid": "8bd08976-0346-42ec-afb0-ff86513e61d2", "comment": "Malware payload (Mirai)", "value": "dcd333ee18df631af5ac7a289394ea2fec67fb6454582b5b0ae56b1757ea4ec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155977, "uuid": "6b62a9ef-260d-4958-baf8-26163bcaa174", "comment": "Malware payload (Mirai)", "value": "d312473bd7a98a74df59437fbc73990fb64164d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155977, "uuid": "d86e3c70-b950-4619-a363-2a9a7b9a7895", "comment": "Malware payload (Mirai)", "value": "2a820488559a065504123cde8454a7214a3aa1404c8435b95688341cfa81b238fbb278ad47c7bc81eaa36eaf4af04564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155977, "uuid": "7b42ccfb-4197-4a84-b958-73fa33e57d61", "value": "T14B232A07A58580FCC56DC17846BBB93EC92775BE0239B2EA7BD4FF267889E210E1D504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155977, "uuid": "1a569ab2-8ea1-4191-abb9-41e46036afbc", "value": "768:owLvSBiA/UTzQGNdlIwt3v+AN01W2esezgljpakgPMfAxXGnbKC8OIzJyJVm:LvSo1TzQG7lIW3v+HTYgljElU5bxoVyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155977, "uuid": "c9064ca3-38ae-410a-8e1f-0bc7e23fb0e7", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155977, "uuid": "893263eb-6b87-400b-a823-40436f3ae63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155977, "uuid": "8f298728-9fc8-4616-a541-bfbb2e46c2e5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a659052a-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772210697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210697, "uuid": "ccfdc2ab-75e6-4be7-9a71-ee74ac9285f9", "comment": "Malware payload (RemcosRAT)", "value": "0ecf5b200685e740a0270380a506723a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210697, "uuid": "0fa0a4fb-0fbf-4a3a-9996-1a8ca2028e66", "comment": "Malware payload (RemcosRAT)", "value": "ddf18913e974e0d83e4f65d4fb9b20e98974bf87cc414af05184fe20bc0f6e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210697, "uuid": "e1c155be-0171-4e78-9178-ac0c483c7328", "comment": "Malware payload (RemcosRAT)", "value": "c7a6062daacb7ad3d6d0a89bd1bf90fcf650ad26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210697, "uuid": "9e99dda6-fd9f-4b72-b599-1821ed4f26dd", "comment": "Malware payload (RemcosRAT)", "value": "a748e04db3af1eef45f5a8cd9d9aca74572da3ec154767ece0478996aa78db7a754304489f80c1712649bbbefcb5d02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210697, "uuid": "4b18418e-47f7-4664-883a-f0999a295286", "value": "T1424512581789C417CAEA53BA29B1F1784B7DAEDBB510C3564FECBCEBBD217101808396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210697, "uuid": "8128d617-beac-47ad-b281-21cb65e71e1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210697, "uuid": "cfa54494-32e6-4f5f-bf9f-369027bb9521", "value": "24576:SeI5aO7XTl9kE8EqKd0cerovv7eDd+3p4emyUADnr:aUiXpOu+ovzGd+3paJADnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210697, "uuid": "2897c481-f980-4658-b37d-f31f60fbd8d9", "value": 1275400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210697, "uuid": "8c152d0e-8796-4df9-b4bc-126cbe7a970c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210697, "uuid": "c7af3bcb-ac27-47f1-ad8f-9b7a9bcacd70", "value": "EXCEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f57154-1409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772216600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216600, "uuid": "6dcab61f-7887-4894-93da-e5e9b59c979e", "comment": "Malware payload", "value": "3c85f80fb96a8fdea93732d98bba7fb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216600, "uuid": "3ce2587c-d707-4d38-a694-39b28cacf946", "comment": "Malware payload", "value": "e05b416af3eb1f3ae61816555a3361e36df6340bd50660fae17ecd44927197fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216600, "uuid": "30c79c78-296e-451c-8d8c-5ff70786e4bb", "comment": "Malware payload", "value": "b1ff96b11dcd62e7caa74f44c664e33b15a11eb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216600, "uuid": "1a1296c1-46a8-40d4-adb0-6a7d775792ed", "comment": "Malware payload", "value": "acdbb32426360c00f8ce5f7670763ea01f38f554be39b2e19ba41f15241335108a97b10a31fe2c897a89292b9f52bcd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216600, "uuid": "2d9600cc-cdb4-415a-8458-95e0bb4ea854", "value": "T1C4D3E846BD418F17C5C321F7FBDE42983A1A6B6DD6FB3102A925BFA037864D60E36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216600, "uuid": "e58e9131-e457-44f8-a2ec-6f180a8ae685", "value": "1536:TCJT8p3RpTTAfkX4VVIcT4ACShPOsfOCG0wemwS+uPlWQwyw8AH8W25w3ihISwyS:yYtbTTr4ccPCShmeDmkkXwyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216600, "uuid": "cb5110e6-e5e2-4b01-82bf-a43466dd53d9", "value": 134816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216600, "uuid": "71b57922-4ce2-4e36-bd48-c9929a2c8343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216600, "uuid": "1a0d8622-f056-4aee-a392-55758032e916", "value": "kirk.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ae0281-13fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212031, "uuid": "f398647c-454c-45eb-a3ee-a5bffeeb5686", "comment": "Malware payload (Mirai)", "value": "80e248cfc161104d2cb8aa47a516f2e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212031, "uuid": "fae7b97a-e138-41f5-9329-962bbb7c2bee", "comment": "Malware payload (Mirai)", "value": "e067775f0c324edc8115adfe8cb778d2c540e37757ddfc5377b94ea49c932cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212031, "uuid": "4b4a6477-9365-43a1-aee6-529e7ccca1a6", "comment": "Malware payload (Mirai)", "value": "e33811011c2c045931770124cfb668466d6465bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212031, "uuid": "61ec8fdc-3474-4311-91dc-039c212829fd", "comment": "Malware payload (Mirai)", "value": "d1d6aeb34c3a24c6e9ce7ba7f9564673b1205d47313b569ae82f1a4df367a6ae7bef65452068dca41512f2870ef20dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212031, "uuid": "a7d2b3d9-a6c8-4138-b5e1-8be8fb0dfdb6", "value": "T1DDE33B06731C0907C1A32EB43A3F67E193FFAAC121E4F644255FAB8A9571E361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212031, "uuid": "7fd88646-c3c8-47d8-80cb-7e57868f9e09", "value": "1536:vUDTFLKg1RtU1IWkPdxfTIrEPXuZGOtu7B74D3vAqjtzzuoeNDqKBNHko9C2:vUzRvWkPdxwE/067x4Eq6Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212031, "uuid": "3d6a257c-3634-46c8-8dd1-9626f9bcba37", "value": 146356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212031, "uuid": "f1656432-c84f-481b-853d-76de30a2b72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212031, "uuid": "b37743a8-3757-484c-bb7b-900aecfb1fc0", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c489481c-1395-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772166939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166939, "uuid": "06d45f0c-65b4-4d96-b159-e6ca7153f888", "comment": "Malware payload (CoinMiner)", "value": "cf63630a5750f113d94dca8698830eb5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166939, "uuid": "0f948257-e1b9-4b97-9dce-36cb0a80548c", "comment": "Malware payload (CoinMiner)", "value": "e10b18f10b4d07128d965e6d7ec0d6568f3c0fd64d87f48998aaa41ecf63e91d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166939, "uuid": "b4dfb12b-47b6-466b-984a-188df5363025", "comment": "Malware payload (CoinMiner)", "value": "f6afd5a5bcc12f71003d5f42fa43f840256b5ab6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772166939, "uuid": "6871c4d0-a147-45f1-bbc3-8552cda27bfc", "comment": "Malware payload (CoinMiner)", "value": "b50764600fd36d6c0516c16f2f90285f562c8feb9583fac36cd23f32ad9500739f48f4789b4e6eca365a028e864c3611", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166939, "uuid": "581eb385-ba12-4cd5-a1eb-5a28451eb333", "value": "T18937D057F8E608A0C4EDC2B189768226E971B84D0B7523EB57A0B7341F337F1597AB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166939, "uuid": "9392fff3-d521-4881-9ec3-7e517cce1083", "value": "393216:pGhfjGV/iPqXPHCkHFDlcugmERcS0nc77YeiD526BPDmmERcS0nq:khZkHJlVY0Ph5D20q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772166939, "uuid": "984bf913-8955-4953-9397-2f9d236f57fc", "value": 24187015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772166939, "uuid": "47e380c1-4e71-4700-a190-683773cf92c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772166939, "uuid": "084763e5-fd53-42d1-bff3-b481ad18a32d", "value": "syd-api-01_1771980125_elf_VuSiJeKr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f8bf76-13ed-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772204604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204604, "uuid": "cd76915e-2343-4160-b676-0cab93850de1", "comment": "Malware payload (AsyncRAT)", "value": "ac9bbd553aabd25c0a56e210bd3fe94a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204604, "uuid": "e7a89db7-9da0-4f49-be7b-821e7ed17c7a", "comment": "Malware payload (AsyncRAT)", "value": "e11074ed1e3e2c07461249b83510a177fd8254967fe864d1af190f4348855de7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204604, "uuid": "3f8f9b6b-7564-4d26-a427-a9d7b257a479", "comment": "Malware payload (AsyncRAT)", "value": "fa929cd8788c684dc135144ff2a5998faba1f3b3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204604, "uuid": "df3876ae-763b-4ac2-a790-73248fed5219", "comment": "Malware payload (AsyncRAT)", "value": "09b609e31ae448bd54a765a2994bde3364267b4977aabf98eb8740611c62154fca0865830516455e0e8ec9a0fb17982b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204604, "uuid": "164d3271-72b9-4252-b97b-0b81d3f3221e", "value": "T10D653324C7BB6DD04314081E8ED48BD2AD6F2024BC26674C57C63BF856466BF2985EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204604, "uuid": "1ee1c4e6-63dd-4b75-aae7-be6b35afedb7", "value": "24576:5ODPnvv4zjSPf3sMf2+njigcNEaxa07AzVVye52MflVsfR+vyTmSn+6y9sFuHDJO:0DH4Pe3zfxjo1a07gvsAvydnY9VSMnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204604, "uuid": "3c30394f-8b35-40f7-b5b9-a928f7525a03", "value": 1491377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204604, "uuid": "a73a89ff-0ce9-48d0-bde6-6ed78b8a4bf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204604, "uuid": "cb4eddb1-3c1b-424d-a609-bd6e5b036be6", "value": "JUSTIFICANTESDEEGRESOYESTADOSCORTE24-02-2026_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7543160-1389-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1772161816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161816, "uuid": "939a7c29-f334-4589-8e2d-6e69b197e042", "comment": "Malware payload (Loda)", "value": "b8f009ee52c99361c03488bca8a0c9b4", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161816, "uuid": "ecd2aa3b-e2cd-439b-8daa-44ae03ae1e7b", "comment": "Malware payload (Loda)", "value": "e113acf5df0303c2e1c59e52daee010c9a876f34811dbfecf21cba7f82ee12be", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161816, "uuid": "b53e3fc8-12cc-4028-be72-7c090370d969", "comment": "Malware payload (Loda)", "value": "23d26ef545dfc01d1a251aadd384bc65ee03d31e", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772161816, "uuid": "9aec0e82-ad20-4205-9a2d-04838cc8520e", "comment": "Malware payload (Loda)", "value": "7f8eb0844835ddfbe147df44349ce5a9814092b239689d213384c04e8f385e558e26e72e18d9ceaf22b67825e153422b", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161816, "uuid": "454cd0ac-817a-4b17-88db-a8804f2c0e0e", "value": "T1BDA52294F6F6807BFA111531046542EA15686C2E7A21CD5A35C7FB6F323BFB05EB2A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161816, "uuid": "59744fe4-a4e4-48aa-88fc-9280262e2f5c", "value": "49152:6NfJ46F5y2zzuIavXEsT+rFrrH+D3JPxaIgBM9M4RAfrkEx:YfJ4iy2z9uYRHAJxaNuzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772161816, "uuid": "11bfc0cd-1882-4655-a6a5-29d43520132c", "value": 2195968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772161816, "uuid": "bbd2af73-e3bf-41ec-9d69-04a19ce11de1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772161816, "uuid": "f46c4cd2-b78c-47f3-a05e-f97c17a76873", "value": "Confirmaci?n de pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af93849d-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772210712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210712, "uuid": "2c59d7c3-3ed4-426a-9d77-be32d0276a60", "comment": "Malware payload (GoToResolve)", "value": "39f561076859c79b0210007df8605b93", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210712, "uuid": "9f57ab4f-a3a8-4161-b77e-3316164be7a4", "comment": "Malware payload (GoToResolve)", "value": "e1849e82dc6ab6a8f3cf264bc426681cc252b940ee8d7d7e8f4f8dad971f84d8", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210712, "uuid": "3063bff5-df18-4c31-9ff0-b8176dd06d6e", "comment": "Malware payload (GoToResolve)", "value": "89b7675a7f1586bb77f889a8adeea194014a0268", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210712, "uuid": "046d7849-aa81-498b-a078-6ecdf3d21180", "comment": "Malware payload (GoToResolve)", "value": "2eb33a32cce0d777d3e3ec682a8bd6e52ddd29294efb05769df5d5fef635818fa331ed60a257ef245ce93cfba6496d8d", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210712, "uuid": "4823eb7b-0c89-4f52-9c50-ea5a0f12cf8c", "value": "T12A3733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210712, "uuid": "ecabaae7-de92-4bf7-9f0e-76311b8cfe5a", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210712, "uuid": "9288eb48-575f-44c1-bc78-757b7e4e1bc3", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210712, "uuid": "7721a0e1-7f8a-475b-934c-afbd4cdbadd1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210712, "uuid": "228f85ab-f914-4cfc-a058-8df78a71276f", "value": "SSA-STATEMENT-PDFADMIN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548aeaa6-1406-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772215284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215284, "uuid": "f6d11c03-5d76-4e2e-83da-7e71e45b40a5", "comment": "Malware payload", "value": "23923c035be3928189943b4880311ed4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215284, "uuid": "fec2820e-dac9-48ba-8057-1d89de4e8013", "comment": "Malware payload", "value": "e25428c86f98e0ca74e0785ade982e2698873903eb8e3de77cc0c6e8cc3d3970", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215284, "uuid": "90a7e49a-56dd-49fd-ab21-9f9c4625e478", "comment": "Malware payload", "value": "7265967ffbb85abcfe3980e530086e4e5c21d201", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772215284, "uuid": "dca82173-7724-41b0-be01-ba704678df43", "comment": "Malware payload", "value": "349772efec555d8012b4ca55dbb63b034a62d48efd3a567b6ef82eb67aa588569d1d8707ff8592acad16d682971e0313", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215284, "uuid": "3a4bd43a-681c-41a4-9d9a-5bfb2d5497a2", "value": "T17D65E2E5D7AA1415076A3718EC75BE80FCAB1F1F89D380CE373012DCBAB85AE5674918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215284, "uuid": "78ececb4-e744-488e-8aac-684f8e6f400a", "value": "384:z8BkGCg2GDFGJPs516afy80SkZXkAn7pBeNlNwE:7HDE5kYy80SARXeNLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772215284, "uuid": "5d9e788e-8adb-4345-aca3-732a75b0d48a", "value": 1431129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772215284, "uuid": "122ab40a-c6e2-4be7-9eb5-f8bea917bb5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772215284, "uuid": "a96ed0f8-0ac7-4d8c-abee-f888d01f192b", "value": "LAH.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd102433-1427-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772229687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229687, "uuid": "fa9cb9bf-5070-4a16-bda9-9c58ff25da85", "comment": "Malware payload (ConnectWise)", "value": "78e6deda055ed2f849168b4a6878d363", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229687, "uuid": "920058f0-33be-4e3c-b1a0-f064b804c6f4", "comment": "Malware payload (ConnectWise)", "value": "e2d1fa5b50b501c93c023164b6028f2d0d91af22319f3ee1d1774a9542c9d3d8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229687, "uuid": "065d3f59-dc3b-4d0e-98d1-85b5d435f238", "comment": "Malware payload (ConnectWise)", "value": "6233cefacd92612ec0f88e484fd2ecb36531b310", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772229687, "uuid": "56f0e4dc-0a0d-47b0-a602-eb9f07d413bc", "comment": "Malware payload (ConnectWise)", "value": "e736da5d0e991b89b3e8f3f4b21e942af311642fb31b1c7f8294b5cb2bf73de7dd2da79b3fdd894f8f0231a46d1ef30c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229687, "uuid": "3c08ceaa-b276-4b7a-a390-02906fee3a82", "value": "T1F0D6232523FD405AF8F75B39FD7682E45972BE64CE21C11E9328B90D2A74D8096723B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229687, "uuid": "87a7f4b3-8412-4fb4-a503-ad5fe04db216", "value": "196608:CWh0cGwhWh0cGUWh0cGjWh0cGwWh0cG+Wh0cG0Wh0cGf:CWacHWachWacUWac3WacnWacLWace", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772229687, "uuid": "e3d3a702-a593-480c-a7c4-981fa809ba92", "value": 13549568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772229687, "uuid": "8076b8a2-19f2-45db-9f07-00e93cd281dc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772229687, "uuid": "03604ab2-7d61-4381-8336-0b9002fba667", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8504c03e-13ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177140, "uuid": "0e26facf-c6cd-459a-9ada-4febf289a85b", "comment": "Malware payload", "value": "818b1c6f62a260554db3495a5dd74f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177140, "uuid": "ad30465b-0538-4deb-ab9e-992af90aec77", "comment": "Malware payload", "value": "e3253392515a75ba1e6c616f423f92254f0157c2e9f1741750fcc9e0053d6c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177140, "uuid": "b8903991-4748-459e-b002-f9c528a46ae8", "comment": "Malware payload", "value": "420cdaca502318a73c2783559a8cf326adc5fad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177140, "uuid": "d190aaf5-382f-4c4c-ac5a-3a8a8e9c6d72", "comment": "Malware payload", "value": "fa54ecf2bd44c3a5d6f39924c894a5096754c0098f7b8dc5f117651a0b6ac254ac3b58d9bfa9f12de4f7605a819b5f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177140, "uuid": "74232f57-3c44-4fc7-9905-368149dec7ac", "value": "T1056423465D5F1E4EEAB501301E23C017B9DB8EAAC182A9767CD4B02B58FD43EB187E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177140, "uuid": "37907593-b2b7-480d-9425-750f0c48b617", "value": "6144:X6ojS4oborxGPyA2Fwe2rko8Sc+azNhzCGvUgsNErRF4zQd:hLKorxOyAbko83+uRZENwAQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177140, "uuid": "3efb3110-dce0-4ff0-8e9d-2b47088830f5", "value": 333460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177140, "uuid": "540efdf9-d05a-4726-91fe-055e9ceff2ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177140, "uuid": "9ff6f148-5846-4096-a0a3-9d840517719b", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c48cd69-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177877, "uuid": "54f44e75-8939-46d7-9d6d-a275b6718424", "comment": "Malware payload", "value": "cb4015399f290db65fe4dff52050a4cc", "object_relation": "md5", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177877, "uuid": "5de01c67-2137-48cc-a296-c6bc86b86f81", "comment": "Malware payload", "value": "e3360256ac126c9feaba1ab030581c73ec92b364ca884931e895a4ac031540b4", "object_relation": "sha256", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177877, "uuid": "a3047632-4bed-42b5-adc7-6c8b55faab1f", "comment": "Malware payload", "value": "66d9aa32b7b1d88a8f2f68498c0492048cc4aed5", "object_relation": "sha1", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177877, "uuid": "b8807ecf-05a7-411d-a917-f91ba9ef92b6", "comment": "Malware payload", "value": "fdc983e4b3ddf541b5956eea732c5f555d425a42562f063499a16bdb5adda933b656f449997e82676903a763f1906610", "object_relation": "sha3-384", "Tag": [ { "name": "catalogo-castrouria-com", "colour": "#19767C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177877, "uuid": "9a3776ea-f4c8-49ba-900c-6ef476f1a777", "value": "T130C1A0828D369514DC561F3514F161CA025EB053E9E65F2F41E5B433EE11C1778E9EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177877, "uuid": "edacf127-31f5-4735-8b16-fb5a821292a4", "value": "96:vDzxgMYhoMe7F0M9sADtBgyjQ0OwdR/lr6Y42V96WIkeu2DJXdMisN+aVoiQ:v/xgtoJyMV82OwXlr54zkgfMitSoiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177877, "uuid": "bbc90bad-78d1-4688-b9f7-1ad4ae68a90b", "value": 5784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177877, "uuid": "0703305f-c258-4111-8404-e2993b51b570", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177877, "uuid": "ea8a9727-af84-46fa-9ec2-bc04bc71013a", "value": "e3360256ac126c9feaba1ab030581c73ec92b364ca884931e895a4ac031540b4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c37adc-13b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772178219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178219, "uuid": "7e114bf9-bbb0-4617-aa6a-e609e416a2c5", "comment": "Malware payload", "value": "8523f2ff3ff13e510a9bf75665562b3b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178219, "uuid": "2eaf376e-d6a1-49c9-baf0-04083dc50892", "comment": "Malware payload", "value": "e6b523e77c31b89f8eb3489007bf14b3b9d34bc3870a9d96ecf7b99efa506c76", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178219, "uuid": "241a70d8-5a1d-42a5-9e89-d8a3a12e4832", "comment": "Malware payload", "value": "2df65e6ab96c8c65fa91d84d379f0af2977a6a3a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772178219, "uuid": "e2e66276-8056-4060-be71-29bda7df5239", "comment": "Malware payload", "value": "f7323034eebbb716137984a3672caf27062ca7f9c41887cc3f0bfba0e54a6b6aea5e28261f5f49e7b50275ed20a01e6e", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178219, "uuid": "a82deff3-51fd-4a20-86e7-87f2d7b55a78", "value": "T1FB830803BB4B80B2F59921B118AB276B427F744557215EFBEB803F5E4C346D1ED3618A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178219, "uuid": "a8ae55b5-42c4-4a5b-862c-8b33db247b09", "value": "2fde00c1d5d2abaae0366099ef60eb01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178219, "uuid": "82232d8e-1dd2-4c6a-b696-af1aba42ff0e", "value": "1536:jSlrqxJMwz/g5+6WUQ+NiO/CRr5zs6hOoyPix:jSlSq5+6WUz7ql5zsgOoyPix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772178219, "uuid": "3f22d47d-bc40-4207-be5d-b3e061ca06e6", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772178219, "uuid": "6a4482ca-8c34-4d40-a1e8-139aec6ebabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772178219, "uuid": "a42677b9-4b52-42b3-a194-194292fb6691", "value": "mvnac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e24a2b3-13e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772200644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200644, "uuid": "0e0bdb70-a739-4385-b491-5b34efc041ff", "comment": "Malware payload", "value": "fb4fe1145759e080f0a12c81b3f85699", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200644, "uuid": "cada90ee-6da9-46f6-b1da-b2037140cb4c", "comment": "Malware payload", "value": "e731caf31c58e0f2987126739f6883876ecd283fff029f986b5f7f2fd611018d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200644, "uuid": "6a98fef1-ae79-4825-88b6-cad08c087411", "comment": "Malware payload", "value": "9a0bf472a178c2c6814198bfe38975d9b0061d24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200644, "uuid": "d48b232f-e868-4f1e-94d4-be5b759eea3b", "comment": "Malware payload", "value": "e9c1527649f182bbd37344b5ed2645f0845c2f34eae7d867fdcfb3c10dbe36889e1c6b360a0316692f367874196e1f08", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200644, "uuid": "8718eca0-db27-4808-a115-800f59dec0b1", "value": "T123828D3621F08B335A9065C4B3772BA54F769607456720B8B4FE1E359F5AB03B0EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200644, "uuid": "cdaf1f39-6a88-428c-8f7f-b27b6602fb61", "value": "192:cCul4hvZ5m5FG4j4HKNphv1KLMW6MN7molZQ:a4hvZ5m5FGGoKNphv1KLMW6MN7mo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200644, "uuid": "2a933906-c99d-415a-9dd0-9109e74dc484", "value": 18577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200644, "uuid": "a2cb9f48-18ab-44a7-9d45-c56ec7569cc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200644, "uuid": "ec772283-da73-442d-8f3c-b95fc5ab4a95", "value": "e731caf31c58e0f2987126739f6883876ecd283fff029f986b5f7f2fd611018d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67efecf0-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772212310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212310, "uuid": "d1a2a110-42f5-4db9-94b9-3f13846014a5", "comment": "Malware payload (VIPKeylogger)", "value": "af36365b7594e446c3e915f9f8b6b011", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212310, "uuid": "b5bd0e6f-f504-427d-9dae-7d81bc95398a", "comment": "Malware payload (VIPKeylogger)", "value": "e73a5477514bda62b7c9f28d8e46ce4e3d9bc051f8ce957dd1108948d600e862", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212310, "uuid": "09849f39-22a3-47ee-a7dc-126f15535fb2", "comment": "Malware payload (VIPKeylogger)", "value": "afd734465bf6c2f8a4f90c7423e4b3572952e2db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212310, "uuid": "723fc345-cb53-47b1-855b-e5e2ff46f1c5", "comment": "Malware payload (VIPKeylogger)", "value": "0c29a8ac805ac87898af6b502138223ca569c27838dbf01db26b5b875fdb7ce47ff02e445153b23f20f4ca4563d42095", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212310, "uuid": "62728d76-02ca-4472-befc-0cb54d17d252", "value": "T1E7F21368B624067F4A5E1BC3F70A9774C3554BD24AB62F5E030216CB98EFDB0C79852E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212310, "uuid": "351a22e4-22e3-41e5-a4c9-d1e73b7cc82d", "value": "384:BOWDkBRAHs7adsMydvpCtK32fQ4JWbOApHVbac:BOWDkBRAM7msMydN32fBWbOAp1bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212310, "uuid": "bede5dcd-c593-4fdf-ba23-d0d3d0ca7d0e", "value": 34845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212310, "uuid": "0c1e369c-28b1-4fa8-85ec-00417399c298", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212310, "uuid": "578f32d1-452a-4060-98c5-7a29aff1cc19", "value": "af36365b7594e446c3e915f9f8b6b011.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea7ce7f-13ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772182659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182659, "uuid": "80765670-a0ec-467c-9969-7f30fc36680e", "comment": "Malware payload (Mirai)", "value": "eed9c35820016ecf477b438aca084303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182659, "uuid": "84124091-5253-4c65-b1be-7a1959a05a61", "comment": "Malware payload (Mirai)", "value": "e79fd463358212803619f8d5737cb19cdaf051ae132deb927d5df2e59f94f614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182659, "uuid": "986af25b-e219-4df3-aa11-faf5554061d9", "comment": "Malware payload (Mirai)", "value": "0c8e1cb178e4d39c685eb22721f5d4fb84310c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772182659, "uuid": "7ce6a561-1670-487a-8405-4e3376c7667d", "comment": "Malware payload (Mirai)", "value": "ae8199824b58f8d1295a70f8df6bb4d8e499acb115628962db4498493e0bd70f4048c02875ae55c759f2fb292fde5eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182659, "uuid": "ba7983d4-2a96-45a8-9924-f852c7834a2f", "value": "T167E30941F8405B23C6D612BBFB5E428D372A17E9E3EF720399216F25378686B0D37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182659, "uuid": "0b6c9b2f-e1b0-4a14-8bfb-c329663769c6", "value": "3072:entcNiS6ATkdZ0PWVr42gwNkcjpQNMivd13Q:enRHfAQr423NkOpQNvFRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772182659, "uuid": "07c17c18-4c84-4107-9080-a42495686677", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772182659, "uuid": "dfede608-4a06-415e-aa76-d8d763262164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772182659, "uuid": "2303152a-0a0a-4a1a-818f-212141aef213", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4b16ee-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223998, "uuid": "1c185e7f-2120-491f-8cf2-47e4aec55305", "comment": "Malware payload (Mirai)", "value": "7b97d6d78c06793cb9da2cdcf571bcb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223998, "uuid": "15f7f482-783e-4356-a4d0-44ab96f18756", "comment": "Malware payload (Mirai)", "value": "e8069ae740b95f00470128daedf357bd68578cab26a188a4380c51cbbc745ca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223998, "uuid": "fb775968-9b49-4283-a28b-e3fb404d7bb0", "comment": "Malware payload (Mirai)", "value": "f7aa188bf89ebbc5ab7b2931074ccb2da6f21fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223998, "uuid": "272981f1-1fe6-4f00-9d77-1247c14250dd", "comment": "Malware payload (Mirai)", "value": "5f4b44c0d9d8f80057164f6a08c42e3cea1c0381c3ceee54e21dbad5f2cd0fad93ed62c4e331efd82945998de3ae4066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223998, "uuid": "fab3e083-69e2-4b83-a57d-e361ea8cc7b5", "value": "T1CA735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223998, "uuid": "866e5d6a-e041-45a5-8cd9-9eeb21cd6340", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fV66t:IfmhxCMRkg7IF+7S6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223998, "uuid": "46aaadbd-fdf4-47a6-834f-1ff3ab6f477d", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223998, "uuid": "b7f45a54-715a-4754-8956-a2fdd454d2ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223998, "uuid": "5f150c38-8258-4b20-981b-3296b8c925ec", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b81e27a-137b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772155596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155596, "uuid": "0ba83ee8-5976-4b3c-9efc-b382d3a90c19", "comment": "Malware payload (Mirai)", "value": "8995b9d617b3dd0e09766718a2e536e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155596, "uuid": "299b627b-c846-43c7-a37d-250b6d1f9b3a", "comment": "Malware payload (Mirai)", "value": "e809fab39d54f7e46e4c164858b7900f6b46981a9de3d8c6e3d611bfcb0c8c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155596, "uuid": "f0a13a37-9f24-4e91-8bd3-0a02ca5640bd", "comment": "Malware payload (Mirai)", "value": "6ae7bde470f88f9d738380f2b7bc2d55d3932540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155596, "uuid": "481e7a45-f6ec-4ec4-bfc5-b05d171072bc", "comment": "Malware payload (Mirai)", "value": "6506cb034f478a5331e2d60959cc5950dca25119dc8ded9d54563db71ee8aac1787c5f9131a6dabfb0f23f60e6f38bb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155596, "uuid": "ca395381-2777-4725-a312-7c5af9c9961c", "value": "T1F113F785BC918A2AC9E427BAFA6F418E3321B3D8D2DF3617DC111B147B8691F0D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155596, "uuid": "d8cc48f8-571d-4fbc-ac0a-fea012eb180b", "value": "768:rrPw5kZ//DAdGWc8RuP1suK9EDfkaI/TNlUqel4WvLMkvWHOEUNc:AaZMkERpuKKDfkaIBCkWLGHOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155596, "uuid": "d5263f81-95b1-4fa4-8568-3709c5472cce", "value": 43092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155596, "uuid": "80e1955b-1d6b-4147-b6c6-baf1e7424b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155596, "uuid": "12b5f690-1829-44ac-be4d-f9509949c710", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c75f4d-140a-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772217028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217028, "uuid": "6411115e-d467-4502-bc55-9ee64e4c9706", "comment": "Malware payload (Smoke Loader)", "value": "a3572471dbd275b470ba42343413388c", "object_relation": "md5", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217028, "uuid": "983f5305-7f95-4f6f-9fbf-c864830df621", "comment": "Malware payload (Smoke Loader)", "value": "e8e64cc6c938061a1017434f5341b758d1b9bf8bb457195ac4d42530ba723e61", "object_relation": "sha256", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217028, "uuid": "b38a85d9-6e32-4d36-9590-88c34fe1b481", "comment": "Malware payload (Smoke Loader)", "value": "5d40f170a149b22360814d559db78631b0ed79af", "object_relation": "sha1", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772217028, "uuid": "28ed8429-f451-44fb-9847-7702323cfd79", "comment": "Malware payload (Smoke Loader)", "value": "9baa4de1c9b3a63c9b6230893aef2784d3dfde61772353be70e6fc963630fbfdae623fa09bba31fcc826ade161de206e", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-122-75", "colour": "#0825A1", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217028, "uuid": "5bd1c500-0625-4d24-a097-3f0d87228196", "value": "T17877BE17B7E840A5D0BB9238897B5716E671BC210B3097CF2254B66E1F33BD05E3A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217028, "uuid": "3d97efac-4c0a-4db7-9f32-0d279c41e613", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217028, "uuid": "54ab8604-7190-4917-86c7-669a873f6d9d", "value": "393216:vEyH0FJnq7gTJMrYnrHluY4KevysJgQv3eOzOKXaT2V5BNoQvAJ91Lufuf3/EHjX:vE2VrYnzuKevRJgQv3SQvO3qfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772217028, "uuid": "c336ecdb-7f1c-46e1-aa29-96b89b22ab07", "value": 34284032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772217028, "uuid": "f9a8e497-d0e1-47a4-98e9-8e11c70b624b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772217028, "uuid": "e0610643-a46d-4d0f-99cc-1d0a126ab2dc", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bf1534-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772210770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210770, "uuid": "3ed6090b-ca8c-49d8-aefd-6b09fb8fdf12", "comment": "Malware payload (GoToResolve)", "value": "69df4e7a5f745318c650c38c98341343", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210770, "uuid": "c29558ca-810e-421e-9633-22aa7f85d7e5", "comment": "Malware payload (GoToResolve)", "value": "e8eed1f14fdb46bb0fa0a7f75b24bd7917264203129f6850f6faeb446d46b53b", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210770, "uuid": "63cc8fd4-cc12-42f7-8844-41ce1bc681fc", "comment": "Malware payload (GoToResolve)", "value": "64c994c28c01121112d894aaff3067f6e47b4b41", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210770, "uuid": "af5a517d-bbe3-433f-bc48-548584fb9238", "comment": "Malware payload (GoToResolve)", "value": "9555bd50562d69e58acd13a45e0cf953113a79f69411f49f37bd1325221d5bbe21229765ec0eb531270a0e4921e3bc1c", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SSA", "colour": "#E62225", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210770, "uuid": "ba693c61-4d7d-417f-8e8c-4344ee0af316", "value": "T1323733173988C571C6AE01B25468AB7E967C9D210F7105EBF7EC7E4D2B303D36A3264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210770, "uuid": "f7765d22-91bb-4f72-99da-713e5a10f231", "value": "393216:OuH6t/ADslrnxHHiACqwWFgvUX0TE5HkCshd2t1Q7tDjy1bpJs8zoajmG4cKhuEf:tH6ZGsBxFCQEUX35dsAtO7t419mz+6qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210770, "uuid": "ee954822-771a-4267-8c79-546224f7320b", "value": 24526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210770, "uuid": "c96ef292-a990-485c-a9f2-7ec146664139", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210770, "uuid": "012138bd-535d-4cb1-a7e8-b3f30f3178a6", "value": "SSA ADMIN_STATEMENT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e1cabb-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177912, "uuid": "931e1a7e-a11a-409e-9f2d-a4c5c749230f", "comment": "Malware payload", "value": "b8f3cc58fb1ea8b3e49685a970c63fd4", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177912, "uuid": "81a2f86d-2f57-4114-8cb9-e77e055d3950", "comment": "Malware payload", "value": "e9d2354002610f3646404ef00f340f596242aa90e9ae7c8bcc8af92e22145082", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177912, "uuid": "e2cf78c7-b5e0-4170-8e7a-b0e7704bcfd0", "comment": "Malware payload", "value": "729aab528f17f58c65e9f60584930cc80b9f09ec", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177912, "uuid": "203e6b63-7930-4e53-a135-4113cae9c586", "comment": "Malware payload", "value": "4fa696b127504ff0475451ae2beca934fe6486286e99d72183049ca7d2307d485e8fbe380ef72e16529aa35e1c90f774", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177912, "uuid": "33e1a5f1-725f-41be-b148-b19ed626c329", "value": "T1A093181127978369D7AD5A74FDB0473906FADB063117D3AE0A50626DAF923CC890EE32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177912, "uuid": "e6e74d3d-e242-4c71-b6c7-59db9a890510", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177912, "uuid": "51d8681d-9e15-44bc-b842-f9d661e80fc0", "value": "1536:trAxFMLJIDiSsPz4r2li4IZLHt0+gO4j0:JAxFxDiSsz4rz4I/0EI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177912, "uuid": "f6b87cd5-a514-4726-aa0b-6bf571831e3f", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177912, "uuid": "a87edda9-581b-4ceb-8421-ecf7b00d1007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177912, "uuid": "89c618f4-588e-4a39-945e-394be04e71d9", "value": "msapp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79784cb3-13e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772199884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199884, "uuid": "8d7e975f-b506-4040-b42a-e574ae2bdfb1", "comment": "Malware payload", "value": "394e87873dec7ce7e083b45067d9b16b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199884, "uuid": "6018e2fe-e85c-4f01-885e-979ae83eb89d", "comment": "Malware payload", "value": "ea6f705ca2739b0c87d1912a59ffeb9c67bdb103c44af8f09b294eb9e613ffa6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199884, "uuid": "db41ed39-baaf-45d6-852b-4cd268f32a4e", "comment": "Malware payload", "value": "6e450ce9a8976dd5891dd3629bbe1b36dcd1d776", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199884, "uuid": "71f752fa-0ef2-4564-8099-2723ee53b311", "comment": "Malware payload", "value": "d6e811d7440132bde12fd5942fbd244188091df073447d6adbda17499b484f7313fbb089f9ef194b71ff68b8ccc5b085", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199884, "uuid": "742df030-2b4d-48df-93ad-edf350946336", "value": "T1D5528A3721F08B32D7D061C8A2671B614F72A60B456724B8F4FE5B259F2DA0374EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199884, "uuid": "3fb53501-dd1e-4108-91fa-3c0f003a2ac3", "value": "192:cCur6p4hvZ5mN9oKNpivvV6PFITVaHvhF:5p4hvZ5mN9oKNpivvQPFITVaHvhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199884, "uuid": "8e77962f-48f8-48f2-869b-67cba5cebf1f", "value": 13569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199884, "uuid": "2f28a69c-79e9-499c-9852-47a4da049110", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199884, "uuid": "95f979d8-e1f2-4659-879b-7f79c265ed2e", "value": "ea6f705ca2739b0c87d1912a59ffeb9c67bdb103c44af8f09b294eb9e613ffa6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07cecca-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772211573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211573, "uuid": "caa6b3c7-9691-42ac-b97e-7ed249b25ee4", "comment": "Malware payload (RemcosRAT)", "value": "fce0471de52460246cc42afd1f47f5d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211573, "uuid": "1d66868e-271e-44b8-9918-08479018b083", "comment": "Malware payload (RemcosRAT)", "value": "eae6a4c5d87b8cf77b73626857ce4ace839e9edfb20ce72c46d162156be140cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211573, "uuid": "e4fdc814-0a12-4034-bf0f-742492d52d23", "comment": "Malware payload (RemcosRAT)", "value": "a4e1ba207b5ec66fa000e7e8fa5cf043f64cf2cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211573, "uuid": "b79a1797-3d5f-4da2-b8e0-e62289c05648", "comment": "Malware payload (RemcosRAT)", "value": "e1884aab7358093dfe26a5aba6834ab7e97aec4dc169a72c784fd8e244210408bafe093889a2f7870fa675c43ceb2622", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211573, "uuid": "d0bbc598-5c4c-4155-af1f-65b1e8bf773b", "value": "T11135F4338CED26F522DA382697EB69F50C3508C4BFC36529DE4C81EEBF4561E58162B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211573, "uuid": "ac11edfa-e8c2-4755-b018-854c43f5b0ea", "value": "96:LFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFa:LgBQcU6OE1XZv8UVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211573, "uuid": "20d7fa7e-c191-4178-b0b6-6b48890bb72c", "value": 1143983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211573, "uuid": "0fdd505f-58b7-494e-8c38-580be932435f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211573, "uuid": "d02979f0-54d1-45cd-9ccf-ffd1a91270e4", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d87b3c-1386-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772160420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160420, "uuid": "667bafca-4c67-4d52-9878-252c361090d2", "comment": "Malware payload", "value": "8958ad7b3a8f31b9fa07836d45db562d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160420, "uuid": "4eb251c0-5797-41cc-974f-9eadd1aa7685", "comment": "Malware payload", "value": "eaf774319a523aa423c0a1edc693f060ad108d9570495a38549efd0c16953af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160420, "uuid": "b3a2d745-de96-4dee-a162-f9f02cb7db0f", "comment": "Malware payload", "value": "c3496c96c968bde177aa47f3c701c6b660c8c48a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160420, "uuid": "dcd34718-a67e-47fe-a5e7-1c3351ada827", "comment": "Malware payload", "value": "283a093d7ccfd63467b24f0c6b192602a9617e6be7d931efbfa28cb699024e0966837cc6b00a25b9a65329ea9b1b9e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160420, "uuid": "48e450bd-21b8-41a3-945c-b190747d817e", "value": "T1756302571C230B75E7359F3592768E703F79B521A7CE43A2C6E8D0630FAD312C29A689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160420, "uuid": "42dd83ee-6676-4a4a-b38f-b651e85606a7", "value": "8efd347d961f811985fc96a4b4c4393f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160420, "uuid": "35ccb4eb-0ff8-4f6d-80d0-88966fd6d9a0", "value": "1536:BwcROFzYurGLwH3JcNR/77YaGmpJinfdArE5Z86ztT9d3c8+K/q1OPRJR:fyzHdXWNRz7YciOrEr8KV3caq1+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772160420, "uuid": "58ccef20-46f7-4ea6-9598-a7ad7e57bb88", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772160420, "uuid": "b4fa699a-57a2-476d-8da4-a2e2bba27600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160420, "uuid": "442b1064-5fe2-4264-9c4d-59fc351f51ad", "value": "Cs2Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f67d3c-13ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772205052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205052, "uuid": "0789aa0c-8e97-4dfa-9a6f-698210627d51", "comment": "Malware payload (Vidar)", "value": "c3386900ff75beb655f599b7ee2f3037", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205052, "uuid": "2bec8052-8deb-4c4d-833a-d730625ed0cf", "comment": "Malware payload (Vidar)", "value": "ebf147af0097ac710001e7088fe641e78ccb2aa691abf543a1fb5bad97a79887", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205052, "uuid": "c5412e1b-ef6c-44c6-9769-1f5383f9e749", "comment": "Malware payload (Vidar)", "value": "e50da867efd32098071cb1ebaac57e19d443a4e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772205052, "uuid": "5ea36df1-8b67-4633-b850-f6dfdd3c7522", "comment": "Malware payload (Vidar)", "value": "ce9da9dc2dc58789eee7f9682e01bf3801059c0eb2e53a233fa239c55cccd22020868e67ed69169bad266caef1fe2d71", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205052, "uuid": "2230a45b-5164-4433-a0ab-92a47d554723", "value": "T188D57C17ACA148E5C4AE93359CB222827B71BC090B3263D71F907A752F737D85D7AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205052, "uuid": "18d2068b-4cd6-4de7-8c7d-259446b54390", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205052, "uuid": "e6241572-677c-4a60-af16-2d20ab6a2444", "value": "49152:s5O9pu0mfpgK0f+Uda7BEMG3lvcYNOty:s5ndepRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772205052, "uuid": "538d7088-b079-4472-a470-4fb27f5ec9c9", "value": 2781696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772205052, "uuid": "d69e2fe6-65f9-49fc-b69b-66b24fbf8885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772205052, "uuid": "77d2c807-4976-4e71-b976-7b914347b674", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82815d6e-13e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772199040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199040, "uuid": "b9b1f0ae-55d9-43fe-9c97-c0abccb1a876", "comment": "Malware payload (Mirai)", "value": "f494a17ec57c80bd490bab8dec8171f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199040, "uuid": "a1d21438-5a56-4c46-93e4-7d9263bbe4a0", "comment": "Malware payload (Mirai)", "value": "ece159243759e54fdec58b2945591edcc0d4e94603a447ad94f51e0081310ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199040, "uuid": "0c243d40-84ba-495f-a02b-8c5a17710b03", "comment": "Malware payload (Mirai)", "value": "eb924a1b974cdaae7dc7e371378151a21a27fd52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772199040, "uuid": "dfaf5d05-9d63-4047-bd4c-69043b7761b0", "comment": "Malware payload (Mirai)", "value": "4d0b468c60d4886368c2aed9ea572e7575ac943ceaff822e134714973f372b8a747ad169330c359c140b2f86b59e4999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199040, "uuid": "0f43aff4-24d2-4725-a32b-5fac699532a8", "value": "T19BE33C05731C0A07D1A32EB43A3F6BE193FFAAC121E4F644255FAB4A9571E361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199040, "uuid": "ce28e359-ee62-4484-a1c3-110e1586ae3e", "value": "1536:G+t5NRN1roBXIWkuGxfTISEPE8QBcR/7Cg4cMvAqj/zbuhTNcqaEGhIq/qt2:ldtrTWkuGxpE8P+7h4cqBF/qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772199040, "uuid": "892810a5-177c-4f55-bd3c-9c1156d6164a", "value": 146356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772199040, "uuid": "41fa9cdb-f530-41c1-ac0c-7aab10fcc5ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772199040, "uuid": "ff926e5b-b3a3-4e98-a819-9f03ffbe1d0a", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0af09e4-1386-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772160436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160436, "uuid": "17711f1e-cfc6-4d9b-a535-b01ef5020abe", "comment": "Malware payload", "value": "9a5da4e75f7788f2cec23cc87c9992f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160436, "uuid": "0f0f7702-7f0e-4831-96d5-b992c4909763", "comment": "Malware payload", "value": "ecea0ae8314b5b34614388a9a42e43e032c3e6650421f7fd71846e5f1f230f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160436, "uuid": "dcb5616e-0286-4089-8d7d-2c9013c8a207", "comment": "Malware payload", "value": "07e285e12d98d2e75588319b9ab7965ae1880d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772160436, "uuid": "4882aaa9-cdbb-489e-94ab-6e823e1dfa40", "comment": "Malware payload", "value": "37d43ac546a6e46d78022de1d4cecef5bcb968751f2648e179710cd8d1cfe680c269388b2d7a97877eae5aef53c51efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160436, "uuid": "104acf8c-04fd-49a9-ad3a-dd4f0da91a1e", "value": "T120F31903E68670FCD566C5785656A132F632BC624B22A9EF07905B352E71FC0BB3CB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160436, "uuid": "c27becf4-e1be-4e97-8a67-aa9e98f2c423", "value": "0b239b2e24f947e6eb7cac795d0de7ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160436, "uuid": "b896a8e3-ed79-4b22-a49d-29ffe2fff9df", "value": "3072:/F4eCASUDbioOczMiOVYi0ZTVKlXb6z+IWYR27fXszNdEtGZtEN8tkxDRd/o:meCAgoDMiFklhlPXgNdEtGZtEHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772160436, "uuid": "a6452b7e-90ba-4d2d-ae05-456642ff8308", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772160436, "uuid": "79509440-7d19-44fd-a051-3af67b270efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772160436, "uuid": "61f854b0-0eec-4c9b-ada1-40518d4a0820", "value": "Cs2Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deadb512-13eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772203919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203919, "uuid": "1be327e9-b99e-467b-b519-a244c2e0bf9a", "comment": "Malware payload", "value": "7ca960866a1e8be36c5806fe05c6772e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203919, "uuid": "bbef9049-a12a-4c40-972c-c0963dc10d40", "comment": "Malware payload", "value": "ed0a2246ae7d4ed2b3a0322c19ffa99a3d103d3faff3df53421c320cfc3719e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203919, "uuid": "6218916b-383e-4bd3-ad71-f975d54a444c", "comment": "Malware payload", "value": "7c320601991cc65c8acdb14b3041d94f0bf95c69", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772203919, "uuid": "827115e1-cbbf-4e6c-9628-4931686e6c83", "comment": "Malware payload", "value": "e0f698b29c56d6529b914eaeb034260126f36119053f87d60d52540e4511b6cec2bb659b229a4ac0cb576319ed493c79", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203919, "uuid": "500efbaf-01b7-4d60-8fc1-40f0c1c8ad9a", "value": "T11451397024F11C732A256540B2772B91AFB3EA53496323CC39DE1F2A6FC6B03A59F421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203919, "uuid": "69321be6-28d0-4ca1-9aa5-398dcdedcb37", "value": "48:csRu9RG6B6gId/iPdFHPwWYccrmZZcr8MHcrivdcrEmUbl/b:cCuy6B6v5ioP5UX89b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772203919, "uuid": "ff668f34-ecea-4d9b-902e-5b1361138100", "value": 2935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772203919, "uuid": "b05cc16a-1cbe-4542-a8e8-a799e539903d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772203919, "uuid": "e5ad096a-a9b5-4c80-8abf-249cadbf678f", "value": "ed0a2246ae7d4ed2b3a0322c19ffa99a3d103d3faff3df53421c320cfc3719e2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a078a5c-13e3-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1772200127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200127, "uuid": "382c09d9-a3b6-4422-80fa-d9016a60ad0e", "comment": "Malware payload (SimpleHelp)", "value": "dc7c27785a6f7509d39d236de24ddd1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200127, "uuid": "1dc26848-e43c-477d-83f2-f8518c175418", "comment": "Malware payload (SimpleHelp)", "value": "ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200127, "uuid": "8e4a787c-e062-4c5a-9cb7-0f87d8f143d5", "comment": "Malware payload (SimpleHelp)", "value": "c78702cad05c3512a5d31081d16df0e5a8cb03b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772200127, "uuid": "66f2e4c3-171f-4a27-b800-7db05cb87b2e", "comment": "Malware payload (SimpleHelp)", "value": "6f7980a3cb1741786250f5de04070e4f067124340b34e3ffaea940d9b47b14ad59e47e56d59da88329ab27ea94398348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200127, "uuid": "836a67ae-822f-4f0e-a1dd-4eb8cbc79898", "value": "T11D373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012327F1C6D28B213D4542EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200127, "uuid": "4f5a3974-b146-4e90-b819-50b6f189c486", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200127, "uuid": "99f497e1-9708-4572-ae1e-09f55998748c", "value": "393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3H:+tobo/qEVooAZNKYeJPeTe9B5JWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772200127, "uuid": "37d49782-3add-45cc-bcdf-69582913d548", "value": 22855344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772200127, "uuid": "e39f542b-1882-4ea0-8a02-8f2a1f389b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772200127, "uuid": "ec524866-9d4b-43e0-bc52-823f85ba2273", "value": "Documents-Court#743673#7596770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee40a006-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212965, "uuid": "434889ea-b45b-4f44-96e7-367a2234be48", "comment": "Malware payload (Mirai)", "value": "734a26e3cef6eee0d32c97917c37672b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212965, "uuid": "5f2c8df4-3c17-47d4-a0bd-74ec2a01b10d", "comment": "Malware payload (Mirai)", "value": "ed9a6caad952675001c179795deaeabe1b09fcad8007bf40c4dca55a8f1b181a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212965, "uuid": "562b7787-8d35-4a96-9d0f-ff396c10d895", "comment": "Malware payload (Mirai)", "value": "a7c10325a24d829c4a4ea5446cd1e530a37ca4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212965, "uuid": "f8ffce28-7d09-4c72-b8c7-b2b0aa16a327", "comment": "Malware payload (Mirai)", "value": "02d649ae27ae2fe5089ac9d4c30eca63e043bad6af8d246b1c0ae338fcab235d4dafbed57c8a8da7a2bde934ca4d7e05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212965, "uuid": "8c00a875-dd56-44eb-873d-d038faccabc0", "value": "T1B6330238F5657C558DAC5820EFA806496C7B1EED5BE6B0B60E0851AC38D500A2FA9FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212965, "uuid": "9263c5d9-1639-4fc8-9b39-88d3e05b0634", "value": "1536:wSsS+awMidEUps33JMzcWiZc+0dYDx7IzPdeInfqR5L94:kvMidvGnYdyc+028Vjf25L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212965, "uuid": "a3f7745e-bc7f-4143-8431-8e9327f284d3", "value": 53668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212965, "uuid": "7ab6b6b5-c8c2-43f2-ad06-ae21af9aad67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212965, "uuid": "b14d5c46-cb4b-4993-be10-13f70a09c466", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710ef52a-13ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177107, "uuid": "eafb6223-a9f1-4cdb-bc3c-bbd511c3986b", "comment": "Malware payload", "value": "9e889735c69ddfce6043c6b6d1643837", "object_relation": "md5", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177107, "uuid": "ffd35cba-ab25-4da5-9f8a-8b15ab72d0cc", "comment": "Malware payload", "value": "ee359a7e20cab3f911cf31861b75695b8a8714c28900f8f96d5081764801a4ed", "object_relation": "sha256", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177107, "uuid": "635a42ef-d609-4fa6-aaa5-15b94ec8a24f", "comment": "Malware payload", "value": "25e8b8ecc04fbeb8f46dcc018efbb544b5e7372e", "object_relation": "sha1", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177107, "uuid": "c77102a9-5e31-430a-8499-0b007b763d9d", "comment": "Malware payload", "value": "3bcfe6d9ea511977f441262ab3b0a5c1279b58cc3e78743f42daca177d494d94f2e43847cdbe64e3a383f66ba08bd395", "object_relation": "sha3-384", "Tag": [ { "name": "webdot-ddns-net", "colour": "#2F79FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177107, "uuid": "b374c127-9566-4f98-b847-43f6d182eb66", "value": "T173D18D5762485238EE72D0A6933C73D2167A7E80C565910EE7CD71346120E6F3FC6A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177107, "uuid": "5c787a15-cf49-4d41-8260-80b6c9751950", "value": "192:UmlhnVOFTi7ohJjTjTjTjTCBLIDTmS7Wp9pfgiYDEI566666J:fqTqk9HHHaGSSkWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177107, "uuid": "7b721d9e-99e3-4b0e-b86b-13efec134cb3", "value": 6712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177107, "uuid": "1d0a571c-7485-48fe-bfd4-9431e96142eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177107, "uuid": "06396263-50b2-4445-9ebc-0fa7af7386e2", "value": "ee359a7e20cab3f911cf31861b75695b8a8714c28900f8f96d5081764801a4ed.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d7af93-13af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772177819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177819, "uuid": "9c88deea-6b68-42f9-9068-89373cb3125d", "comment": "Malware payload", "value": "85afce804fb9744aa7e363aed5f9a2da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177819, "uuid": "ba21b0f4-1d20-4e70-8080-7020c53e5b0c", "comment": "Malware payload", "value": "ef0ef1f57a3c06824976153b34029e4645f6ec3a96c5febd00a4c777ff724281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177819, "uuid": "e9a6c2aa-fa67-4e45-8359-c0b1f52828ed", "comment": "Malware payload", "value": "e5ab84c04d3481fb2610188ed8f5627d04d4ba1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772177819, "uuid": "671b1379-60f2-40d7-baf3-276f2e44849e", "comment": "Malware payload", "value": "1d5240b77d9a3b213393aa7f6b55513917a621cdbd97835ede1c5a5b7a485ea0f8f994c53e691fa1f45954202d4c9535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177819, "uuid": "25b27bc9-39d4-4134-84a2-04714b7165a4", "value": "T19A84238EBBBE36C5CDE138A88565CB9B8ECD475594BECA051CFB958C03A1013DD22F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177819, "uuid": "eee5fa88-a0f1-45a5-9db6-1ec73d220779", "value": "6144:66oJxyKwdJ3uPSRfC1dO5NM2fM3YVdK9Z6Mhpx2ywxSJx14kpaB1NoWywoOetgWD:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772177819, "uuid": "bb23b692-db17-4290-bc76-6a99f8954d35", "value": 384042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772177819, "uuid": "a6927a2f-f5fe-42c3-8eea-15b7e84d75e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772177819, "uuid": "416a5b50-9330-49cd-abd2-050b9da1a605", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f14364-13fd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772211609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211609, "uuid": "b2f03852-9db3-43ad-8849-f22669297702", "comment": "Malware payload (AsyncRAT)", "value": "36212cdb5564ccd9db235ffea0023766", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211609, "uuid": "002cb300-1b80-4ac3-bdca-5642cfb4cd07", "comment": "Malware payload (AsyncRAT)", "value": "ef3642f0f0ac54e1f99126563cc742c212977aae2ec3f3ce2583bf6589f425d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211609, "uuid": "0fb4c329-3593-4e05-9f96-03bfe814dc12", "comment": "Malware payload (AsyncRAT)", "value": "0c52d392e57f01184fc801dd6b048eea27da6f3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772211609, "uuid": "5f510ebb-d06c-4dba-99c7-c99d3eaf9a88", "comment": "Malware payload (AsyncRAT)", "value": "7b23e1f84142a91b1eb07c8866747791e2a3d6289d357ce4df8d3dfa1f35e02fedd42653c4c3c03c98d2ec9213e3e8bf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211609, "uuid": "fe5a6f2c-5882-4e19-9562-9fe7a955b4ef", "value": "T1BD161263189003EF90C8A82E50BDA7C1DDE689133EB2DFB7795589DDDC461DCE887226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211609, "uuid": "f7087d2e-c904-43e8-ac8b-3948ba29ef82", "value": "768:1gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg0:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772211609, "uuid": "cfbe1a68-af57-4997-ae68-efffa5ebd960", "value": 4325336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772211609, "uuid": "a7d9a7d6-8595-419b-8ffa-39f2ae9ee7db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772211609, "uuid": "72e44c92-948a-413f-b33e-b9b193f043a8", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4fdba5-1402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772213851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213851, "uuid": "e8a0d0ad-98af-415c-8290-b1c378e0fd38", "comment": "Malware payload", "value": "5c8982f64dc3fde82bd9ed5324f6443b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213851, "uuid": "8c8f5bbb-c0bc-44e0-9643-6539b206ed05", "comment": "Malware payload", "value": "efebff3e20438ccc7f1a487c07321c56468440abf49f665dd29386d58dddd81b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213851, "uuid": "79b4749c-3970-4193-b28d-3303c4ac9f0b", "comment": "Malware payload", "value": "275e941e3c89cad10faae0129889ca898dca5c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213851, "uuid": "2bfef9f2-f427-402e-bb73-f49658ed78f4", "comment": "Malware payload", "value": "5c6e045f75707610c73a3d2cde00ee619b0c015245c2c61f13f5058f2c0307c18a7b213a4b7476c9df678daa3c9e54b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213851, "uuid": "6304845f-03b9-4dec-8b2e-c91013e0fd80", "value": "T10BB36B13B4C190FDC8D6D2744BDFA227E972F15A2238B26E27E16F263E5DE112B1D211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213851, "uuid": "7715237d-637c-46f5-8fa0-9ce1a8a91f30", "value": "3072:OYXQiQyoO8sEJKFBOfPGJpbiUHfO+q5ssDqvcuDiwtHoHsEkJo20NoxOkxx9IxxR:OYQiQPs5BEPSpbiUH2+q5bFuDiw5ov2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213851, "uuid": "50e81717-cb39-4195-839e-65d044687486", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213851, "uuid": "5aae823e-b779-47bc-9d62-d694e1776937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213851, "uuid": "cf153ed5-c98a-4fcd-b17f-beb4506d13dc", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea1ed31-13fa-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772210415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210415, "uuid": "604ce4b1-1296-4b8d-b151-055aa567b2fb", "comment": "Malware payload (PhantomStealer)", "value": "62b4563e05a19ae79b05c4c51cbba5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210415, "uuid": "2c63db8e-f596-4b8e-8304-e7dae607d1e7", "comment": "Malware payload (PhantomStealer)", "value": "f0210da3603f43d66ac5fd9ce665c9bd544cdb66ec47d30b03b8191a6c1c09dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210415, "uuid": "d05fde5e-7f2d-4e47-bac8-b06fb8c3baac", "comment": "Malware payload (PhantomStealer)", "value": "0c02bdfd404bce6724e7b767491b238c16345216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210415, "uuid": "36913c3e-d368-425c-ae27-4bc94f107f0a", "comment": "Malware payload (PhantomStealer)", "value": "c364fb408878ee90240ee1730b1e0249c944d6341ba6378a5b16238234456b123261f5c837ec3c1850c17457bbbb394f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210415, "uuid": "969655c3-a74c-4958-a0cb-358e777715ea", "value": "T1CD75025427A59C1AC77D473659A0F1789774CE9BB111C24ABEDD3EE77B2AF000A82383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210415, "uuid": "e5072c49-f7bf-47ed-8174-8481c6c25e02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210415, "uuid": "f101bc81-fef0-410d-9ce5-5da4d3a0fffc", "value": "24576:97/k9mc44Cjl7wrHZd0wlYe0mmvlUfMwEAonf0pTop/J6emd1N7E/Z6I5aO:9zk9L47aNdffeodonf0pTQ/8ei7qZrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210415, "uuid": "03057286-e70d-4119-8487-eb9c5b4bed65", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210415, "uuid": "d70fcc60-75d2-4c58-95c8-fa40d3ac26bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210415, "uuid": "6bff9349-bd88-4a52-8361-03ef129dc678", "value": "62b4563e05a19ae79b05c4c51cbba5a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ee7458-13ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204625, "uuid": "d1f9ac8e-4d32-4e17-b004-44ae2d687cdd", "comment": "Malware payload", "value": "cb3376b896ddb0cbde792d51682dec96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204625, "uuid": "aefd915c-2e62-42d8-b784-f9a17295e982", "comment": "Malware payload", "value": "f15f864bfd637a9577813fa24e7a77b64a7a098bad8f020f09f7dc067305dbd4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204625, "uuid": "5e11d321-88e0-4dfe-9c5a-43760e1c3051", "comment": "Malware payload", "value": "e128960519cfefb20864aa24d7ca26d216769a85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204625, "uuid": "c2014dd2-8996-4591-a164-196d70d82f2b", "comment": "Malware payload", "value": "5783f00918d483bdcac408d632ec46ea13932641eb64afcc6c516355eb1099ecc169804af0590e43505291893e63e1ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204625, "uuid": "34ed8b65-90ec-4fe5-8206-2d43a15c9ebb", "value": "T10E82AC3621F08B339B9055C4B3772BA54F769617456720B8F4FE2A259F5AB03B0EB720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204625, "uuid": "0da23e14-3bf7-4f90-b0c1-644ef8777f36", "value": "192:cCuA6p4hvZ5m5FG4j4HKNphvn/TONVLxo8vhM3xL+B:Mp4hvZ5m5FGGoKNphvn/TONVLxoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204625, "uuid": "91b44b02-8413-4f3d-a183-6f63d6572778", "value": 18072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204625, "uuid": "354f3e8d-1df1-4535-82d6-5cbe5909815e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204625, "uuid": "b4cc1171-e441-4e08-9c39-32ce5b85f871", "value": "f15f864bfd637a9577813fa24e7a77b64a7a098bad8f020f09f7dc067305dbd4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d967b81c-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209924, "uuid": "b60d0f4c-d4b6-4600-a1e5-ef0e7359c15b", "comment": "Malware payload (Mirai)", "value": "5f4a43173ed1bc23d3a524a3afd57f0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209924, "uuid": "58a454cb-8c2f-4682-893f-48f2966e6e8f", "comment": "Malware payload (Mirai)", "value": "f19a5e21890fd7c9cd91c023419507310c675e6b74d15417d52b805c1368ccc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209924, "uuid": "b2f5c7b7-2706-4715-ad42-e25052b14220", "comment": "Malware payload (Mirai)", "value": "13563ebdf37cac7c4a5abf77fb2415f32b648294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209924, "uuid": "588b4135-595e-484a-b9e7-c8f63704e59b", "comment": "Malware payload (Mirai)", "value": "3df9efa79f3f0f0d031e4cb870d9a3388acf9087f2704043065f221314bc8d23af55c71bb4db5a90fc8d92fc5c57a277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209924, "uuid": "afc28875-b37d-4b9e-82e3-357dc726df85", "value": "T1B2142A46EA404B13C4D627B9F6DF42463333979493E773069528AFB43F8679E4F12A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209924, "uuid": "8eeddd4f-24ad-4a14-846e-a1963060005c", "value": "6144:2R1aaBqbNragXnDWS24eLlBOIA0rM/RuRw:o1aLbNraInDWS2DFA0A/cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209924, "uuid": "1435a109-3bfc-4b8f-9100-d06b15d2da91", "value": 198026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209924, "uuid": "b0b1ce1f-8bef-45f9-9cc9-c549f170ab16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209924, "uuid": "31ab97d1-de67-46d9-bee4-cfea67df0cc5", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0648b845-1400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212576, "uuid": "4e31aa45-7a57-466c-bcc1-766619371881", "comment": "Malware payload", "value": "0baa6a0fb2372c597f16ff0b02e3a823", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212576, "uuid": "3e7c5327-3279-4385-9f0e-a3f4fe02e98e", "comment": "Malware payload", "value": "f1c84d94578f6b9eddb92ec17e17d289de7bcdcd26eb5d1ced114a8d9c4e96d6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212576, "uuid": "67ccc065-9a9b-478b-9b8a-00908d567e9f", "comment": "Malware payload", "value": "1ffeffe8013072838991292bead2d97a9e1baf9c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212576, "uuid": "d3bf4b25-ac81-45b7-b7cc-a7146205ee49", "comment": "Malware payload", "value": "0b593ada187283d93b1c104abcfe5cf5593d946f038b3efee8fd8c0bd8fe77d17831387537b8d5c141765128b43a1a61", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212576, "uuid": "3adca822-08f7-4e69-b52e-865914424622", "value": "T1CED512BB58B2B9435A904663E70F2C0A339B29E53A68D346DA51915C3F3B1D38F91733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212576, "uuid": "351ace68-3eba-44ad-aa4e-92587eecc041", "value": "49152:iOc2yD4lTPKa1x7HQSuhRcgaDNdoYn19DQ/u+pErTdVfsS1/CWn2:ioyEFPKazwStgs4uPD+CpVhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212576, "uuid": "6a9fe5dd-d960-41f3-956b-2595216c5443", "value": 2939799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212576, "uuid": "5099c251-268c-414d-a5af-c0f3af306e8e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212576, "uuid": "19c4905b-62cc-48af-8790-0ac791097d97", "value": "ZAM SHIPPING LINE INVOICE.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7099c8-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772212370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212370, "uuid": "46e1d401-92e5-44c8-b246-4a1318ac7e57", "comment": "Malware payload (Formbook)", "value": "ca74d48325ddc17c552df6c87ae89695", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212370, "uuid": "62eca1d2-b80a-4f0f-9e5f-c44e18e5cc92", "comment": "Malware payload (Formbook)", "value": "f1c9a309e468977e81b36253d9dd4aa59912fed1fadde9acf6c4edd3b5b61989", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212370, "uuid": "84bc73c7-7591-4557-a66a-ad389e59e17c", "comment": "Malware payload (Formbook)", "value": "6937a577a81cf07f1c63deca9e11def176e3cb0d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212370, "uuid": "fa74c0d0-7ea1-42f5-8afa-480f90ae3101", "comment": "Malware payload (Formbook)", "value": "fd0c1cb951931f7ad380782fc8ed216c224aa1fd42c728ff16b2488c5a39c7a7bb0fcb1ec935d82fa79cceea0adb66be", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212370, "uuid": "20b0e4eb-516d-4b76-ba00-c57363fbd72e", "value": "T13855D047FE4827EC5FB8F83FB0895D0E6F1157907485AD81B9673E01EAB07054A8EAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212370, "uuid": "71473bed-6130-41fb-b0bc-6982254844d8", "value": "12288:T6AyvKpaRGtiXcpI6u2uZs/ttG/hzNWyBtt6e5T++gGK2uXeCXnk8zpQYvp88cmO:Miie5G/VApNLuMEYgdCXj/DKoJ+Zs1Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212370, "uuid": "78e54a4c-37fd-4061-9e66-887582a45a5a", "value": 1331979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212370, "uuid": "7f8be88e-96f8-41c1-9ea5-6782ae58cdf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212370, "uuid": "5f4d334a-25ca-419f-8164-0f8fe4745bb0", "value": "ca74d48325ddc17c552df6c87ae89695.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abdf902-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190679, "uuid": "c7ec6ff5-9d48-4fc2-b8bb-c117e2f67ba7", "comment": "Malware payload (Mirai)", "value": "b2757dfc59254562b857c34a6203ac98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190679, "uuid": "68db72e7-8ba9-420b-876a-f6c73902ee3e", "comment": "Malware payload (Mirai)", "value": "f21a10b3ef988b58af67112540c72b1bbe48ab240b2cc561a6348f1483a35c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190679, "uuid": "289f5d0c-36cd-4f24-a066-85687a553482", "comment": "Malware payload (Mirai)", "value": "c1f2de972251e7a766f9fdced23d6c66c8b82398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190679, "uuid": "370f2149-d012-4e51-ad9d-573445773f2f", "comment": "Malware payload (Mirai)", "value": "93dea40140df48fc6f38e98db2864b6d2edb25c7c2bda5ea243dce9a8ac5917632274e32dce87f8ece396f26527d551b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190679, "uuid": "0e9a0673-f7c7-482c-9a79-7576d57c455f", "value": "T1C1261A87B8918683C4E42676ACBDC1C433632EB99B9B13576D05FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190679, "uuid": "213b0ae2-b84c-46cf-9064-ab77f0e9ea46", "value": "49152:1CRFiaTA2o/VjmZDAFdTrqatY1Cgmtn2RG5dUh1:kR/TA2YYZ8bttFn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190679, "uuid": "f2b3f8b0-a573-409c-b707-c9ffbb4bef53", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190679, "uuid": "26aba07e-37cf-4d6e-9eff-c9c234520c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190679, "uuid": "e03beb61-3e5c-4464-88af-c231551c31aa", "value": "android_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe8bd34-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190714, "uuid": "cb7365a9-c129-4dea-b4e1-11569ccb0453", "comment": "Malware payload (Mirai)", "value": "a3293fac3d1bea853e43aa8b3d1dd599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190714, "uuid": "1b681da8-1de8-475e-b6cf-331240b62a37", "comment": "Malware payload (Mirai)", "value": "f223bc55bad1bf9ba6ae9ba11f58b338bc00e8e0d4b50311b5b5c42a09a7c122", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190714, "uuid": "089562be-6ee9-4fd5-abf1-378946909906", "comment": "Malware payload (Mirai)", "value": "61f5ca848836c182bf290e6bd0fa68b05792d471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190714, "uuid": "e79ad371-702a-48af-ae04-f0e8bd570c8f", "comment": "Malware payload (Mirai)", "value": "fbfe0ef4d89535f8948e30c036ec4f98d56b60e6b3b797d57dfcec5a6b25a22b10c03895c0c757b65b63a8283bcd5807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190714, "uuid": "eb0f8974-c477-4f65-83c6-edad08855722", "value": "T1AF463811FECB54F6EA031A3144ABA26F63315D058F24DBD7EA547F2AF9776A1083220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190714, "uuid": "6fc2ddc5-908e-4e24-b44f-7953b279f762", "value": "49152:jDa9Nvu7Im2sjVRX1oy8Rg62ixeZXQT6zwzQdCERMwHlqrcRlwkt5E1:voNvZGjHXGy8D6QGMlHcTwkjE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190714, "uuid": "ec559308-1dc8-4492-b051-c00b56676527", "value": 5623992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190714, "uuid": "143bfc2c-1366-4d90-9434-885d903ed1ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190714, "uuid": "6841b78f-809c-465e-92a6-8eac9d527b2e", "value": "x866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288c6175-13fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772210486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "52f40442-9a99-478a-980b-9d84480481cb", "comment": "Malware payload", "value": "0662d559d283c16bff6177db4938746a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "12c08817-c6ab-4fc6-a248-6c852034cd58", "comment": "Malware payload", "value": "f2379598561aadb7c49aad9a08b566f23f096120a5d61e0e13357bb6999e356c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "c3c282e3-696b-4df3-b89e-6906c82234ae", "comment": "Malware payload", "value": "f986b24476399110fc96696ebba533269873c833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772210486, "uuid": "88330b67-b3e1-4cf1-a406-2134d1115024", "comment": "Malware payload", "value": "22e015ceee0bc663bd210858ab63bb5916aadc62bdce9f99ab7408187d6a06ead7866aa93328a0c03bc2545773cfb9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "af298955-5d28-41aa-9ea0-df6f8ec67e78", "value": "T18916E117E2A344ECC56FC134C3579772BE71B8194134BD6E1A98DB322F22E909B6E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "1fa380d6-6d0a-4856-92f4-06b0a5073658", "value": "ca637f7a818eada000dfd5a7891f723a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "2ec9a848-0023-4493-bd51-713003635d73", "value": "98304:8cRbep2WV5Ad3aDV4JJG/hPPv3ROD6E06tXJRlx1sc1:zopZB6tXH1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772210486, "uuid": "42f45176-8d2a-48cc-86c4-56aad1cb2558", "value": 4192768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772210486, "uuid": "15a5592f-f709-4cf4-b506-6b3d65867349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772210486, "uuid": "1852eb3f-765c-4ff7-b018-f8181794c408", "value": "84160465eba93db5fbf349565941fad3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae6007d-140e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772218731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772218731, "uuid": "887947ae-74fd-4218-8a69-cf54fd9f8039", "comment": "Malware payload", "value": "f9093a22da6ef773716aa3a78748be8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772218731, "uuid": "7a5fc6d4-99d3-410a-9520-9bd54c46e786", "comment": "Malware payload", "value": "f267497e16c04ab543483c0dc9c1bf3953e546023675a48056fd3d85b0925d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772218731, "uuid": "8c7ca4d1-ea0b-4c02-b48c-c010ded87eb8", "comment": "Malware payload", "value": "60e3ce104be2eb66ef96a22077d7b960753533d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772218731, "uuid": "285a9c79-1933-41e3-ad77-6b0ed0514cab", "comment": "Malware payload", "value": "b8ba0eb57bc260053cbe6bc7ab1263c49b4aaf72580d551c2ab4ca9f0e29f614af6969f9111e2ebe52e1df90f5d3ccfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772218731, "uuid": "b6373072-fdc8-4202-85fc-6de7151db935", "value": "T156F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772218731, "uuid": "71435c20-8f5f-4667-b0f9-8d7e3623c5ee", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772218731, "uuid": "d2aa7ce9-20df-4af4-bb50-abe86f05fe6b", "value": "393216:on1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:o1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772218731, "uuid": "9608810e-1e2b-4a40-9258-11ac2a9586e4", "value": 71502336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772218731, "uuid": "88a3ff74-26c7-4883-9cc3-c23c3d27a27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772218731, "uuid": "bdc4baef-cb1c-47c1-98ed-16dc03964982", "value": "Silent_Utility_v4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624088b8-1409-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772216596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216596, "uuid": "20d40b32-d61d-4999-9bcd-f387d0e9944b", "comment": "Malware payload (Mirai)", "value": "546bb71c44f39be88120fc51c2bea69f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216596, "uuid": "255a0e78-2173-46ba-b424-0af18b245be2", "comment": "Malware payload (Mirai)", "value": "f35f6012c18b9fef2425e35672ffd38a732de32318f10b976171373a26a24ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216596, "uuid": "aa2f152d-811d-4fa3-8f94-565faddfe226", "comment": "Malware payload (Mirai)", "value": "c2b03f0ac34bab3da59658f43e006daf95cd53e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772216596, "uuid": "02a55cc9-02ed-410e-bde4-3839989a7279", "comment": "Malware payload (Mirai)", "value": "888b950b2b1e0089cdb631c8fd35fb224bfb171cf83ce915584f8377d432a500104850236436dc6027d4ae5c6b835328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216596, "uuid": "a8942d6c-4985-4707-b261-a7b721575ff6", "value": "T16FE3F783F901DFB7F40AE37648A30816B530FBA60C524A76726779AAED391D51423F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216596, "uuid": "0bda667e-1a7b-452e-9d7a-710036cf2b0c", "value": "3072:2uhqohDGhiVKMWGyv9tlIoLk+WP7t78OiKVjjbiBLyGMJrNt:23ov5yvrlIUktZ8OKLyGut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772216596, "uuid": "c68d0e43-ae5d-4788-aea7-5daec861a76e", "value": 156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772216596, "uuid": "974b2486-214e-403d-aac0-e68529455c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772216596, "uuid": "c10f55b2-ca47-40df-85e4-54580484ecd8", "value": "kirk.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7372ef-1376-11f1-a769-42010a9c0008", "comment": "Malware payload (QatarRAT)", "timestamp": 1772153532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772153532, "uuid": "afb263e1-623c-4129-8a7c-1841644e3315", "comment": "Malware payload (QatarRAT)", "value": "5ed6f53e05535da82da34e600b0e5541", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772153532, "uuid": "74cafadb-cbc3-4d99-9b7a-d56768d6df37", "comment": "Malware payload (QatarRAT)", "value": "f3acfbbd1ff87fb33ce62665085d9423b62f68fa54c00d70d3fdc53cb5912207", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772153532, "uuid": "b80cffc9-99df-4a82-9ae7-9105fc5de35f", "comment": "Malware payload (QatarRAT)", "value": "4466ae094e99e045d08cc2c0b1f1fa80f137c8ed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772153532, "uuid": "62ee888d-130f-440f-a803-28aeb8f7e8c4", "comment": "Malware payload (QatarRAT)", "value": "4d06e6288f68d4f11f8891b264c360928475e6f3c21d6ed80364b8b461f6827917e594d864ebd3466fe3f7755fffdeeb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772153532, "uuid": "9b7bf411-0b00-4ada-bf20-bbea753388f6", "value": "T19635CF5A9BB221FAE177C03D8AA65A76FDB278590320D7C703E456A91F27BD04B3D301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772153532, "uuid": "64cb2161-0a99-4110-8bf8-cd7ddd3e304d", "value": "012b52c5b409e9f22dd209d7bfb843c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772153532, "uuid": "4774e56e-ee34-4ed6-90c9-e4aa0e727d72", "value": "24576:H0I9BhzPmYuPl2k0qVaqZiME0uUyHt5gzj:H0I9BhmPlzZT7wHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772153532, "uuid": "77efdf7e-0f7a-4408-ba40-3feaf7357b33", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772153532, "uuid": "afd79d47-c4df-4759-b25d-1eba33a032b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772153532, "uuid": "6a321fdb-1a79-491d-9d88-44e09df04211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43baf2f6-13e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201512, "uuid": "18d2f152-dbd9-47c8-bb42-f112c809f163", "comment": "Malware payload", "value": "6f48240d8d517df66fbb2d7ba4848e27", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201512, "uuid": "5d4c7fcd-9ba7-4abf-8950-fe8cd9a76613", "comment": "Malware payload", "value": "f3b6bdc0efddff3c2b8847f4739869787332fbe74f8164da491a5aaa41e364ff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201512, "uuid": "94800ab4-4107-4ddf-8369-1a86e2c52f3c", "comment": "Malware payload", "value": "fa5aaf95452d9278d1d0053b11943e44f3a09d73", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201512, "uuid": "ee20bb54-f896-48e9-81ec-edc8ee20c1da", "comment": "Malware payload", "value": "40c389c17c75a8748b07c7bef31ae5d2cc5c73f0a0d4efbb746f108268b7d1719380c5248bbeb673df4ee103523545ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201512, "uuid": "effe5437-8f48-4052-8f50-899de6eda82a", "value": "T15C518B7060F14D732E686540B2B72B956FB3DA17415322DC35EE1F3A5F8AB02A5AF421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201512, "uuid": "0313482a-0fe0-4a7d-9d15-301235f1291e", "value": "48:cniRxuGRys0/iPdFHPwWYclwnECPZmDl27lwnp6Elwn8RUmkl/F:cWu4SioVdZqzQdFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201512, "uuid": "7f61f8cf-71ab-491f-8336-7332deb2162f", "value": 2665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201512, "uuid": "d06d0323-4524-464b-8907-89756d736851", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201512, "uuid": "7dfe784a-baea-4c7d-93d9-2d00794b7cb5", "value": "f3b6bdc0efddff3c2b8847f4739869787332fbe74f8164da491a5aaa41e364ff.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adca8154-13df-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772198683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198683, "uuid": "90eba02f-ceb4-4d96-8392-8f705ed47fab", "comment": "Malware payload (XWorm)", "value": "9f1944e17372714e8fe0d4dcf586b4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198683, "uuid": "c500b95d-86ed-441f-8b22-916617412e9b", "comment": "Malware payload (XWorm)", "value": "f5d384d10b94f31f151234b0bff7c4699e38883029727da32a2ccdef58b4589e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198683, "uuid": "b571b447-5110-453d-8595-61f210cc4794", "comment": "Malware payload (XWorm)", "value": "5f2cd5b8b538ff33ecc53624ac738471daccfe21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198683, "uuid": "87045cff-293c-4a3e-9c91-7c6645ceac30", "comment": "Malware payload (XWorm)", "value": "67fcaf836af2a6129152b04217fcfea993643034b9fa2073569292064b97e690d3d52b746073a599266609036cd47965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198683, "uuid": "8ac295b2-150d-4130-b0bc-119626c1ac4f", "value": "T159C4BE426F832B55E6180B7CC05324982BF0D8579266EB2F7FFD80F5A9A7F84CE0A551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198683, "uuid": "55779795-3056-4ba0-a240-923217eac6c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198683, "uuid": "60f1313c-87b9-450c-b82f-cbe6e12b33e1", "value": "12288:i2G0QFjX00kkFjokGOuXJxNB3+MLi61zuhSczlOiM:nK0OxoNOYwMWeuSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198683, "uuid": "389b7918-51b6-4d4a-9299-afef51ae69fe", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198683, "uuid": "8dc73fd9-86f8-4263-af7d-e10d0bb3a82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198683, "uuid": "e24947a6-a18e-49b2-abfb-04029d649d06", "value": "BXH_ COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb26fff-13ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772204238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204238, "uuid": "2523cf19-57f7-4f08-a798-2da2ab2cc735", "comment": "Malware payload", "value": "8af7a12b5a730ace01e68e5a007966f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204238, "uuid": "5461dfdf-cba0-4c37-b053-9ec9d018bc2e", "comment": "Malware payload", "value": "f6bbbeec6cb3f490d6a8617dcd5efce5578c6ad83c8999aea44ef054552f27aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204238, "uuid": "8108a7f0-21be-4913-8ea9-5a633fe61877", "comment": "Malware payload", "value": "b1905653e6f2ddc807f1449b1607972101c3c668", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772204238, "uuid": "580fcd0d-adbe-4e9d-8b58-14146bff277d", "comment": "Malware payload", "value": "8e3d7923894fb4964a3f38462fb03d0fd4fe4ab8910346c09574d591ae05acda76e3a77cc9e5c5db13302ed0257c1cab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204238, "uuid": "dc6a83d6-6476-4e4d-9696-bc1f3281a4b2", "value": "T10622387B21F08B3297D021C8A36716615F72E60B456714B8F4BE1A3A9F5DA0370EBF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204238, "uuid": "b6090f01-4216-4310-8280-44abbbb3ebcd", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGFnI78ORtgjo5C4wEJgEFElxO+:cCuOC4hvZ5mzjG5fd+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772204238, "uuid": "c2397499-e6fa-464a-aa3a-d0439f70dced", "value": 10777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772204238, "uuid": "c549b058-3dbc-4396-aa3f-2d3a32fba0ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772204238, "uuid": "3c2f1a2b-9e50-4c71-9dab-a8f8896dd0f0", "value": "f6bbbeec6cb3f490d6a8617dcd5efce5578c6ad83c8999aea44ef054552f27aa.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7bc821-13cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772190687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190687, "uuid": "cf24dda5-510d-4324-a6c3-3928d49ecf4e", "comment": "Malware payload (Mirai)", "value": "37ea461f1518a7d56272fe6eb53de413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190687, "uuid": "cc11b22a-4ac3-4588-8321-2f75d1b0e508", "comment": "Malware payload (Mirai)", "value": "f6c613f81ab9ff70562ddb8d8a84d570c7ce10a326f74e2101a97c088d3e07f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190687, "uuid": "5c656b3f-8c53-44a4-bd11-c9855f2a2206", "comment": "Malware payload (Mirai)", "value": "474e3dd914ad6b59d1af13ba7589dd2eff55a79c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772190687, "uuid": "ec001ae6-b10f-4dea-904e-cef6834f098c", "comment": "Malware payload (Mirai)", "value": "e9b86992a319581c03eb29b7e585bbf96982db1d63b744f5a43907225d56b578bde69cb7f00a707d14a0377c7ff1bbdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190687, "uuid": "c1032c70-0585-4481-b68f-9994248e3973", "value": "T15E261A97B8918643C4E42677ACBDC1C433672EB99B9B12676D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190687, "uuid": "b904e381-5459-4cfa-9a52-06a28e52e839", "value": "49152:81KJyKYoD8kX56SgqV2GI+C1/ihsxSPKX0Uh1:8YJyMD826SR2GQiCgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772190687, "uuid": "8c559200-d949-4a49-a154-6a535feb77c0", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772190687, "uuid": "9bdf54fe-2d78-4ebd-81e4-c3562a7fb709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772190687, "uuid": "3e5a0793-63f0-422b-a977-a74a8398103d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a357a94-1401-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772213039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213039, "uuid": "15c4b6bc-aa85-4bb2-a1b6-0ac1a7e88fb8", "comment": "Malware payload (Mirai)", "value": "10874fac9c561999da96a12d0e9893ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213039, "uuid": "3b34951a-4e4c-4509-9a18-fd97831a1937", "comment": "Malware payload (Mirai)", "value": "f8bd30051552119b023085fe6247dd725761dd369e72c4c7dc1559654bc473ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213039, "uuid": "cdfc9d4d-3f2d-4ccd-b942-1817b867045f", "comment": "Malware payload (Mirai)", "value": "93b6f2ebd252b92378afea7e58807b45a807641b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772213039, "uuid": "292b5625-8a48-4cc2-b48f-3a5e3fc5022d", "comment": "Malware payload (Mirai)", "value": "422c592a4fea2d2ed80c6cb09fc00f5aaedcf4d0c33bf5487475b187ac57c9b7e0f6a5c99e6ad4cd64d7d324748721e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213039, "uuid": "a180171b-a6a5-4f3b-b803-bb29946c996a", "value": "T149E22A9BBA92883FC9D04336BAAE116D3312F398D1DB3B07CD198B5532DB5499C5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213039, "uuid": "eb4435c1-b93c-44e2-a667-281517de70bd", "value": "768:x3e/LDyH37TtcD27JCYc/FN47VD18YzAkqmR6YoS:Ne0PCwJCrT4JB8xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772213039, "uuid": "57da92aa-6360-4fc4-bfbd-f169f47ef53d", "value": 34096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772213039, "uuid": "758d77bf-2013-40c7-8618-79f5d9ec6dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772213039, "uuid": "3d79fae7-6263-434d-9cba-88345b13b383", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb1f9a8-139d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772170417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170417, "uuid": "5963ff3a-cab5-43dc-96df-49332e0733ce", "comment": "Malware payload (AsyncRAT)", "value": "696276a030ea8d7ad4dd262a7212de69", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170417, "uuid": "ac8b129b-93e4-4e46-b885-b59d18ba076a", "comment": "Malware payload (AsyncRAT)", "value": "f8bd7e21cf206f09883ed40c8653cc6de9be1e82a9b60239764578e69c934637", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170417, "uuid": "3ea5894d-fd34-43e8-9e33-09deb25cbe1a", "comment": "Malware payload (AsyncRAT)", "value": "7e853e456132c731cf3451a043071a13489330b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772170417, "uuid": "b6a11ba0-d469-4b7d-a8cf-5dc18cabb324", "comment": "Malware payload (AsyncRAT)", "value": "e98cb565c6108a88459cefe80dce837f0322a7643137324e9f2ef91a52d144ab9806597a1cccb74f34af3a2ea3d2bab2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170417, "uuid": "8909a6b6-9403-4a30-9aa1-97c20ce359c5", "value": "T17DD23A09B3D88561E1FD57B94C7293048375EA5B9963DB9E2FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170417, "uuid": "0401c637-4217-40e9-a914-eb5898c20049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170417, "uuid": "fe141ed8-c367-4be9-9098-861c186ece61", "value": "768:Z/8x+2RXBql0IMog/cIRGqoe/Rb7fB/dTs/+:Z/8A2RXcl0IMx1iQRbN/e/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772170417, "uuid": "1e51240b-5fc7-4bb7-879b-2d9e22ed3f16", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772170417, "uuid": "6f280ca9-e3d2-42bf-a6b8-dcf022da78a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772170417, "uuid": "c6e82fc6-ba4b-4b0d-b639-da19bab96b9d", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf65dd3-1400-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772212961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212961, "uuid": "d7229167-19d6-4a32-aae4-a75c8f319726", "comment": "Malware payload (Mirai)", "value": "87eff6cf1ea798628591d932c82b43cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212961, "uuid": "3e44c38a-6ef9-4040-8e43-8b8cad4aa30f", "comment": "Malware payload (Mirai)", "value": "f8e5a8b4b35e54573ff8a1bb47f68bb52d4fe8fec5566e3c8b63c61926ac65f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212961, "uuid": "d29047da-9599-499f-a9e8-0df455f0bfbd", "comment": "Malware payload (Mirai)", "value": "b3e5eac67ea315ac9a6d886075deb471cba02a4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212961, "uuid": "057c5880-1941-4050-a119-da4f894e6edb", "comment": "Malware payload (Mirai)", "value": "d6a8ff186d43f5556a52b04f64669179561afcc05cad1de9cf9e5e8c0d2e124a1c7a4eba6fcd28bfba2ad3f78acf203d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212961, "uuid": "c4573a73-ccb7-4b80-a74d-ba5862ad0b2f", "value": "T18703F12ACCF487E7F80E00B31E9FF65562B0E42E0924CD527544719F1D81BF97698EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212961, "uuid": "f11618f4-b4a8-47b0-b5bb-52c9a5f953eb", "value": "768:lS7z8GNgU0Vy3oRX1XVyjWSfFDgAu6jDbmbe2GGnbcuyD7UHQRj3:lwz8OcX/SfFDgiX4Jnouy8Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212961, "uuid": "54626e0b-6e68-47fc-ae90-5951f1156ec5", "value": 39260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212961, "uuid": "73318f58-5882-439d-83a7-3652edcfb825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212961, "uuid": "b8b54d3d-f204-4c29-8da5-a89e9bfb64e1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36e49f4-13b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772179392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179392, "uuid": "af767235-c7db-44fd-8493-0a62ab491823", "comment": "Malware payload", "value": "eeb4946d4f940af4a1aef61f12b8941d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179392, "uuid": "5f87b273-4a95-441a-b76e-673a38fad3dd", "comment": "Malware payload", "value": "f8f41fb4ccce48ab3d50bf470e0a97909aa7c677a57e78be76b06db2ee681dab", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179392, "uuid": "4c74328c-7591-4bd4-b329-77644ef0e9dd", "comment": "Malware payload", "value": "72f12ba919733acf77c442b0a0db31b6df231445", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772179392, "uuid": "daad817b-739c-4234-8033-791d2dabd899", "comment": "Malware payload", "value": "9218a0a94c9a19597c906c35e6e743f9a79b5e29b33a5c0a020c84392b31fd140e3a97f8f4c92d2873289fc425bf4eea", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179392, "uuid": "e8e151c7-f19c-43f2-b777-63ca5b4cd358", "value": "T1815590786E26C01BC063CA63805E8DAD7295E3A737DCF15A50AB4E970F0A51C1771EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179392, "uuid": "3c3841b4-f0e0-4948-a42a-2e56bab0b7b7", "value": "768:eUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUb:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772179392, "uuid": "d9b5405d-5a93-4d0b-ac05-ad71387fe4cf", "value": 1298077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772179392, "uuid": "b0d73320-c210-4104-a973-68985f2f3977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772179392, "uuid": "4a6156b7-cb83-4086-82ff-384d04ac7c17", "value": "FT - 00226.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8329f15-13df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772198674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198674, "uuid": "42723c31-3ca7-455c-96c3-1822ed8c45a0", "comment": "Malware payload (Mirai)", "value": "3e84a794a5475bf7f43040cb149f8746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198674, "uuid": "6a9efc8c-45dd-4666-95fd-f70ae08918c1", "comment": "Malware payload (Mirai)", "value": "f9da4a7db661762e52e88fd8031a9a3f0199da98e7ced89a551db883515a0e93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198674, "uuid": "14c50496-b362-4299-8dae-067709f64617", "comment": "Malware payload (Mirai)", "value": "ac5beb1b727e7a4f4f82ccbcee9bc31bc9210104", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772198674, "uuid": "67bce66b-2b1c-48b3-979c-24ecbed0cbc3", "comment": "Malware payload (Mirai)", "value": "bd2855e40e7a518fe93445e71f9bed1521ef157793d6c030a37bbf80b7e1bd6534cf6abe138a190207614d934d158a86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198674, "uuid": "b37e30bf-8d38-40ea-99a1-6f36e4cb773e", "value": "T12514B81E6E228F7DF668873547B74E259B5C33D627E1D640E2ACC2105E6028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198674, "uuid": "c856d918-2b38-4c38-bb63-3a7e080743e9", "value": "3072:DwPOX6d4IlujYmfAT9fv+0/C/qWx0uBIrZgd7iF:UPyAycmsH+4dWHBIud7iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772198674, "uuid": "23f667fd-24f0-40b0-993f-8da9bc10a298", "value": 190944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772198674, "uuid": "79a5e8b5-93cb-46d8-a435-9262f531d917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772198674, "uuid": "94d71153-a395-4ca8-9778-b8fdc1b51d95", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e5ec3e-1418-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772222959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772222959, "uuid": "d686f553-fd41-467a-94b6-c484055d6df2", "comment": "Malware payload", "value": "1670cd0308114863ccf9649f63a45111", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772222959, "uuid": "f5937ad0-bcf1-4c17-9882-2b18aaeed238", "comment": "Malware payload", "value": "fa5313cb05940191e9067ddbe16d547fd50380305f74a3b3133769274506eebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772222959, "uuid": "b7588022-90d5-4d8e-b07e-1ceec4f6e74b", "comment": "Malware payload", "value": "f76d7921f4c318d740971e0bcd715c79d2996ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772222959, "uuid": "6b1236db-3d3f-4085-a083-ea134f3a29b4", "comment": "Malware payload", "value": "bc3d02a6cff994e9e6538fafb7dc4e34f7405db6dc60d2cbf496730d0c96a6562c3948325124f637561a059c3b55c66e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772222959, "uuid": "6522b69f-d847-4306-a933-0387d4156f3a", "value": "T1D034230947064056DADA937ABB2CF309E23C173AC7D534C0C76EAA1B584CDAD392676F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772222959, "uuid": "d89ea114-cdef-4bf7-ae95-a6dea70facbd", "value": "6144:W+hw5/dXT2nhhM+GUXRAu6slAP+mjz5ycjKyeBy7s/bpHPz+a:W+hwBdyn3tGUXRAYlAPXjzxKqOzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772222959, "uuid": "861227f1-3e71-4243-bb7b-3fec7171e111", "value": 237174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772222959, "uuid": "5f41a3b0-83d9-4941-b6f0-3ea864eb6bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772222959, "uuid": "4944c8a1-f55e-4d45-9dfc-58e8d7e6e741", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052425da-13f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772209567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209567, "uuid": "052031f6-36e2-47fa-962d-78efda89e722", "comment": "Malware payload (Mirai)", "value": "44e285242c9283c84f34c57805ea9113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209567, "uuid": "7ddd9d6b-2f46-4310-bca6-fe0d41b354a1", "comment": "Malware payload (Mirai)", "value": "fa6596f9f49becc7d33d43ffebb63ea856bebfd4b9cc0551361bf364f94296fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209567, "uuid": "2f9f02c6-97fe-486d-a113-914997a28200", "comment": "Malware payload (Mirai)", "value": "de521d9cbb0040abcbe364cb42b20d79d9868b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772209567, "uuid": "2904db61-3967-46d7-993b-11fa6fc4df76", "comment": "Malware payload (Mirai)", "value": "8dcce85b5744645ae51392bdf41889eaeedef6c82eac3b03340898490e1d7605277438286e07956c206fa8ab2ea6b2fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209567, "uuid": "906f25d1-f6e7-4080-949e-8160c6faf801", "value": "T1C4C36A33D82A6F68D159E030B0718F792F53A59282875FBF59A2C2758483D8DF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209567, "uuid": "38c625aa-74f5-4a78-97b7-bd80f02b6281", "value": "1536:ywxGXM/nvXvjuZ+sDj8WvoxloxtC+7Ks0AEbcpoYIMrTGjZzDkhJvDV4WjHQRr3e:ywxtfvXDsDjphxtb+s2khJp4WLQR7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772209567, "uuid": "27ec6279-5552-4483-ac3f-0cd7019b4c3a", "value": 129888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772209567, "uuid": "82c12baf-4a3a-4bbd-bf50-80562ed6e9dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772209567, "uuid": "b5cd5dd7-80b2-4e16-878e-9076a46b5bc9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e289917-13b8-11f1-a769-42010a9c0008", "comment": "Malware payload (GenesisStealer)", "timestamp": 1772181880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181880, "uuid": "c9316bcf-fb28-4d3d-8dd8-3f3ebfdf9555", "comment": "Malware payload (GenesisStealer)", "value": "d1634b0162d5784d989cfa421f5b3db2", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181880, "uuid": "bff7a216-9de6-44cb-905b-3e107c101578", "comment": "Malware payload (GenesisStealer)", "value": "fa83180ee18c87e91ab920252e77692e7849b03d8220ace614bd4620bc559bb8", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181880, "uuid": "f3c23b07-ef0a-40f2-908d-7f22ac15b648", "comment": "Malware payload (GenesisStealer)", "value": "e221296cd5b59d86b0159e8bffe929bf8e2152f6", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772181880, "uuid": "d709c133-42b2-474a-855f-199c54725ef9", "comment": "Malware payload (GenesisStealer)", "value": "fcce1477122e95713ffae37e500321380c744f553a9e36ecf998d30cefd2bcccabf55d840e8414057080b7a0c5928e1a", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181880, "uuid": "3c9ea3e4-9a9b-47cd-a859-3d904409742b", "value": "T1A2E401342DBE36AC02B6519A746B27C85E1A343328CCB57B21D09A9B5BB175DE0CFC5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181880, "uuid": "94b17069-bf15-4389-9048-8f0b25cae2ae", "value": "12288:ITVOqr17lvu6CP1lwFHXUrEIJDeFIM1+uA/fx7ga7WHo/mHMz/uP9ViRO:aH7lgN+F3UoFR+HxV6Ho/mHMTuP93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772181880, "uuid": "ccacdbd6-c195-4ebc-b832-a66cc450c922", "value": 721857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772181880, "uuid": "fe127c89-f22a-4841-af90-07b15893940e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772181880, "uuid": "112849ec-b65a-4c32-ac4b-27f0db163edd", "value": "a825f8018d7071c1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81335f4-1372-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772151859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151859, "uuid": "f45a5a97-0f48-47c3-941e-535063e71054", "comment": "Malware payload (SalatStealer)", "value": "ac71b2bbe8e3e3d916fa3d3b38359814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151859, "uuid": "78d787ee-e9ac-4612-8e34-21dcf74a8fcb", "comment": "Malware payload (SalatStealer)", "value": "fb0d24d589fa741a7211ad909418a55f4955e3739e50ad067f3f78e7fe76231d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151859, "uuid": "e17dbde9-214a-4ed0-bc37-2a3c68ecbceb", "comment": "Malware payload (SalatStealer)", "value": "b52f3448304ca7f9d32dc59c4573be6e24e0bb9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772151859, "uuid": "516b5c35-1413-442c-bd11-1334c1e1c247", "comment": "Malware payload (SalatStealer)", "value": "69f972c5d0baab9673488d5649ee8fe317a9c07c0f627ac977801d9d53812f42078243a02c252c4568a6bace9c35b318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151859, "uuid": "1179b5a5-9485-4ba4-9aa8-6f0f9a82e697", "value": "T1F3C66C41FA8B58F9E9031831416BA23F23315D05CB28DBDBEB547E2BFC7B6815967608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151859, "uuid": "598cb22b-2563-4b7f-8922-213966c3e455", "value": "49152:VC23KFPzlToZPQMht1HzoPrYkXMElLa1pwptRmQtp6NGEG4b5QPS/xFSvAaKXHP4:gWKF529hHzs0kdtnQoS/uo5gbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772151859, "uuid": "0de8c06c-f381-494c-9b71-90503aa8ca7d", "value": 12113920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772151859, "uuid": "110d1f41-04dd-4acc-90eb-99a4780f1da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772151859, "uuid": "55fec142-c530-453d-a411-2bd590ffbb11", "value": "y8vfve.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8bd1fa-137c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772155951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155951, "uuid": "03bd69d7-e4bf-4fc5-97b3-8ea015eb3f35", "comment": "Malware payload", "value": "19346f230eb26a7260a065d0db7f72e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155951, "uuid": "74fc9b0b-0438-4e75-9f51-205af2c048b7", "comment": "Malware payload", "value": "fb4c58ff61d8e43a744e3928ac0e0823ab1d106d8ef1f5171495c46eb3570780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155951, "uuid": "e7b4d819-6093-44b5-b202-19a509fb0ed3", "comment": "Malware payload", "value": "622cf7b4b75c5f2da0fced125df7e037e440d5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772155951, "uuid": "ec3844b4-cd48-4a88-8cab-8d783e189f80", "comment": "Malware payload", "value": "967fb77a4bb13eaf64daac15d0c50078b7f82d3a35dea821fa065686ae76581fb9cc1eaff9130e28d5cc173b7d550a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155951, "uuid": "1f74380c-4f7e-4e8d-804b-5e20d40df355", "value": "T1E5164926A3B511E9E0B7C23C86566723FDB138494775A7C7478187662F23BF0AA3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155951, "uuid": "3a868d0c-fbbe-4bf1-8224-d3ece2aca5fa", "value": "81517998566655feb277d6430cc96232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155951, "uuid": "02763231-4b50-4928-916a-6f09138c3ad4", "value": "49152:a+tUER+edSpVZiggdG25lDi8kvKoj+oBUcDId6i0UZP4hwc/KVHg7nk3SE/YeMeu:tSpVZiJhoj+oBUcDId6ihOBbF47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772155951, "uuid": "ab32ac43-be93-476c-9686-7155e7a60107", "value": 4149760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772155951, "uuid": "54c7e69f-3964-4926-a7b7-1123f6863495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772155951, "uuid": "a839b5ba-af3b-4eb9-a8ea-af648b17f6b3", "value": "_fb4c58ff61d8e43a744e3928ac0e0823ab1d106d8ef1f5171495c46eb3570780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17648193-1400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212605, "uuid": "c79b8af8-1b75-48cf-a910-339592facf75", "comment": "Malware payload", "value": "6b021c13fe430013b512f320a2fa2e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212605, "uuid": "2f6e46e4-e90b-48fa-9fa1-46a7bac9e900", "comment": "Malware payload", "value": "fd07a311deb1224fdfebec2afbb408d353ade390085b2fd486fc79bb9ce735ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212605, "uuid": "d061244a-9165-40e3-91d4-8e4d6884a495", "comment": "Malware payload", "value": "b248f8a67e52e327d5731127932b93e6f2df8648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212605, "uuid": "93553215-5377-431e-9730-a629a40683e0", "comment": "Malware payload", "value": "54f32976d7eba40f3676438d7b80467b26ee1e46ad4acf982836ea8839c7c5d16234650b6290f6726fbbc2c61964aeaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212605, "uuid": "3a0462e7-067b-4c33-8b0b-6d717da471b1", "value": "T103973395334408A3E68A5776A2A3EB6669D3B93157D0C1CF5FFC21451C932E8BE3AF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212605, "uuid": "30566892-8c27-4411-82c8-3813b2fd32a2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212605, "uuid": "6c92bbd4-f43a-4601-a1f1-64949e7b8a35", "value": "786432:b25vzPOmQuKz6FIFlUR1OOMW8IFQQ20pb0eLLsKMMo5ovsVuR8n4Od9gURHFijT/:S9z16z6FIEWvWGQ1pbUoeO8nTHk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212605, "uuid": "e7e7e6ec-39c7-4b25-9311-ded96363c3d1", "value": 43131687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212605, "uuid": "40777657-2dca-4c8d-b849-ae96e776cac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212605, "uuid": "16482af1-241c-4132-a5ae-22ca7d1a0470", "value": "YazlmPeindeMerakEdilenOKurulumGeldi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e5dda0-141a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772223925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223925, "uuid": "6eef9ea7-fad5-43cd-b0ab-e85d41fd1135", "comment": "Malware payload (Mirai)", "value": "2b6a1c1898655c749b0f1e6c7eef12f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223925, "uuid": "f72fce77-7274-4fda-b886-e170ba85068d", "comment": "Malware payload (Mirai)", "value": "fdc1eba3fa4a4227e0f2e569ac23bda82d6d70189a15aed65b0173105299fc10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223925, "uuid": "303d9254-5d1f-4efa-a34b-0c0139c94715", "comment": "Malware payload (Mirai)", "value": "81ea4290a492608b45a1ae75029d0f2f8fdca1b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772223925, "uuid": "a09d1b85-c8bb-413a-905e-3a7773189e48", "comment": "Malware payload (Mirai)", "value": "9f438e3c345396c63ceb4250e1e9ac12c9493251f71917b886612458b0dc0d6ab7ce4bd6b0db5c810493fc756d63311c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223925, "uuid": "02253f32-3ef7-41d1-8d68-512a8e06c967", "value": "T17A041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223925, "uuid": "93facc26-2422-4a2a-9ff2-5b5450c90b06", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woRKcrI40fCtZ1SD39rsJj/s9fx49SY27:t3nEr5dfHPq7UTocc8uF9X0V6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772223925, "uuid": "ddbbb06b-3255-47af-aae3-a306fc4e6a90", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772223925, "uuid": "707d41a8-f286-4dc2-affe-aa543595dbff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772223925, "uuid": "f0527da8-4124-453c-b297-4d604ce2ed82", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39bd734-13db-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772197056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197056, "uuid": "6caf39d6-e850-4180-b518-c7ec9675d7b3", "comment": "Malware payload (SalatStealer)", "value": "2dc2bfc6af604e10b379f8c04c2a4da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197056, "uuid": "1d902f2c-62bd-4746-b683-38ccbc6613c7", "comment": "Malware payload (SalatStealer)", "value": "fdc4fdaa72a75855b6fa41d76b931f9fc9a9c076df6108e1248a778a1015e91f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197056, "uuid": "7de6643c-ae44-4127-b597-39cd931afa88", "comment": "Malware payload (SalatStealer)", "value": "a0c6e100b5f04d7558cf6f0930b1db9a23ceaa60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197056, "uuid": "24fd539e-80a6-4eb1-b8db-bed75aa99776", "comment": "Malware payload (SalatStealer)", "value": "00f1cbdfb90312c50552250c2beccdda9b949d6bc54439362cfe61d3af15f5d69b5634e6668380f62df655afcf8ddec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197056, "uuid": "def3c33b-8c63-4030-8c19-135dac228ee6", "value": "T1DDE5331C3F9EF314FCA417B988F596F11B41C9EA8580CEE1838EDBA29EB6741F019615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197056, "uuid": "b8e0803b-7dc4-4bb8-9aff-2b89c21aac12", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197056, "uuid": "a9b670fd-7f52-407c-b6c2-fe4f915f91b1", "value": "98304:S5lgKS54rnABUDuPgTK39nZPlgdI8k6mTPopdwdn:ilglirAGDU9nZNgG8k18p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772197056, "uuid": "57c8ac04-b2a3-492a-aada-5650bff21fc0", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772197056, "uuid": "8d2610c5-747b-4fd2-93bc-a2da5a2eed96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197056, "uuid": "7c39b270-aea1-425b-a9ac-ed3722e88302", "value": "FrameWIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a9b6b-13ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772212257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212257, "uuid": "a933526b-4563-420d-a2c4-5af8955d696f", "comment": "Malware payload", "value": "8baafe0cd60653bbe389d15c1a0261eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212257, "uuid": "b3881038-7293-46d5-b3c8-74f0a2af6121", "comment": "Malware payload", "value": "fdffc68c713867091ef37a75b186a85fc8aaf66da37df84636a5aef2724ab6dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212257, "uuid": "a69c8055-fc21-40d3-82e1-3408a903cb0f", "comment": "Malware payload", "value": "101c72b651686379aa29af8fd3fdd731e589ad20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772212257, "uuid": "d61792dd-3875-4a86-babb-fc07223cdf95", "comment": "Malware payload", "value": "f9a3a947ef58476540a18171ecb9a986e4ee588e221f7866ad1e5455b1c640733de5c7d259f6e925fcfabc6e0d72cacb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212257, "uuid": "19dbcaf7-c596-43db-a464-f202cb5d7133", "value": "T1FBB022380C2C828FC2802A0E08F08330CCAA3E022C0280003B32E0F2CB20CCEA03C2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212257, "uuid": "b4874242-96fd-42eb-a3fa-aac3cb9a98aa", "value": "3:wn8cocJJvKSvXJQ0cTkETjRfGRXkZiXncShNVHM/Kewv:6lo4cc5Q0cTkET5WDsYnMCRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772212257, "uuid": "ffd322ae-8dc2-492a-81ae-a33ac5a80b25", "value": 123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772212257, "uuid": "6f749c87-e857-4b2f-921f-6431bf46e2db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772212257, "uuid": "735fa7f0-b4ee-41d0-bc44-f93c2e9da419", "value": "Y527481308.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19bfa0f-13e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772201669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201669, "uuid": "7a988473-d084-4e69-a16c-82c7a9fdbc26", "comment": "Malware payload", "value": "4746c2f3fffb730bc78ab2c2634a8add", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201669, "uuid": "6bd0749a-239d-4e1f-9fe3-aaf68604cdb3", "comment": "Malware payload", "value": "fe2bf4c44d3afd4fcbbb6a1042962cc850fecc902df5280a57bcb48e615882a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201669, "uuid": "fac8e8b6-0735-4d86-afe3-719bbbc386e5", "comment": "Malware payload", "value": "a9d64348b5f6fd15bf8a14d7171d86261032b39b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772201669, "uuid": "025a4f79-c808-4934-a039-660ba8598f0c", "comment": "Malware payload", "value": "a432ce20855f467e41e63baf1e781d9e9ecd420d1731ead5ea58adea774b9ef07330689040fe045d8cf1016c3de18270", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201669, "uuid": "684cdb3b-b4fe-49fe-9bfd-23bcedbf0e75", "value": "T14E42F4B425F14C731E611A40B23727F56BB7945789E3218C39DD2F39AFA6B02A4FE421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201669, "uuid": "77689034-6afa-4e9e-a4a9-1cac40f33349", "value": "96:cRrqB6uL/7ppbpleU1eUGpE9pNZeUF/eU6inFdLeUndpZdNdVdtdWddd1uPuFuOp:cRrO66eweOeke4eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772201669, "uuid": "d4bbc944-07b3-4ca9-b10c-50f67b96ea0a", "value": 12918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772201669, "uuid": "2541f00e-e2da-46f7-ad8c-f354330f610a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772201669, "uuid": "daff8666-921b-48a9-9d1c-2f1baeb662da", "value": "fe2bf4c44d3afd4fcbbb6a1042962cc850fecc902df5280a57bcb48e615882a2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff32b0e8-13db-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772197102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197102, "uuid": "64d492e7-adf1-4bdb-adbf-54d43ed7d112", "comment": "Malware payload (SalatStealer)", "value": "2560942b2d76daffd8107f6f74c23937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197102, "uuid": "afa5ec45-8840-4bcd-bb58-215a2d0b3b29", "comment": "Malware payload (SalatStealer)", "value": "fe5b6117462a3b52e0dc23eb47d4e5ae7c7dd403f42f3e428bcadcaad96707ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197102, "uuid": "ce71665c-0cc0-4ff5-ab47-334d78eb6347", "comment": "Malware payload (SalatStealer)", "value": "6208dfa053ca6005bb2e7224eca58ddf004a0bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772197102, "uuid": "4401c097-fea1-4038-8c79-095e5543d3d7", "comment": "Malware payload (SalatStealer)", "value": "1794e49eaa65a4f626c579e7fa35485b52ab444e694e3f37c21f1fe81a6dd625210a40bb60487ca8f446403e76c650a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197102, "uuid": "9efcb4e2-4303-48c8-8c77-852bebda095e", "value": "T1A7C65A41FA8B98F5E9031835406BB23F63315D049B28DBDBFB543F6AFC7B6911926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197102, "uuid": "cb6840ed-1f4d-4f8d-b248-003f271b7a29", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197102, "uuid": "042c00b4-f8f5-4962-b666-3be475a00a93", "value": "49152:7i811vwTevHX9SegoOP0yH9pJ0tS1E2k5+CP/ibP+NdaMrD4RRNKhMhOeELiw63D:Wa1vwY9mpKib6aMwy2wJStJHQLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772197102, "uuid": "ec349f20-8b73-4a1f-a16b-7ea095d54d68", "value": 11672576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772197102, "uuid": "f181e880-17cd-4b28-aac0-e683d2901f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772197102, "uuid": "cf5cbb06-636c-49b7-bd62-d2f0b37720fa", "value": "FrameWIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3294a6a2-13f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772206208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772206208, "uuid": "02bfa0e7-c2a2-4f93-8787-3ca4dddbcd00", "comment": "Malware payload (Formbook)", "value": "8186bf9af10e4bccdd1e5e28f981fab7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772206208, "uuid": "f807018a-95dd-4873-9c30-02a0c7925348", "comment": "Malware payload (Formbook)", "value": "ff8d81f7d8af638ec6229c831ccb591a6ae6789a4f4938ab1143be902a9ca6b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772206208, "uuid": "21401fa6-be12-4b2e-bf00-f7f8cebf49fc", "comment": "Malware payload (Formbook)", "value": "4ad979041495a1f340b2d711c38f407a631983f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772206208, "uuid": "dc868044-47c0-4296-a9a9-86b92b8762a9", "comment": "Malware payload (Formbook)", "value": "02ff66612906b16d3e0971cdee8e6d08791f92542568a0dc323f15225bf9624994fc3a41df6d58ee825eaa6a74784df1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772206208, "uuid": "99fd117a-cfb1-499f-9605-fbc5f3fc5ecd", "value": "T1D525230AE0B99463E9F11170043766B6FEBB6F1155A0838B67343F3F3DB58B18529693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772206208, "uuid": "562c4c44-b9bc-4103-b14d-2382d8ef912a", "value": "24576:JXaVXbFfDTwbaCoMoZ2j7IRUCAm504gmfZoeYCQ:NobVDsmn4j8t04gmmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772206208, "uuid": "e026fabf-a381-4413-bc74-39bcb15c6296", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772206208, "uuid": "a63651ee-8351-435d-92cf-6fb1b7b5ee77", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772206208, "uuid": "8235f2b2-c4d2-4295-a3b3-026c322b4872", "value": "nJusti_pago.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }