{ "Event": { "published": true, "date": "2026-02-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-10", "timestamp": 1770768182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "05195801-335e-4ddc-a0e3-c5b75dcc79b2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5147efe-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708020, "uuid": "208a3444-4e0a-40fa-8504-bbb462ffbd5c", "comment": "Malware payload (Mirai)", "value": "745d3dad4be65284c604273edd133745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708020, "uuid": "c97e5ac3-b795-404d-81f0-34c067434024", "comment": "Malware payload (Mirai)", "value": "01d9aef82a3303d19ffab87971911d96b4d2112853317622d8bab84bc68116a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708020, "uuid": "114cba5e-69ca-47df-acdf-c8d94b10e061", "comment": "Malware payload (Mirai)", "value": "4628ce1b68e1af324bc96a0c0f45501a170919e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708020, "uuid": "c9002aaf-7142-492e-9b51-2c928002ca3e", "comment": "Malware payload (Mirai)", "value": "a9284893c3ac2edba7f6bb0ebea35dba4a115b42a86bdd6da797b51658487cbec38e1404c68fcb8816a642f4cbe92f77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708020, "uuid": "d55f6356-8123-40ff-816d-f3906a796654", "value": "T121C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708020, "uuid": "e5c82b48-4e90-4d1e-bff6-8ce1d3989755", "value": "3072:Mf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4hqe:Mf0tJBR4NSALD7rnCrhei+qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708020, "uuid": "f9a89e86-3cf8-40cc-ad17-8a0fdb6730a7", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708020, "uuid": "51c48721-ec44-41c9-9148-df195f27bc14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708020, "uuid": "e95ef113-3a7b-461c-a8f0-48dbd6ef69cf", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff419d6-0660-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714776, "uuid": "baadf91e-76c9-4515-833c-08b5d612ec87", "comment": "Malware payload", "value": "ca338dd238ada0d31685fd4e6ef92226", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "windomsliga27-duckdns-org", "colour": "#BF80DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714776, "uuid": "3fce9686-0304-4e67-898f-bd1226ba0c49", "comment": "Malware payload", "value": "01dd9280127735ac31729679ffa3d25617fcc711ba2758779f56209daa54d6d6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "windomsliga27-duckdns-org", "colour": "#BF80DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714776, "uuid": "272e3eb2-6311-495c-8368-98f6d091da21", "comment": "Malware payload", "value": "f3f1d099158a4d5b87f41a0704c66a483f428113", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "windomsliga27-duckdns-org", "colour": "#BF80DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714776, "uuid": "e68a9a4d-3e73-4a72-b654-c26b12048aa7", "comment": "Malware payload", "value": "527f13e9f07a8a5b1b19e27dd864b8066beab8f38c8cadc41385beba51c5921513c3bfe31fab01e87b4909b38111a85e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "windomsliga27-duckdns-org", "colour": "#BF80DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714776, "uuid": "ed6a2a85-65bf-42d2-b24f-1721628bc8df", "value": "T117E2D7F2289AEF7423E39057E39AF1155E7B604E947A983BC3708F56E841540DBB2273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714776, "uuid": "e72039a5-c65e-4de8-833f-5b3c6d2bd7d1", "value": "768:6C+3urj2Cr8WY9dtpxRDGHsASoV6ldzVYH:AYpedonszVYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714776, "uuid": "cbc974d3-c218-4301-b383-626957b10113", "value": 32302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714776, "uuid": "3925af54-39c0-4851-9ef5-6a790b428260", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714776, "uuid": "d0726807-839b-4ea3-a0e4-ffc16c584fd1", "value": "Notificacion de Comparendo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef077cc5-0659-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770711875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711875, "uuid": "d016e583-a115-45e7-b155-14faf43f4b39", "comment": "Malware payload", "value": "585576bc17a858f0accf77fa35401473", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711875, "uuid": "07aa91e5-fc2d-4676-b093-fadc2ef2d267", "comment": "Malware payload", "value": "022891e8fa9e515285b200f2fb583a532dbb1d10bccb49e0fd1e7631f74ea58b", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711875, "uuid": "119e36e1-6de2-411f-b6bf-9ec1905285a1", "comment": "Malware payload", "value": "d7d9c80e41c444a2f2b553fc335ac97bb56dee56", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711875, "uuid": "141a629f-b2b3-499a-a1d2-8ca5961ceb42", "comment": "Malware payload", "value": "8d924d74ff4fb572cefd404ae9febef92f3fe6cd27c48e75c42b529b8a94e1045b86003773d0b9c6261ebb9accb44c86", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711875, "uuid": "350dbc96-001b-455b-ad44-183267537f15", "value": "T1B1F09E507772C4F15C884F216384CBCEA436225C10E8360558DDCBCCA6C774B576E484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711875, "uuid": "e3e5338f-825e-458f-ba87-28829a8c5ef6", "value": "12:Cy5SF5sd5olxVmsXKC2IS1CFASQWifg8MM3ifrNS:95N5o5mIKC2KznaMq+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770711875, "uuid": "8232015d-8e1d-4d81-83b5-94fc5ba61d39", "value": 488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770711875, "uuid": "606030cb-6c2d-4f87-9a82-f1de027a819f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711875, "uuid": "e24774c4-78f4-4f8e-87b3-1bddb8adbc03", "value": "022891e8fa9e515285b200f2fb583a532dbb1d10bccb49e0fd1e7631f74ea58b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e6f5b7-065c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712989, "uuid": "34e33160-9650-4a0f-92e0-65d932bb5d42", "comment": "Malware payload", "value": "ca2ee0b121ccd036d873a5d2d5984c62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712989, "uuid": "0edbf0af-5cf6-426f-ba53-ab3841d73c09", "comment": "Malware payload", "value": "02ed2b680ebe23acaf4831f5dc4e655d011ad42fad6bfa68846f2fa2ccf33a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712989, "uuid": "b2a2dcf0-496e-4a55-a867-e52bc9480ce5", "comment": "Malware payload", "value": "ea5305ee03550b91d26a4f11fbadc3c3f6c8b58f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712989, "uuid": "49d43f39-29b2-4e04-90e2-eb79a3a8034b", "comment": "Malware payload", "value": "a3c6a44d2e9811e36685b9ac6cd56706e2e5f244e721f9ce6c2f6234abdcdfa6ea9ebe8a607355762f36b91169fab74b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712989, "uuid": "94f18912-523d-4281-aef6-c2ebdf1eb1a5", "value": "T1D72533E2AED3D5CBC8B3F67D90048BBC642615286A47170A6E1CC7E27A19C791F4FD12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712989, "uuid": "d56464aa-e194-4320-b38e-b39d18fc0d83", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGk:dOZnWkZP1dUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712989, "uuid": "dd4cd560-8cb1-47f8-8001-e0c982b670a8", "value": 982296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712989, "uuid": "acf653f2-a041-4ab8-a75c-c5ed1453afa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712989, "uuid": "ad634472-3134-4813-bba2-c6e7047f3ac6", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d6dd64-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712474, "uuid": "c64c0fe8-6511-48b1-83ba-e390ce4af270", "comment": "Malware payload", "value": "ba1d605b55d20984e4a5e625228833cf", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712474, "uuid": "dc4a0aef-cd62-4865-87e1-505c29827efc", "comment": "Malware payload", "value": "0307323f8599ae13899e2acf1cbb7b175e46d74b4045a3606bf351370fc3feec", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712474, "uuid": "d800c0d7-d4a6-418d-a595-4fc84c0f1373", "comment": "Malware payload", "value": "2ef3b4d1b0af2a20c92a979d1d7cf3f982959659", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712474, "uuid": "b24cb8f6-4e4c-43b0-87e8-9b470e8dcf24", "comment": "Malware payload", "value": "5c59aef07f1779874f9729a4424e643cd04059cdbeacd0b0c8e79dee2fb976ff082bc94a7638693f19db1952499311fc", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712474, "uuid": "3b8b9faa-76b1-4547-9bd0-4538edcb1d90", "value": "T109C45B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712474, "uuid": "e626c61a-b37b-44f2-b14b-2f91d311bb1d", "value": "12288:RBBC+ktPksN4rBBC+ktPksN4OBBC+ktPksN4aBBC+ktPksN4EBBC+ktPksN4p:REZSrEZSOEZSaEZSEEZSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712474, "uuid": "d1eeb815-71a8-488a-9b94-766dee85d25c", "value": 590517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712474, "uuid": "31bc3136-58b7-4b4f-9033-f4bb7173fa85", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712474, "uuid": "386bdff9-fcb5-4285-80a6-b975c2c56f66", "value": "0307323f8599ae13899e2acf1cbb7b175e46d74b4045a3606bf351370fc3feec.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f87684b-0657-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770710722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770710722, "uuid": "80613f6c-91c5-4dfa-af04-3ba1af99662c", "comment": "Malware payload (QuasarRAT)", "value": "802aa7a4a57b22e797ebeb2b3b638527", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770710722, "uuid": "d2f6b5d6-67d5-4c8e-9818-d254ffbce288", "comment": "Malware payload (QuasarRAT)", "value": "038da7941cb395df589983f3b09346694fe2a3a9e458a295ebfd5bd7c9fdb434", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770710722, "uuid": "c7fc3bfe-169c-4d0e-a1d4-675918ce322a", "comment": "Malware payload (QuasarRAT)", "value": "6179f1929d3b2cdeb9d453ef1ec5ce3c88521923", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770710722, "uuid": "d74b56ed-1fcb-4ed7-a88e-5a47e85ccf89", "comment": "Malware payload (QuasarRAT)", "value": "4f9be4eb263c9339a5e73d78e5030bbed8d3a423e59ade63c8aa162fa66047bae5a59416f1b14bcb0b64b409cbf7273d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770710722, "uuid": "15c95332-e997-4a8b-b3a2-c459356c1091", "value": "T1CAC5238537FC4909F6BF9B702CB6662486BDB8A35E25DB5E05C4309C1930BE5AD60F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770710722, "uuid": "4869d2ed-37b8-466c-94a5-94540a381377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770710722, "uuid": "2bc30c1e-1bcf-4546-87a3-be7a2c882f99", "value": "49152:j7L+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcmi:/L+2upjBVGVl/lQrCSZ4183Dmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770710722, "uuid": "64d91ab5-bccd-44c0-89c1-a4ad024cc45c", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770710722, "uuid": "7c4e2207-11c7-4852-a53c-c1cba07751fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770710722, "uuid": "dcf223be-831c-4802-b8a0-57988cca9149", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9302d379-067b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726324, "uuid": "c3fa0ec8-51b6-4cb6-b1f1-9401d47bb4ec", "comment": "Malware payload (Mirai)", "value": "393dda82b8ff510ace2fa88f3f3bf2a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726324, "uuid": "9eccad16-d7d6-411b-8c15-5927abe69874", "comment": "Malware payload (Mirai)", "value": "04e6b7f7a4b88d4229852215a7b6821ee3fc1dacc5acbf78881936ad31aef490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726324, "uuid": "770a8cfe-9bc9-4685-9a92-62739ef8191e", "comment": "Malware payload (Mirai)", "value": "845cc77e123e80bf34dbdc38c106ad0e3a4351c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726324, "uuid": "3ea474fb-fd7b-436d-b460-a71be94c2825", "comment": "Malware payload (Mirai)", "value": "29fe223d0deaebff0495e426d2e4de9966681e8971dc3aecfe00c829581cb7267bb5a8e1aa575ef91ea0cca8b833c462", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726324, "uuid": "9508552e-866b-4ff6-91a1-f85f7170bee4", "value": "T171834C02B31C0A47C0A31DB03A3F27D187BFA6D111E4F689691EAB969675D332586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726324, "uuid": "337e329c-2a28-4669-9bb4-63d2e417e3d3", "value": "1536:S38UBQdMnoBvTNXrzgt4TLjXMtvRja4H2c7kTQqL4+iauKe08rxufN:3zdM4TWtijKx1qU+FGYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726324, "uuid": "064b166c-9e8e-429f-91ef-083505b11bc1", "value": 87992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726324, "uuid": "4eaf1a6d-0292-4f08-8dfd-f866db04b920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726324, "uuid": "fd6fdae6-9597-4488-bf29-aa3a10c2ff89", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0db299-061e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770686181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686181, "uuid": "0c717791-b1d3-435a-bcd4-335dc7f67abf", "comment": "Malware payload (Mirai)", "value": "347344b47366274ea8162357001f50c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686181, "uuid": "1f795627-3878-4f39-9545-88836c19380e", "comment": "Malware payload (Mirai)", "value": "051aa68a30bf13fbb60039872123ee120e89b23e656badc41141d9a5163ea475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686181, "uuid": "330e9655-9239-4e41-bd23-807177b3de0f", "comment": "Malware payload (Mirai)", "value": "67a87536e7b4b5ba53951c62a6d336af164c0f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686181, "uuid": "f4ac44a5-1270-4daf-8824-8d1ed90dc727", "comment": "Malware payload (Mirai)", "value": "cd4208352b44500d8d922bda9bb4c2129b40bc4db10284fee820dc1bd92ddba6474fc136a309826616b43336b17a9de3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686181, "uuid": "49e023b0-f021-4c06-80b4-bf7aebfbd283", "value": "T1B804C916AF910FBBDCAFDD3742E9070139CCA54B22A53B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686181, "uuid": "5b2eb613-c665-4f84-be29-45e74d8affa9", "value": "1536:rolcmnyYr06saviJlXdHgZy07W1RehcqaB9xC3mcGHgrUBYZU2T/rlcMTnwh+IOW:rScmnYaaRAv61R4GArkYbZTnlINIzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770686181, "uuid": "f499f289-1709-4bdf-8ae5-ea88c684561b", "value": 177764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770686181, "uuid": "cca68b14-d3ce-45cd-a1b4-c217ed309d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686181, "uuid": "64c649c2-c9a2-4d58-a456-b4a2bf2d99fc", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41a7c06-0684-11f1-a129-42010a9c0007", "comment": "Malware payload (Ransomware)", "timestamp": 1770730218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730218, "uuid": "42ca9be9-e58d-4da7-a89e-8bc71cc6c31c", "comment": "Malware payload (Ransomware)", "value": "54f115740424dcb39a5e2f8a7d0d8937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "thegreenblood", "colour": "#3BE8EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730218, "uuid": "f52c0648-4246-4418-a963-5da5802f3cf4", "comment": "Malware payload (Ransomware)", "value": "05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "thegreenblood", "colour": "#3BE8EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730218, "uuid": "6cad3cec-3d04-490b-b1c9-7eb7f835ca50", "comment": "Malware payload (Ransomware)", "value": "74c039427e1ef4b6187dc6048024bf774b28f26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "thegreenblood", "colour": "#3BE8EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730218, "uuid": "7a28a306-33b8-4f40-9c90-42281c732286", "comment": "Malware payload (Ransomware)", "value": "ce4ea94dd0c00272a03f0dcade4c0d3e7dbd279005cf6f70bff165ec0fd76cc934335eeba73d8770b5775638fb5fe111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "thegreenblood", "colour": "#3BE8EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730218, "uuid": "e31378dd-a08a-4263-9c1b-83e86df2fe8c", "value": "T1C0B62847F8E20C94C4FAC2B595368226E970784D5B7A33EB9790B7342B333E15676B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730218, "uuid": "1a1daf05-d056-4a4e-8e68-5f021a0b2db4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730218, "uuid": "bea27715-4337-455d-9a2e-147a70cd8a0a", "value": "49152:UeyhCMYueFiXSha+bQmB0t4tG4tLEsuPt8nqDSqtjMti8sv0aU8ugCamW+kLG9/n:UgH24smuP1ZCcsM3oqCuENM/hMgzX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770730218, "uuid": "ca821f66-3bac-4d1e-80d4-8c60efa74a61", "value": 11169280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770730218, "uuid": "6e5d1df6-fbfc-4d02-ab33-149edf4b39de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730218, "uuid": "26bfbca3-b612-4ab6-b6bb-64432feddf76", "value": "05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a91b11-065f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714250, "uuid": "dc91b7fb-cdb9-4c27-82cf-dacc969020c9", "comment": "Malware payload", "value": "b0c940a80fb72f4e5fe0062dace0dd79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714250, "uuid": "c1e20150-85da-4374-809f-446e6f31e22c", "comment": "Malware payload", "value": "069510ed1f104299aa7692162454ff98f30483663ca5a9906a5d88cdaa2eb04b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714250, "uuid": "71bdbe16-4da5-4f0b-beb0-b51771e67834", "comment": "Malware payload", "value": "52832f8beab6fc9b4026d1497ca5c60b1ed979b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714250, "uuid": "afca69e8-5f03-439b-a2de-c007cb253ea2", "comment": "Malware payload", "value": "99eb68cff35f5e743d863255830b648146492b08f48a197cc1e61a23013be0b2794a3d5cdbb078f39416063181549d0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714250, "uuid": "e9db2c5a-bb02-4cc1-bd10-6e92003216b7", "value": "T1C2D527A22CCEF7D25772034967AB47C40319C273E981CCA8ED9A1D8542997CFFF19692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714250, "uuid": "4262bfd5-3026-408b-8581-65046bb370d7", "value": "12288:JEcztjEBV7EJAOAdNmcfSQ3Fo3GrR3qZstGGE/WWEx0rCl9xKP/SwvgBxkRL/+go:JSXCBJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714250, "uuid": "704644ff-1893-40d6-b6a9-526bea7e8b5e", "value": 2926618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714250, "uuid": "f2be9ae5-cbd5-4aa8-b509-5ba1264cec9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714250, "uuid": "43f35c55-2bb3-4ecf-a021-060ef612233a", "value": "069510ed1f104299aa7692162454ff98f30483663ca5a9906a5d88cdaa2eb04b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ce3877-0632-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770695081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770695081, "uuid": "f3eb32aa-8550-415b-a044-4310d51ecacf", "comment": "Malware payload (Mirai)", "value": "f00625057cc1d478848d5093691704a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770695081, "uuid": "efdd1d15-eba4-4c43-aadf-a299fb9cfe13", "comment": "Malware payload (Mirai)", "value": "06ddd4f1d88eaa3e201d386c544256418704af4a0fc714059eb0ec97d2c333d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770695081, "uuid": "95b66cc4-d17b-4184-b5f6-b95ed4f9309f", "comment": "Malware payload (Mirai)", "value": "8b13279859374e8bae26434e1f8f5ec5557beae2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770695081, "uuid": "e4843068-0271-4506-bbf9-177197267473", "comment": "Malware payload (Mirai)", "value": "2e0cd0bfd09910c5a3c1c6dd836ee005e091556076c47e6343bb8ac07c3db3dbd754feb1ce4d6b57560e3a03e84e7dff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770695081, "uuid": "a0d79cac-8d88-4ea5-af2f-e4dd1bed1a78", "value": "T1A80165CE65925142CE01AF08A86258C49148F3CDFB7B4BDCECDA997AC5DDF443814F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770695081, "uuid": "805cff5d-e5ee-4273-ad76-1a1e5c2edd3f", "value": "12:4p63iRTNNIl5Pq0LKm4igOPRKeMBFK3r0SO5RVtSq0ARXclc:niLNI7JKh2Tk7l53tB0Axb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770695081, "uuid": "785ba219-85d8-460d-8961-da3dd9f87246", "value": 786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770695081, "uuid": "aa81970e-5227-4959-8944-e8bbee344f55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770695081, "uuid": "25926f2d-d292-495c-af02-8283159df2d5", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0980e46-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708012, "uuid": "509d625b-aa22-442a-ba20-a14d51584b8b", "comment": "Malware payload (Mirai)", "value": "b71b18972ca294a7be537b705af78d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708012, "uuid": "7bc8da67-fb8b-4eac-97e2-046e22287011", "comment": "Malware payload (Mirai)", "value": "0835075d55b09ec5f589dec140b4453f11cd702f0b39466499c11f5161393b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708012, "uuid": "8906ed59-5221-4bfe-ad06-92cd7e61d3aa", "comment": "Malware payload (Mirai)", "value": "3c7e5c065e4f8fdf44fbb5a5149e42f4c739e01d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708012, "uuid": "34bdf9de-fed4-4688-9e9d-3fe4b07ad276", "comment": "Malware payload (Mirai)", "value": "478f3dd8f4f23d44b750bfa1b2ee7fbd24789a505ea10455dbcfb3f84c0929b0a4afa483d96129963f646525094f6fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708012, "uuid": "b8635737-e043-40dc-a0b2-5a16fa586d4e", "value": "T162D308C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708012, "uuid": "56413f11-3c81-4c33-8810-06b6ce7f6482", "value": "3072:CXbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIRx:/rybytG/Oyi42VOgLNKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708012, "uuid": "07950be5-f502-416b-af76-47813c4827e7", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708012, "uuid": "24a6a5e5-83e7-41c4-983c-04a0612ebb1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708012, "uuid": "d9dab27d-c1d2-44df-91c6-1249c9bc6ea0", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8040bb2-065e-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770714011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714011, "uuid": "f7226b9a-139d-462f-bee0-e1ad113ed6ef", "comment": "Malware payload (RemcosRAT)", "value": "a6ae54ce9e6d620075cc982dd14a8e15", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714011, "uuid": "b0d73121-72bc-4d1c-9ab6-419ab01ab2cc", "comment": "Malware payload (RemcosRAT)", "value": "0a63ad9e5a0a1451d8e87b9d15e1df76dc8d9024bfe9a77e96dca233d79405dc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714011, "uuid": "b74bf584-692e-4310-8dfa-763ed0fb5b70", "comment": "Malware payload (RemcosRAT)", "value": "1836928a7ee356925c368690f4623b89c0b20207", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714011, "uuid": "8fcfaeab-1605-4462-bee8-cabaa8f837cf", "comment": "Malware payload (RemcosRAT)", "value": "1b9e059c2627f78a40984bd9e788b28895ffd0c71b78c34988a6fc5d33baf9a2f19750692da946a8d08d144804416dac", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714011, "uuid": "7063d106-a668-407e-8487-9e10a92aae93", "value": "T185B18D1F41F07716A7E4982F3B4F4D40C6A2E82EBE448A71EB1D8CDD94AC2D1A39217C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714011, "uuid": "9e2049fd-2a9d-48f6-989f-c878e428357e", "value": "96:FfpY1VY2bjA5Y98d7YugmAldLlwnsSgSFGGZcz+3ZbPgOgk+Z1ewUWy:FBYbPnA5G8UueHlKsSgStZw8F//+fewa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714011, "uuid": "a205e652-ffcc-4f4a-9965-7419e518be57", "value": 5470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714011, "uuid": "f0802928-51fd-4351-b638-94f6c4a5a0ee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714011, "uuid": "9680d471-1d18-43e0-bf04-4aacb765dbb5", "value": "nIMG_202608022456.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b54dc35-0683-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770729613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729613, "uuid": "cea56d1d-8b2a-4c6b-b32d-115bfab0c922", "comment": "Malware payload (SalatStealer)", "value": "1335642ce72a9fda08a1cf55722fdaf4", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729613, "uuid": "57276fd5-c281-4b8d-bc51-ea22ab6a6c6b", "comment": "Malware payload (SalatStealer)", "value": "0cc55f947801e4e6e7486a840b0421300ceeee4034c9dcc509c331c86a629375", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729613, "uuid": "ae410836-c357-4884-96d5-7815ff923a9f", "comment": "Malware payload (SalatStealer)", "value": "a829aad209e3a38e46818da2d6e98e101a7aefb2", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729613, "uuid": "f899c552-a382-4267-a5ae-013af5c3de79", "comment": "Malware payload (SalatStealer)", "value": "5b2453a18a99efdf72e2466d2660d5f2ca144ff9eefb9cad9cc4e1126e94b7b72133556710776c0cc066f7a9ef2bbb8b", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729613, "uuid": "ff3abc2f-979b-4e24-b67e-5c0b40cb58ac", "value": "T13FB6337592A8CFE3105AD2760E5642F07CE57AF0E825F703F0BA682B1F31527BD9A854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729613, "uuid": "b9c3c323-cd99-427d-af45-1781c1e93503", "value": "196608:8b6ddAdESNDDDaNBR1FR9hhLQc6IFq5d/M+Y5QfDoCbRanrIyXkjT/NwP:8b6KEuONBR1FRf5Q6idJ5fDoCbROXktY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770729613, "uuid": "deeabf78-3d99-4612-9bd4-d9a91017d61d", "value": 10700770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770729613, "uuid": "3ce0f52d-bcbe-4e1a-9bc2-8f1d9a87b50e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729613, "uuid": "a00688a2-6d76-4e13-bb74-bd4d01a7960f", "value": "ghosty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e017302-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712464, "uuid": "e92c7a04-6cd5-4a3c-9cd2-60b298562087", "comment": "Malware payload", "value": "f4b2f3c2b15e559de13d1dcc6cb16e15", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712464, "uuid": "631de0ff-3c9e-4da0-bea7-61048435903b", "comment": "Malware payload", "value": "0f4371e0e8f3e36d71a34f70be060b62d456aada233de0887ab88ce6d9c7447c", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712464, "uuid": "76239aca-fd01-4883-9466-85a33ee61af6", "comment": "Malware payload", "value": "3a7fb229d669c797f9c5c11f0b8985fd04962453", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712464, "uuid": "59d66203-27e0-4f4d-b4b0-2fe4886571c0", "comment": "Malware payload", "value": "eb60b04a0efaef851fe0f992617ea0c6ab6c2ee619f554bb983fc819ec8e7ab2727c1b3f65677e6aed8f52bca784bd24", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712464, "uuid": "9c203ec9-f733-4c2c-bcf9-5a242feec80e", "value": "T16AC46B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712464, "uuid": "323eba5e-68f1-48da-b021-c7031a2f5a12", "value": "12288:V6hBBC+ktPksN45BBC+ktPksN40BBC+ktPksN4pBBC+ktPksN4UBBC+ktPksN4x:8hEZS5EZS0EZSpEZSUEZSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712464, "uuid": "2fcc8a60-06a1-40ad-9a8a-8570af27ad4a", "value": 592274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712464, "uuid": "7492e4e6-c518-417c-b286-d49017d515dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712464, "uuid": "e4beb939-1be5-439e-b519-b7a032188bc1", "value": "0f4371e0e8f3e36d71a34f70be060b62d456aada233de0887ab88ce6d9c7447c.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c018fdc-061b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770685000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685000, "uuid": "ca51b1d0-6b11-426f-8800-2c276d39184a", "comment": "Malware payload", "value": "1a3acc8efa0b462032499de4ae380e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685000, "uuid": "4915a014-3935-4fec-8b2f-2520f86ea8eb", "comment": "Malware payload", "value": "1146d4e237f11dfee4394a797800c40f43cf64d59f7a59924bc9432f3151fd6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685000, "uuid": "81c10294-da3a-4faa-be82-f5e792cf6f76", "comment": "Malware payload", "value": "7a72a4b4cb04675e0cf9b08b681e96a508088ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685000, "uuid": "00bff804-b346-44b2-ae0e-78085cab1c8e", "comment": "Malware payload", "value": "3e2fc9e1074206426b315b63d5e614aeb398a60427da36a13db20548479ea9407aeed43ffa8712866ac64f60163351f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685000, "uuid": "60588dc8-6b67-4a08-9d12-a28b7a448941", "value": "T1194533D2FAC385CFC5F3FB39A414877C74262D695A071207AA6D43B37A19C690B87D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685000, "uuid": "2e6bd22b-7d1e-46ac-abc2-e7b340240ece", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGyMVYNVZ0:dOZnWkZP1dUuMVYHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770685000, "uuid": "738190fb-c101-437a-9c1b-f341229abd6d", "value": 1254348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770685000, "uuid": "f1557f1a-8de4-405d-913d-0ca0c5d13423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685000, "uuid": "0def9bf7-7ada-4e5f-8fb2-41647d80257f", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93e4da7-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743165, "uuid": "d3650fb7-d160-45c0-9d07-dd94b4b9de9f", "comment": "Malware payload (Mirai)", "value": "2535a443210892b245fccd25e67b53b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743165, "uuid": "270d8dc4-9cf1-4ba4-87c0-e7192fb2be11", "comment": "Malware payload (Mirai)", "value": "14eee8757c40c99253f2cc2612521029ac18a130546f38bcd4c0406157f53fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743165, "uuid": "e627255c-cff5-4e21-9b22-6619621143dc", "comment": "Malware payload (Mirai)", "value": "bb3744979a93a51f07f48a983ad6283162ef0c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743165, "uuid": "0213bf02-450a-4de8-9743-38b261d52929", "comment": "Malware payload (Mirai)", "value": "8a976d2f0742772e1197b0f50642c6f22b14bef2000ee2cc2e571e89b2abb595fd0cc26ec58cb699fa96310be5350f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743165, "uuid": "0b89b89c-34ef-47f1-942d-22b882361325", "value": "T1D7C2D0331EEF39B1C2A430BAEC7C8AC7525F0BB965F1652172005B91DEE200356B68E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743165, "uuid": "a5bcd207-f775-4988-b995-38ad41c48328", "value": "768:pjKX9vt6GqA3Q0jzV7EUyUq9bXIkRs3Uozq:pjqtBqoB7EUBSXIFzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743165, "uuid": "5c3ccccd-fd3e-4b4b-a4e5-0336ec0dc8d4", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743165, "uuid": "07d99481-7014-4f1d-abd1-518df7c98aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743165, "uuid": "3cf4c9bd-bee2-443a-9a3a-7bf68d4fe7df", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461eaaf5-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770718034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718034, "uuid": "855253b9-cb83-48bc-9b5b-d8bc1cbea469", "comment": "Malware payload (VIPKeylogger)", "value": "f8153370353e00d59928989fb9cfa709", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718034, "uuid": "2e6867df-c619-4d3e-ba33-9cf8febadce9", "comment": "Malware payload (VIPKeylogger)", "value": "163fdc2dbd0e48d1f5862e2518651b66966a204c232894314ab8c399c010c835", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718034, "uuid": "7e60bf8a-463a-4118-ad4d-43e2b16c5a8c", "comment": "Malware payload (VIPKeylogger)", "value": "623177fb260fc82ade60d52d59dfb51acb6b9c6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718034, "uuid": "cf83f1a5-5e0a-4314-a860-5ace95c63170", "comment": "Malware payload (VIPKeylogger)", "value": "c50c6026b7de2f0ffce596211e61e1b544a8545776b7742c530298f9c881694e73dff5d02fad9b3530c5bec3c68fe159", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718034, "uuid": "dd9fda3c-c3b7-4840-9923-ff186019e89a", "value": "T1D8B45C30DD7406680F1717EAFC660E92CABCC649562755B1FAE9070E610A4ECE3BE36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718034, "uuid": "d5ad15a5-a022-4d94-8f9d-ff848f29c6e7", "value": "6144:EjWjwRjjHJejjHl+VCgjjHKsjjHl+VC9PBjjHhjjEjzjjHwjjHA4jjHlIjjHl+Yz:Wk8am19m6R9qvGXsDm7m692mm9JkmnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718034, "uuid": "3d6df4c0-9808-48c4-902f-d9b3e7a3794d", "value": 528288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718034, "uuid": "9439ea05-8ba9-49c7-bd34-9fdc64cc398f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718034, "uuid": "24ceca5d-81c4-4743-829a-c46cfea06fb6", "value": "Urgent - Request for Quotation- RC-26-6799.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478ed02c-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712453, "uuid": "6f845216-5c7a-4d72-b5aa-3e85bf929cf1", "comment": "Malware payload", "value": "eef0a1a8c16e8019b7833dc9cc348876", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712453, "uuid": "b8d87d3a-6c97-4be7-9150-cb491ca278c0", "comment": "Malware payload", "value": "18846eccf11cfa1a77356bf7d5026670d6b285266349d83b15cd2862b3ae5554", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712453, "uuid": "ca5d540c-bd43-4058-bd77-a2f791942b59", "comment": "Malware payload", "value": "3b719d9439b07a8e7ba174d79cbb5dc0268131e7", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712453, "uuid": "1631f2f8-482f-47a1-bde4-44dd317f4a54", "comment": "Malware payload", "value": "428691a5217c42f58f6ef71980f5d886d8988fb7242973cebc4482f3f16b24543dd08ac3e44f5fed9ada7d726e290d89", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712453, "uuid": "c1734491-e07f-4bed-9f89-134a464cf819", "value": "T1E6C45B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712453, "uuid": "4a012998-8062-4de6-9c45-8c4892f9014e", "value": "12288:6nhLBBC+ktPksN4zBBC+ktPksN4/BBC+ktPksN4KBBC+ktPksN4ABBC+ktPksN40:6n5EZSzEZS/EZSKEZSAEZS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712453, "uuid": "551b54f7-d946-481f-9834-effb94d3e774", "value": 592156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712453, "uuid": "22ee62d6-295c-49a8-be9c-7790ef8baf7a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712453, "uuid": "ac357686-b65c-4b9b-b9fc-936a675d23fc", "value": "18846eccf11cfa1a77356bf7d5026670d6b285266349d83b15cd2862b3ae5554.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40984d48-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712442, "uuid": "325683ef-aca2-4af8-a642-bf47181315e1", "comment": "Malware payload", "value": "af42f926a1e5c0a717f4a13a162a4163", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712442, "uuid": "0d135fed-63a7-4e14-a025-2802f7ab9bdc", "comment": "Malware payload", "value": "1a6072b3d3d288eb25e7e738971c0ea76ae14d76e092daa2400e1b107b212bac", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712442, "uuid": "5b9a547b-a286-4b5a-913f-0b6bd792983a", "comment": "Malware payload", "value": "2b4953ecad9de4e4556db52766ff79ab32c5b128", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712442, "uuid": "3f1170b3-38f9-4fa3-8ca0-8ebd58a3700f", "comment": "Malware payload", "value": "c6b8879f09f03583a0e6eb97a52b6d4f7d7cfb448fac95ffcd5fbb31e21c937170a5ed9ca5079c650f962cb824a1f2ee", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712442, "uuid": "df6f056b-3fda-4061-9ab1-5c6852c012da", "value": "T1DBC46B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712442, "uuid": "f55fc7fb-3c50-4952-bf84-faa3df1766fa", "value": "12288:VBBC+ktPksN4YBBC+ktPksN43BBC+ktPksN43BBC+ktPksN4jBBC+ktPksN4m:VEZSYEZS3EZS3EZSjEZSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712442, "uuid": "5fac988e-c2d2-489b-b805-b72355c219bf", "value": 592244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712442, "uuid": "ff8d1a7a-5d25-46d9-aa7b-7a0c46054cd5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712442, "uuid": "f87de44b-e38c-46e4-b6bc-477c7dc191e7", "value": "1a6072b3d3d288eb25e7e738971c0ea76ae14d76e092daa2400e1b107b212bac.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769da15c-0679-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770725417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725417, "uuid": "c0ab16ab-e752-46ff-8c75-cf26ffd550a9", "comment": "Malware payload (AsyncRAT)", "value": "6782b6d750b717ea2c048b8ee00ece17", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725417, "uuid": "2e83cef3-68ab-4a58-bdf4-cf8f3c0d5704", "comment": "Malware payload (AsyncRAT)", "value": "1ab4672076f63692e67555ebea72d9d7593928012ea7277776057e354d70364d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725417, "uuid": "7e55cde2-43ac-4eb0-9a43-2d23bcdeec0b", "comment": "Malware payload (AsyncRAT)", "value": "3400163e041d1b3bc7cb871223777097ca5aa133", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725417, "uuid": "04ad10a1-8785-4865-91b5-1eff943c5e4d", "comment": "Malware payload (AsyncRAT)", "value": "f7fb5e064b5b815676603f533ebeace5ab460e0f7ae180dae89a321bcbed5548c995ca61063acbe4d34dc862eb827455", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725417, "uuid": "ad04af73-e08c-4c2b-a243-1f1aa821934f", "value": "T1E2D24B08B3D48561E1FD57B94D7292048771EE5BA973DB9E2FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725417, "uuid": "a265e4ca-3580-4c99-8133-f10361b6bfed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725417, "uuid": "f2bac796-db73-4600-b8f8-70aec0893aed", "value": "768:G0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dTi/+:JoRXD/qymB1iwRbN/w/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770725417, "uuid": "fe3d1dcb-0457-49cb-8acc-591c8b72b74e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770725417, "uuid": "08f8d68f-f6ea-4b0c-8358-702b2c80641a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725417, "uuid": "19bcf8d3-00f4-4458-a3f5-b8e6a566869c", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ed7da6-067a-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770725810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725810, "uuid": "32077394-03d5-46d4-856b-7e313e8126d7", "comment": "Malware payload (MassLogger)", "value": "f57daa8141bca737460d4c241dfe2151", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725810, "uuid": "ed297110-ceb3-4dd7-aeda-8d060881ef69", "comment": "Malware payload (MassLogger)", "value": "1b44667a41735a6ef7b5f0a5da1146a7a92d1ab053de189483fc5b039f735505", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725810, "uuid": "ea30bb83-a75f-4bca-9bde-bd6cd989ac6f", "comment": "Malware payload (MassLogger)", "value": "34c8557b990a7bf20ccc9497aa82b80a96a7805e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770725810, "uuid": "75d52a34-410b-4d9d-a57d-58ce22869dfd", "comment": "Malware payload (MassLogger)", "value": "c978534fd121a2c8968e8a7359108a04a4ce7eeea78d3c9fe617004a5b53bc486651070b2f915230d58a811c7c44cf27", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725810, "uuid": "84fea9ba-d4e7-42d4-9d70-3999a21adf94", "value": "T1CF45450B6563D714F917F180343930ACBEC91499F068AB5C6C3BD1A5E6BF28856B48FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725810, "uuid": "7d625df3-7a7b-41a6-920c-d717d4a4d1d0", "value": "192:cKjT5BOyVTRVstB5F1GIF1VhVeHLTrF1YzhuKcEX7qKnnKQoBAlOuB4swj9UI5PN:Z6PF1lF1EHLF1b9GHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770725810, "uuid": "24712c73-ceeb-4dfe-97dd-fde02f4ec88a", "value": 1187435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770725810, "uuid": "d0112983-8ec0-4892-9f2d-8d661ec2537e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770725810, "uuid": "2c9b625d-508d-4ce8-90b2-e1792a79a407", "value": "dekont.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fcac49-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708016, "uuid": "01f8d006-fa67-40fc-9320-f615bb1456e2", "comment": "Malware payload (Mirai)", "value": "a90ff615eb0fcbafa325741d3ca86d5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708016, "uuid": "1fe95cbd-f627-4ea3-8050-3a0564aba096", "comment": "Malware payload (Mirai)", "value": "1cb5a05136a897f87987cc948be575b25ec53b45bdb9646f92fac5f0b4aac5b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708016, "uuid": "c0d10aa7-869c-4cdc-8bbb-3d07c6b6b80f", "comment": "Malware payload (Mirai)", "value": "bee8509ae0fc3776a4f396a2671b8b26dd2bfb58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708016, "uuid": "2b6a9072-deb2-4f01-89f5-6d001c1c0710", "comment": "Malware payload (Mirai)", "value": "f65769a1073a196b1275e5362172f0b3aea2a6018619323a4b9a29b4eb238c53f08282fe5407715d9374faff0dec4e64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708016, "uuid": "217ce142-65b8-4ec5-bc33-49018b698eb4", "value": "T1E7C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708016, "uuid": "50b73d5e-6a5e-4b69-a609-8066cc669e21", "value": "3072:fJD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1t:fJD76aX9aKTcRQVnoiYq1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708016, "uuid": "64955a78-ded3-4dce-8e23-abd7a8cdbdd5", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708016, "uuid": "f8fd8495-f3be-4b08-b5e1-aa6da27ea52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708016, "uuid": "243c4839-5fe2-4869-aa6a-0e4dcc366e9a", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f459f475-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770742808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742808, "uuid": "29e9b177-8947-46f5-a6a9-ed62377c962b", "comment": "Malware payload (GuLoader)", "value": "2e23e44847f75c160a37ca46c6141804", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742808, "uuid": "6f28f93e-221b-46d1-9982-5936400ed591", "comment": "Malware payload (GuLoader)", "value": "1d7d127d7b1ed83d2d74fe9d07e29745cf372317127cd6232fd8b164b06d15f9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742808, "uuid": "f389910a-ffeb-4335-b329-4afbe6c7ceb9", "comment": "Malware payload (GuLoader)", "value": "ebf412a60dadd65372ec0ca40ba7bbda95d120ce", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742808, "uuid": "6bcf9179-5522-4d81-a994-75c0e582b9e3", "comment": "Malware payload (GuLoader)", "value": "637c367d64e7c53db17cb8cfa35eb466a3e9c06e37430e472e2253abe2f75cba6ce20a08d2baeb37db595696d9d2cded", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742808, "uuid": "b2da0caa-5655-4378-b733-01e7a99125d1", "value": "T1D4412A452851280C306A1775B337EE09A364284625F4A6AEE340AE1B70AEB4BE164839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742808, "uuid": "64189d8e-b6d1-4269-8f2c-f967a6b13ca9", "value": "48:ZS9bEv3b6IWk8vndr5wqYf+11rfLpMrbyDHm2ZWd+5c:ZStEPb6IWH/dr5WeZSbyDGkWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742808, "uuid": "2ce6424d-de70-48a6-9b8e-91394276fa67", "value": 1905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742808, "uuid": "eb6c2381-5cf6-4183-b8f6-a71559a1ae48", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742808, "uuid": "f992a319-5efb-4210-b40c-d4db0f2eb057", "value": "nRequest_for_Best_Offer-_HS_CODE_REF_102195_ET_115959_pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a76dde3-061e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770686178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686178, "uuid": "9ff80725-f8b6-4322-befb-eb1e70fd9eaf", "comment": "Malware payload (Mirai)", "value": "6841608320abfb0559b7cca1df8a4cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686178, "uuid": "2a2cfb93-a737-427c-9ad6-a74a5b314075", "comment": "Malware payload (Mirai)", "value": "1fc13bbbccc065511c05659d294e530996d2b307dee1ea044d747059970ccf1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686178, "uuid": "b117fb21-7074-4379-b8fd-871dcbebee5c", "comment": "Malware payload (Mirai)", "value": "fbd85cd11c0ac50da00d3cccb31ffc030dc19022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770686178, "uuid": "9dc1ec22-4d6c-4d75-a991-5f577e6cb232", "comment": "Malware payload (Mirai)", "value": "057baa64dd117fea245e0e819f9166b498f0f03e628187123e3a6bc7e884d35b233b40bc0f96d2bd53c1c60c8b80a0d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686178, "uuid": "16072349-b390-4eb2-8462-6c3131034452", "value": "T104B34973D8296F58C555D0B0B0B18F792F63A590824B5FBE2AB6C2B05083D8DF549BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686178, "uuid": "2a246ca7-59ee-448a-9a7c-c6ecc6519217", "value": "1536:I/o/nK7DxZFB0oZ0CboKG3mIb3EuliVDWe1yFArCz7/:Iw/K7DBZ0qPGhEusDWeUFAo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770686178, "uuid": "3826327b-8bac-46d4-bc45-c078cc08064d", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770686178, "uuid": "4364bbf8-c4dc-4217-ae6b-0e51c6a98d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770686178, "uuid": "df2fcded-5a44-48e8-b0d4-5cf6bf06e9a2", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7387d6-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770738770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738770, "uuid": "abfaa94a-a8e1-48b5-84d1-bc131ac8fe26", "comment": "Malware payload (Stealc)", "value": "e51db01a43f2b49c20e5c5cde2d894db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738770, "uuid": "a1468920-24ab-4ade-ad45-35572433aecd", "comment": "Malware payload (Stealc)", "value": "20a0819dba41dea5b9a6c71ef7f84a0241d129335d290cff07c095fda6e3b423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738770, "uuid": "a805b0b1-03fe-47e4-b1ee-3dc94adbef9f", "comment": "Malware payload (Stealc)", "value": "bb2cfdd19c1ca4a78fd506eaca58e2f28a228bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738770, "uuid": "f7be9372-cc56-44a6-985f-1dd8cbcbc12d", "comment": "Malware payload (Stealc)", "value": "7fc76ca78fd0e2167555286bc7e9b8e843e1aedce54e8ffca83d4dced38200a7ceb88d73714918725f7817b465e08869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738770, "uuid": "0a824ae1-4557-44cd-9ceb-cca84d9fdc1a", "value": "T19396128164C4DBBCC08A473C7145419935E0AD9998FCDB4DAAC6F8237FB1FAC15A93A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738770, "uuid": "b59dc273-dbfe-45f2-ab36-b38957066f08", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738770, "uuid": "e43aa346-9981-47fd-a07f-b95167f06efd", "value": "196608:MgJapTtLEGnzAHRAW0VqAeyMffG0H0QSlsuNxRkZyYyKPTnj:TYTtL90RAW0VtJMXG0UQms3lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738770, "uuid": "5cfc0f7f-4359-432f-9002-a477a84f4cfa", "value": 9182288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738770, "uuid": "67ede4ee-f3b6-40c3-968e-6d8ecd40792c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738770, "uuid": "2e3997ac-eefd-4c98-9e25-4454d63dcb1d", "value": "20a0819dba41dea5b9a6c71ef7f84a0241d129335d290cff07c095fda6e3b423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041add92-065f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714058, "uuid": "a407e9a9-46c2-4117-86d4-960ac39911e0", "comment": "Malware payload", "value": "606086c1bd649533c2f0e3b376989ec7", "object_relation": "md5", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714058, "uuid": "7c32ea1b-c625-42d7-97e1-8747735abf02", "comment": "Malware payload", "value": "20acace26bea8baca56ddf4f9e92d71bea00ca68750ae01f0c890e29b220df3c", "object_relation": "sha256", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714058, "uuid": "48b6263f-ab58-4cc5-a120-f35cee5578a9", "comment": "Malware payload", "value": "cbeb4e9658757afd77f37e6a1c58cd57330d5b91", "object_relation": "sha1", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714058, "uuid": "e336e2fc-5583-4a3f-a67a-f48d10bb2d58", "comment": "Malware payload", "value": "3cae3932ba28db5e79ab84b7e87ff6ac571761d4761320451d4fd2976c9d1bff4c2bad27f122097ecfdc179e10617e3b", "object_relation": "sha3-384", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714058, "uuid": "f3671bf2-6daa-4faa-991a-4cbec5e430b3", "value": "T1C0163320A24C40C6DA6E24353EFD5784F923864AA412ECBC3BB899D54B7015F6DB3E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714058, "uuid": "1b84bb35-0331-46c3-935e-ef928fdc9d7c", "value": "96:wzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzG:x9o29tNUVJ5Cb21M8GJLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714058, "uuid": "d6937429-bc19-4f65-9177-9a1abd5ca17a", "value": 4093383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714058, "uuid": "9227476f-a424-491a-b4f9-149f7f8fde69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714058, "uuid": "162108ee-26e2-4aa5-9995-6dacec3088f3", "value": "20acace26bea8baca56ddf4f9e92d71bea00ca68750ae01f0c890e29b220df3c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeafbdc-067d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770727339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727339, "uuid": "10fa078d-7944-424b-8304-8a7e0fd6ca03", "comment": "Malware payload (Mirai)", "value": "b3ffc35c219501438cc141a95dbe964f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727339, "uuid": "9e376fe7-70ea-4ebe-8860-1ae9eec8e30d", "comment": "Malware payload (Mirai)", "value": "2476ada125f8377faff60851d2ac99690369beb2a24dcaa8df8505f6d0f0b1f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727339, "uuid": "8e3c50e5-54d5-4d1d-8daf-1dbfba20d194", "comment": "Malware payload (Mirai)", "value": "4a6417405ec8b62cb87ca1504de479b4ecb36ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727339, "uuid": "b06ed448-7b47-4b88-a2c1-ee42188ce917", "comment": "Malware payload (Mirai)", "value": "a2ab5fa32e5abaf997b5a1def9d6c5621b1eaf37d712b1fd5430d94520ba10441840dc41e491d71f4ebcb7f7af303698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727339, "uuid": "707590bf-873c-4632-b4e8-a3f335aa5b60", "value": "T12F933A91FD815A23C5D112BBFA6E428D3B2613E8D2EA3203DE215F2177C785B0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727339, "uuid": "8e6ce9ea-35e3-422e-929e-0c7d2daa0d4f", "value": "1536:UFfUbmsTPFWZeNEWBWlYFLMFpdYKVRBOCQgwaj5KeqUfvrSY:4fUbmBed/EpdxjMQPrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727339, "uuid": "0c4b4374-941c-4761-9cf0-d10162a893b3", "value": 91992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727339, "uuid": "1f3a0eaf-6e36-4c4e-8447-23aaf1ccc8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727339, "uuid": "77784513-6ab0-4941-b898-aa67f39d6625", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b12de8b-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712432, "uuid": "3c7ba804-f661-4d1f-8bd3-acc027ec2057", "comment": "Malware payload", "value": "a48eb5df8275f516b8dd900f34f5a389", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712432, "uuid": "57038a6c-fb52-4fca-ace4-1e49b4566651", "comment": "Malware payload", "value": "2841aa909939a9476b22689e3c8c031f412d4393f85e4c3a9ebce372ebb30cf2", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712432, "uuid": "106fa4fb-b4d6-430f-82e7-f5d1ee24be91", "comment": "Malware payload", "value": "79db540b5bc498586d64a3bc008d547e76f2bef2", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712432, "uuid": "285b8136-e0bc-442f-aa4b-a641903a2b7b", "comment": "Malware payload", "value": "04b618d06c8437263023f4944e3cd57c09e337d9bf2f28f81175addf8ab4433fd6b95669e75efeb139b0d6e10f62ff55", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712432, "uuid": "78353d8f-3523-4455-9953-984b38d98891", "value": "T184C46B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712432, "uuid": "828fb623-b927-473d-88f9-ed7cef0a0054", "value": "12288:6BBC+ktPksN4PBBC+ktPksN4RBBC+ktPksN4eBBC+ktPksN4NBBC+ktPksN4C:6EZSPEZSREZSeEZSNEZSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712432, "uuid": "0ef7d890-a584-4411-9b60-a9378266cdcb", "value": 592154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712432, "uuid": "88d3d7e6-0a93-4ef7-88f0-cdc866c4e2c0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712432, "uuid": "63d8eb64-988e-4a3a-ab9b-2ac86a8d9e16", "value": "2841aa909939a9476b22689e3c8c031f412d4393f85e4c3a9ebce372ebb30cf2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f697df14-0688-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770732074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732074, "uuid": "54c07361-b20e-48f0-89dc-e543024d371b", "comment": "Malware payload (Formbook)", "value": "59879736be8c6d84e98ee32bcebccbac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732074, "uuid": "f91635b3-9c5d-4de0-a752-f1af98c35e88", "comment": "Malware payload (Formbook)", "value": "2acbe1adaa423f16b66019c923e753d95fa014348761fb584cf5f2f3bb66226a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732074, "uuid": "5ae7e113-4a78-43b5-a802-89564b45dc0a", "comment": "Malware payload (Formbook)", "value": "cb160b5a312661670e991a01604acd630150bab3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732074, "uuid": "5482146b-35b7-4bae-8359-30beae4af120", "comment": "Malware payload (Formbook)", "value": "306b1df3b1764a9f70b9332ed10fe2cf20f9f02413da974a50d729b0ea3f476537184d43ab9afb110dff45f83af393a3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732074, "uuid": "59c667a2-08d9-48f6-9b30-db451d64d91f", "value": "T15241E8089D32C8013C51AB9C6DFB724546B1AB99953BF621E02036B44AF30E64488B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732074, "uuid": "5739c85e-da51-43db-b601-0eeface63cb7", "value": "48:ZSJB+t/mzfwzWRDjXfxDVXdgOv7FTzS1ojW4EaHhXs7GX:ZSJBcmDxsyFzvFdHts6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770732074, "uuid": "ae5eb4ab-61eb-4bf8-ae6b-36474b20f060", "value": 1899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770732074, "uuid": "2c1a5b75-602a-44ab-8e5f-f4773904167f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732074, "uuid": "4e83929b-81a5-44a6-ba5b-828384c15542", "value": "nPO_345378_29__26_P.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c5c499-0661-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714945, "uuid": "7b5d4407-ead3-455d-83ab-638ddcd9c3c7", "comment": "Malware payload", "value": "2a7be5f2a803f13264997ce93d184be2", "object_relation": "md5", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714945, "uuid": "672e4a94-6cde-4dd9-bd88-4240ceda04a7", "comment": "Malware payload", "value": "2affd57658a38957474622b9893f3f30bf84da1dc10892c94a44acf96005dfd9", "object_relation": "sha256", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714945, "uuid": "cb5e8bfa-5de7-4e99-96f0-d8cc2d2f8dbb", "comment": "Malware payload", "value": "1ca6ebd44bb9499ef0f87f769c25da834fe75ef9", "object_relation": "sha1", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714945, "uuid": "3818de3f-31c0-4cc4-b403-20c1c0ead328", "comment": "Malware payload", "value": "990c67c6a737a1fa16be2418baff5e1fae70a287226da34c00eb21277ec6bfeafd4839b58619fd73d8c31d3483f2ca4a", "object_relation": "sha3-384", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714945, "uuid": "8b0599c3-911f-41f9-97e7-57855c1cc846", "value": "T1D0433D6D00ACC491953A60940A3EE6EF219ED331F7EDEB515BF302B788607B7BD6A015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714945, "uuid": "e6e4e809-cbcd-4f21-9da4-01cf41aa5232", "value": "768:DSvrZTh82azwxo+ULNMTSJy3sMWo0cSvrZTh82azwxo+ULNMTSJy3sMWo00:DcEJCTSJKXcEJCTSJKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714945, "uuid": "f895de02-bea1-414b-8f5e-5f9d241f784a", "value": 57924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714945, "uuid": "875a6065-aafc-4335-a00c-fa4c8168335a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714945, "uuid": "096101f0-49c9-45b2-96c2-be1247fc8146", "value": "2affd57658a38957474622b9893f3f30bf84da1dc10892c94a44acf96005dfd9.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72703cb0-067b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726269, "uuid": "3b556550-49a3-43e8-b6da-8ff3b5ffde2a", "comment": "Malware payload (Mirai)", "value": "ebd0ec9892f2580ae971d71756cbdb96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726269, "uuid": "b0ce5ff3-380d-4cb5-8840-58a757722327", "comment": "Malware payload (Mirai)", "value": "2b8e29b9332a14bd926a626ba33db7a1489990336565882b05ac3368eb1de53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726269, "uuid": "7f5e9fe2-6303-4f5e-840e-5fd11dc7718c", "comment": "Malware payload (Mirai)", "value": "9cf18bdfd537263f6a48e33fda9d43440594808d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726269, "uuid": "9fac81e9-048b-4943-a182-4b64def29ad2", "comment": "Malware payload (Mirai)", "value": "ec97ad06f1d3b7f5b5dcc14015a4987bb015abad9e0de6c75159752a53a90002890e365a11200b2deb9740d7a8ffe96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726269, "uuid": "b38d2b09-b427-4138-8bb3-a29f2825ebb8", "value": "T16303E180F4E41C0ECF5BDDA66E32CA91AF358DDD66A01EC9D6EAD3312903411BF44B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726269, "uuid": "58709779-cbd2-422c-a3cf-0c4e9f46fd61", "value": "768:AkfsrimbY5ZWp4xX7nqaniMXwkv8AIAkQOfc6CC4uVcqgw09v:AkQM3xLnqanXXPvfIAkKtC4u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726269, "uuid": "7da81e31-02ff-44c7-a92c-793fc31d48a4", "value": 40276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726269, "uuid": "c45ceeb3-435e-4949-b469-25837180fc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726269, "uuid": "53160c53-4da2-47e0-9683-29187163a3c3", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debd6db1-0659-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770711848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711848, "uuid": "df4fc2b3-8db0-4747-b939-2f5c71441a02", "comment": "Malware payload", "value": "b4f2af6ed2916673bd17bac09f86ae5c", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711848, "uuid": "1a3afb01-a524-4b52-a362-8f9db98e1aae", "comment": "Malware payload", "value": "2ecb10876a4288da43b866d098d4f005c7b821aac71b72f6d77cb18e37ac195a", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711848, "uuid": "ed9a565f-14f8-4309-b4ac-1d87dea7da53", "comment": "Malware payload", "value": "977870c1a3f0975dd0f8793ac5801e615907fd8c", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711848, "uuid": "538fc780-6fd4-40ef-a933-19a77f8b6598", "comment": "Malware payload", "value": "a56505f470a787835fe9011a86873543b2008b75d1c3b8c1a8859139450b8da0aa53f6f2cbf7370ef2cf4589eecb4c15", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711848, "uuid": "2b6c154c-059b-4dc7-9f8e-f1dc871be69d", "value": "T110B35B4763A500BBE13A8678C9634E45E776B8110764EFAF03A483961F63BD18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711848, "uuid": "21261ebb-36a6-44b8-9b78-8d06d48b7ff0", "value": "d2169c27e2c0d6be26e0e52b32d7e13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711848, "uuid": "878229a1-75bb-41a0-bde4-164a8eb97b8f", "value": "3072:cBxswjBC+kOsZpb42Qriks17Y4Rr80Okprzy:cg+BC+kjZlqiksNYEdzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770711848, "uuid": "010f4781-e752-42aa-a151-c589cc31a010", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770711848, "uuid": "18bac2ae-c2b4-43dd-835b-ee31c110b735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711848, "uuid": "767faae7-06d6-49a1-ba2e-1cd8e726fc4e", "value": "2ecb10876a4288da43b866d098d4f005c7b821aac71b72f6d77cb18e37ac195a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c5b531-06b7-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770751982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751982, "uuid": "c434ccaf-e853-4642-a9b3-22b421bff26f", "comment": "Malware payload (GoProxy)", "value": "33b68203279605561e7384f2d406c289", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751982, "uuid": "55ad52cc-00f3-416b-982e-897647ee9cd9", "comment": "Malware payload (GoProxy)", "value": "30424b733fe17e1e601f5c2ddbd75a0979909835356d5d1e7bb27182da11ea13", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751982, "uuid": "c3859c5d-22a2-4d56-8c62-a62fd3a3cb55", "comment": "Malware payload (GoProxy)", "value": "92fd7a74341ea946027dab83f890d9303db89ddc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751982, "uuid": "6264e3fa-1c1f-4670-bfb2-db54d3e03992", "comment": "Malware payload (GoProxy)", "value": "65e32355a8070ececed3a338a429d54545c87159cf39d6b9d4bee97ef7337265f98999e5ace0a3fc7049c99b56b11e4d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751982, "uuid": "0ce680be-00ab-4330-b976-d55f3d9f7bb9", "value": "T15E664A07EC6155E9C0AAE2358A63D153BB717C495B3523D32BA0F7282F72BD0AE79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751982, "uuid": "827a9f0f-da2e-4241-b1b3-d0940eca0d2f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751982, "uuid": "064bae35-9186-47b4-a48b-7ebe1dcba1a2", "value": "49152:ry3YdUJgmqNXS1bb/7NykVsQU03NDkbWwL2U9l2GoXdGTqFO3jxwg/jl8w9PUdC2:ro+DNSZfvabd2U9obXHkjR5Pb0Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770751982, "uuid": "a0d632de-51ba-410d-a760-522ffec769eb", "value": 6761936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770751982, "uuid": "295892eb-5e06-4a4a-9d7f-c31eca447c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751982, "uuid": "47298cfa-7349-4b41-82bc-fc32ec67c69e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7e50d1-0697-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770738315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738315, "uuid": "6581c3a0-558f-4db5-9ab8-9228b88c62b7", "comment": "Malware payload (AmosStealer)", "value": "760c89959e2d80f9b78a320023a875b7", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Trojan:MacOS/Amos.FB!MTB", "colour": "#65906F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738315, "uuid": "3371713a-5b07-48fb-81d6-04f6508ae635", "comment": "Malware payload (AmosStealer)", "value": "30f97ae88f8861eeadeb54854d47078724e52e2ef36dd847180663b7f5763168", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Trojan:MacOS/Amos.FB!MTB", "colour": "#65906F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738315, "uuid": "7010f9b2-3a97-4415-8e8b-401a22bf040d", "comment": "Malware payload (AmosStealer)", "value": "ac39f9b861a2c5829a4a841a0277763aa7acd84c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Trojan:MacOS/Amos.FB!MTB", "colour": "#65906F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738315, "uuid": "f006e7e3-5f54-4e45-afc3-541e1862c284", "comment": "Malware payload (AmosStealer)", "value": "f0368e644e3f9879ed1376673ca02c7a4c7f68c3f5c01b8e58ce4178ca54087b2ea243db5b4b74ba472a7a5e2d9b5ace", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Trojan:MacOS/Amos.FB!MTB", "colour": "#65906F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738315, "uuid": "75908d78-cba5-4362-8283-4992933d9279", "value": "T14BB419E3623C55F2E98EFB7CF40F2267F936BD4155B8B5D05D810A110ED9360AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738315, "uuid": "811fc794-66c4-4d32-b255-f03b537bf385", "value": "12288:HaOLNaXUoyWecdCiLkZVFRmocmXqtWdmHJxXOTT////wpy8PBS/iSxgNSG:HaOLUESfWdmHlNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738315, "uuid": "ee410ff3-7032-407b-9d80-60d53def3045", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738315, "uuid": "be2d3314-4508-42fb-a9ce-9697ace3bd0d", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738315, "uuid": "5fa22037-ecd6-4e0c-884e-f404505e9a6f", "value": "dyrtvwjfveyxjf23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d71f016-068a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770732596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732596, "uuid": "0aef3050-11d8-4cb7-8099-7fbe3e1c7983", "comment": "Malware payload", "value": "887865b427b0d03aae91f2808eea1438", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732596, "uuid": "687a591e-049a-4408-a114-d819c6b49d02", "comment": "Malware payload", "value": "3143d90eae4bdce90b538652cefc1ba92a69856a77cbe33a6947120c6d0fe3ca", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732596, "uuid": "42afc4b8-cb60-4ac5-b32a-92fbfdfa6845", "comment": "Malware payload", "value": "725964400694f81086a686dde93764f2c46359bb", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732596, "uuid": "ee9ff78e-e5b2-4551-9b9b-98f8758078ab", "comment": "Malware payload", "value": "a6714b9abd5f56f8ebfa4e53c8e9c8d6866753864fa0dffe36d0fe5b4bc43a5afa2f734e310d4a96af1585b12a18e9ec", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732596, "uuid": "f95ea2f3-3c85-4926-a298-df522f49c160", "value": "T13AD0C731268E1BACD1044FC6534DA105E0D5D06B52203074FAF29451F06D553E918739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732596, "uuid": "51131570-b632-49fd-a104-d0030ac18a2f", "value": "6:sny2jrQLv6IlHaSAtiLVCWKMJQuXopcwh6JBJQJQ66N:snxj8L6I16MhCdMJsprsQJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770732596, "uuid": "e7b7d53e-77ea-4807-b943-deaf68620530", "value": 219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770732596, "uuid": "55bfde8a-4dcb-49ea-bdaf-b0d6ee71d33f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732596, "uuid": "7cc06181-5cd5-4011-9ea8-b3251db252f3", "value": "captcha@142.93.242.144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb743e7-0654-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770709618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709618, "uuid": "620695e7-122f-4dd0-bfc7-d35cf867db4f", "comment": "Malware payload", "value": "8976cf53ed1ee086e8543f582ed0eda0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709618, "uuid": "5b2205b8-799f-406e-8a26-883149e91d00", "comment": "Malware payload", "value": "32e114f2148968625656678229f63adbfb3a8f7c085acd7b2b828f3f626e8e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709618, "uuid": "7d777b6a-9087-438a-ae0d-b8766076edc5", "comment": "Malware payload", "value": "16ada776cc42f5d393072ce57248a1e55e14d610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709618, "uuid": "dd78252c-daad-4cb9-8e12-5e75584be77d", "comment": "Malware payload", "value": "657b8da1b727dc64a0f3683e0a9f62595630676dcd09effd51d3d60cac4c9c1223603290113b8d1b244dab658f41e974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709618, "uuid": "c2bde33c-5cac-48b3-97ec-41e85336cec7", "value": "T165D423976B41E7E1AE756A31ECC4670C0D384935602672CBD0B13CB0F7267A8FE1B666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709618, "uuid": "4d345288-115e-4a25-adde-a7f5126df64e", "value": "12288:5EPOJnGunBazvRrJS/rzCwGF1CBxOeDmXWYW46pXMiFk4Kk9PCE93:eWN5Ba1c/XeF1CLTyGbR+iFkVvE93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770709618, "uuid": "c1a7ba1e-fd21-4de9-9957-5c6ec1e82e67", "value": 597971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770709618, "uuid": "47cf4013-da04-4190-b928-c7054d0c42cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709618, "uuid": "6766132b-bc68-43b3-91c2-ca2724c8b161", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff39db83-0682-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770729512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729512, "uuid": "907371a9-2727-46c5-ab8a-e781ed8dd7f0", "comment": "Malware payload (SalatStealer)", "value": "43c03274d487bc502618982bafa25986", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729512, "uuid": "45413d41-93db-44eb-97f1-739259ffca20", "comment": "Malware payload (SalatStealer)", "value": "35c08cadbdc3e244e866f47891e157f2b567679c977c2588c98119bffe591576", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729512, "uuid": "5dea2c14-48a6-45cb-93d2-05ad256e4562", "comment": "Malware payload (SalatStealer)", "value": "5d8a99d45d98c933b8bf397faf05a1efbd2ce729", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729512, "uuid": "a4fbb5de-0efa-4809-82a9-0a0401f19533", "comment": "Malware payload (SalatStealer)", "value": "b1ef2cf52ab838032eec2a2a5a4cb69ff9f7a1a488d5efbe32e904089595b6c550ca6b18e7b6f31cf4d6cf6ff8a491a0", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729512, "uuid": "24f48054-0805-4ced-a377-0cf08a4ac964", "value": "T111E6335846F9CAE7156DD2362E0613A07CD9AFF49C66F302B17668272F2311BBE87D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729512, "uuid": "37ded70d-664c-4e1e-ab4a-9f5d38c376c6", "value": "393216:HWHnWHDb9Ti1cuONBR1FRq9QOidJ5fDoCbROXktwc:220OrRXRq9Q/NpMgwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770729512, "uuid": "e1711f3c-c3b2-4cf9-9443-88b93462a48d", "value": 14068210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770729512, "uuid": "b6845e73-3d16-40dc-95b9-f6edf8a0fc17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729512, "uuid": "c2bed7f0-f4c4-4552-aa11-0c67e5410da2", "value": "webhook.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af70535c-067e-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770727660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727660, "uuid": "ff79b440-1402-4663-b4fa-065ebd428728", "comment": "Malware payload (MassLogger)", "value": "a7c68d5c3034e031b196bce2076b0496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727660, "uuid": "388c2dcf-28a5-47b3-9b58-7ac68566ad76", "comment": "Malware payload (MassLogger)", "value": "364e64c2f1efc897342a41c5389f83d86cbc6b56e39abcd2a5e48e1a67fa1fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727660, "uuid": "dccc561d-f826-45bb-97fa-55b09f720130", "comment": "Malware payload (MassLogger)", "value": "33e19283ac8618943507a9e2aec348cb264d0595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727660, "uuid": "d9b8eed5-d85b-44fe-93ed-3cefe66bd703", "comment": "Malware payload (MassLogger)", "value": "7969bcefd275e91a56fe64022deed28730559aece46e76c4339e68f16aef1d04e9f30298a67014f0653dfe606e06c199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727660, "uuid": "6966c249-17a1-4d0d-9840-192041d59f47", "value": "T13F25E00033E84B68F8BFC7387538551583F1F91E9A22EB2E6F5984E94825F4DD662723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727660, "uuid": "b45bddf1-43c0-4f67-b1dd-46b390718a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727660, "uuid": "820cfa96-3b33-4604-bcc9-e81265718bd4", "value": "12288:60TlE/roSUdKxuNHK67OUXEsJCW4AIjXq2YI1Qsc6F3lrK/CDEN+EFJ4B:O/kfd1HK6/XZfScsjF3lejF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727660, "uuid": "500c4a07-b410-45cd-bc07-9e28ed73b2ca", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727660, "uuid": "933ba428-9577-4980-9bdb-cd593c3c920f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727660, "uuid": "29ef6ebf-e212-4487-8673-8a7f0852c430", "value": "TEKL\u0130F \u0130STEME FORMU_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870718e2-06c7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770758945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770758945, "uuid": "155ac91b-bb12-4d87-a7f3-3c76b6be536c", "comment": "Malware payload", "value": "c53732c7c75a393e7b2354b6ef9f6366", "object_relation": "md5", "Tag": [ { "name": "007consultoriafinanceira-club", "colour": "#9D77C0", "exportable": true, "hide_tag": false }, { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770758945, "uuid": "1ab6e2c2-0f5a-41e0-8a7d-576aeb61dea0", "comment": "Malware payload", "value": "37f147a9841253691eb68759a15bc2e4ab04837e3c6fc482f4cc33ded980a768", "object_relation": "sha256", "Tag": [ { "name": "007consultoriafinanceira-club", "colour": "#9D77C0", "exportable": true, "hide_tag": false }, { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770758945, "uuid": "ccf581c3-7114-4138-bedd-5b8424707c47", "comment": "Malware payload", "value": "8a64ef7c35f94bddce36b82aaa52961855dc4ea7", "object_relation": "sha1", "Tag": [ { "name": "007consultoriafinanceira-club", "colour": "#9D77C0", "exportable": true, "hide_tag": false }, { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770758945, "uuid": "ff5de01d-bd9b-497e-9137-0257d6934c6a", "comment": "Malware payload", "value": "0c0bab1349cf3e6bd55b140f3ccadd692765dff7325035944e3b901b5df2ace01e1500598bb1bdd900b916906445eb22", "object_relation": "sha3-384", "Tag": [ { "name": "007consultoriafinanceira-club", "colour": "#9D77C0", "exportable": true, "hide_tag": false }, { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770758945, "uuid": "e1bab6eb-5e24-4ed5-aee0-0644e25bc629", "value": "T1DFE40208996DDEDDF9B4B002E548BA681C7615BA91F23E53FFD7C52EAC8F8E41407182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770758945, "uuid": "c8321636-9885-4e29-af3d-9beac1335daa", "value": "384:+Inmr1qSkThhYQY+R0OA05AVk4jU8oIG8YGj6nT0N1dGN/yCG1gLzO1pdrk49GbN:MK5U92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770758945, "uuid": "a8c0eee0-2b6c-4276-b91f-95b49bae98e0", "value": 670968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770758945, "uuid": "c9a3df85-63ff-41fd-a299-5564bfa1916f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770758945, "uuid": "5b85932c-5c93-4311-9a4f-5c11245cb0f5", "value": "37f147a9841253691eb68759a15bc2e4ab04837e3c6fc482f4cc33ded980a768.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa292f67-0689-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770732510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732510, "uuid": "de4f0419-7475-4f0c-9905-658a52638bf1", "comment": "Malware payload", "value": "af66058301bb219f627adc6f16864cbe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732510, "uuid": "2fe17f96-e7a9-413b-b312-dfd0cadd95ba", "comment": "Malware payload", "value": "383c328361a9b3f7baca4f88a3f5197ea796595c2adc0451caf70cdda6c44648", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732510, "uuid": "ff684489-679a-46bb-bbe0-938f3a7a8b55", "comment": "Malware payload", "value": "3651f6d5c3c0ad8f3b03a3bbdec83091eeab9b50", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770732510, "uuid": "2c196071-5b8c-4741-9f50-02d5c7d7693d", "comment": "Malware payload", "value": "87fed59b5de91fdc193c2a5fca00734bd0bf825b4d004e5535241787a7782cfa02f4bf746e79607a1c8cb61cea14674b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732510, "uuid": "3aeb7096-18bb-4d9d-a319-27a82f4de366", "value": "T15355A5B150CABF191B248E4855013F30ED7A6BF7D6389324B9886CB962FC790596CE7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732510, "uuid": "8f19a5a0-5efb-44c7-a063-272409726bac", "value": "6144:POvKh2BIRttyzgBqfgEQC7ENnEvErbIJfEnc5iaqcZZm38zkwq1mYJGjmDjN6PBO:qTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770732510, "uuid": "48d52186-100f-46ae-b2e2-f06fca24adf1", "value": 1404316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770732510, "uuid": "845d5a0b-1f9f-4368-a1b7-94cabb9f98f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770732510, "uuid": "a37803b3-5e77-41f1-ab45-37434d7569f4", "value": "database", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291ebbdc-0651-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708107, "uuid": "9be303cb-e39b-4d42-b6b4-17f9ee40000b", "comment": "Malware payload (Mirai)", "value": "58796b133a293c63365baea1022464b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708107, "uuid": "2389266f-ee2c-4b49-9458-0b7c378d89b0", "comment": "Malware payload (Mirai)", "value": "38cbda2689131be2c404be2569dbcb04aea23d3375b66c346166cf28615beb6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708107, "uuid": "73bc360d-5af4-4e00-af3a-2cbdb1cdbd0f", "comment": "Malware payload (Mirai)", "value": "b218f9c91043baa7cadce036b26b62f4e4df75ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708107, "uuid": "17118b3a-4e5d-4c2d-b237-0fb9d4f1b1c1", "comment": "Malware payload (Mirai)", "value": "68b7c7666d5ed3a7734e1c3bcc7fd7f06ea1f4c6ea3b8acb8c9b5c8d71bf305db54af33313dddd4dcc4ba427e62bc8c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708107, "uuid": "6caed4e2-9901-406d-8d8a-7547a9241b4d", "value": "T16AB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708107, "uuid": "6724fa80-ca7b-4c70-892b-48b14a422a64", "value": "1536:l7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCx6:ZzPqF41OUBljSIxecUtCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708107, "uuid": "1abe62c8-96f6-44ce-afe7-30b38a09bfa0", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708107, "uuid": "ef1e5650-c3e6-4a95-ad11-e63e407cdaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708107, "uuid": "f15c5305-b114-49b5-b207-b12ce61e4187", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bdb34b-067c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726734, "uuid": "e6dad86a-ff96-4845-a50b-eec3be21aa05", "comment": "Malware payload (Mirai)", "value": "11c50fb97f622cef691ef4fc7909ce9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726734, "uuid": "9258cae7-2ef5-49f5-ae55-e7cd95384863", "comment": "Malware payload (Mirai)", "value": "38f75e485b65694f5ce10634c84c3a1fcb90c9cd118b7a1aef6916afb50db6af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726734, "uuid": "687a7a0a-20a7-4412-9fe5-f15c0178fb33", "comment": "Malware payload (Mirai)", "value": "4432b1984c0ba68ce1a20a2853574ea81fcb32e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726734, "uuid": "249b075c-5273-4383-ae52-caa1d2be37a7", "comment": "Malware payload (Mirai)", "value": "790458915e3844bed552ea21a719ac39c7b0d2e3db97a4be097b26d0648fa42c59fb030c9006ff52eb8b7d44871c3699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726734, "uuid": "8f070150-5358-415c-8b4d-b5a212144e0e", "value": "T1E313E195330888E6DA1BC1B053F213E5787B85D2F2406D722165F64BF9D2298BE53BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726734, "uuid": "d46b8f01-0ff8-4f3c-8a3b-57cc0caf2b4f", "value": "768:9o0FW/Pmn8EjYQeT4nt0c7F7Aa81WJvnVT4Oy+xF20xokszJgGlzDpbuR1J7:9o0U/PmUHEiwF70MrTlyalxorpVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726734, "uuid": "2ce75ce4-c7db-4aa4-83c4-2e5bebab28f5", "value": 43380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726734, "uuid": "927eead4-2c4c-4d58-b944-059191acb04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726734, "uuid": "1f49252a-9efe-492a-9e7b-f8fc8c3c7881", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c3d605-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743186, "uuid": "13523362-7f0b-4243-afea-1d94827854fe", "comment": "Malware payload (Mirai)", "value": "0488db9fbc068f3c404d1c2cfda08b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743186, "uuid": "68ada758-a95b-4d36-9939-120429239ee9", "comment": "Malware payload (Mirai)", "value": "3e2e6b739e9e8bae3f5fc19db331a63a1ab696a80ce25269641512e9a8812fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743186, "uuid": "cd011e43-088a-461b-8b50-d6c978596143", "comment": "Malware payload (Mirai)", "value": "95974bb7aafefe443c084eb1f31cb8d06cb3d501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743186, "uuid": "d80d00b3-4d3d-4ac6-aa52-b813f54fd7a1", "comment": "Malware payload (Mirai)", "value": "45d37d32f2b9aca5a1db2d6f74863f5812b17f018e8f25da1890dbccbf142f2dd7fa98211469aafb5eb59d65b21c5378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743186, "uuid": "1cb0aecc-4f56-4d15-bd6f-a7f99377fb10", "value": "T10693D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743186, "uuid": "e6e39cb0-9a6c-451a-8ac9-b5fcba873818", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqRKK:NFjXYyCEx04KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743186, "uuid": "d1364fe7-cd09-4353-87b2-e4c18e243116", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743186, "uuid": "b5ee9325-951d-4b5e-97c2-df38738946fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743186, "uuid": "3b7c0dd4-a616-493a-8318-b676abc691bb", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8c41e6-0613-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770681672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770681672, "uuid": "57148268-088d-44aa-883e-c126beffc10b", "comment": "Malware payload (ValleyRAT)", "value": "7d16def42e7672dcd0e078bb8c2a68c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770681672, "uuid": "3873a698-0d1b-4138-8d96-6d396cbd2851", "comment": "Malware payload (ValleyRAT)", "value": "3ef95a0b2bc2a22bfae3383b20a5c6bd49f7784d55e66b10b379b471b2e7e6f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770681672, "uuid": "6f522f89-1e5d-4f3d-8728-60d1c2cbf2cb", "comment": "Malware payload (ValleyRAT)", "value": "a521cddfa5cad6431da500358e60e0d448953b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770681672, "uuid": "514c0c4b-9c1e-4d15-a8ae-525e702bb6b4", "comment": "Malware payload (ValleyRAT)", "value": "382820bac27f48f1083047b03896eafa6da5cdf4ea28172b54060dabb956cbd4524a4076b9944536b416f35715ae665c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770681672, "uuid": "5ddc9b40-560a-4c4b-9cdf-75e94d84de5b", "value": "T175262386D59809F8E077EEB48E794D06D37F3C6A5750A28B53D4B5921FB32A14C3BB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770681672, "uuid": "96e6c07f-bd7f-484d-9f7c-f09756d25e37", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770681672, "uuid": "da075ccc-0323-4fda-a680-45667382c349", "value": "98304:FzKX8hAW2impY8vTeN8HJyHjDeP2/3d4sZ5:FzKoAW2iQY86N8HAHy2/N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770681672, "uuid": "65599456-eed5-41f8-af19-5a1dfe535e93", "value": 4651629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770681672, "uuid": "47a6b753-1496-4951-a771-9a92cc6fd6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770681672, "uuid": "2e7c529f-b43f-4a78-b442-a3bb58aecc44", "value": "3ef95a0b2bc2a22bfae3383b20a5c6bd49f7784d55e66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ec5736-0659-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770711801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711801, "uuid": "6fdafea9-dcc6-4418-9693-9ce41701d02c", "comment": "Malware payload (AsyncRAT)", "value": "e7caf7a1cd33bee82a382d6ff7bfa93b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711801, "uuid": "9e1492f4-ed5f-49ce-8b7b-c0fe83bcee54", "comment": "Malware payload (AsyncRAT)", "value": "3f0bca6b2ba892d3e9d0174a0449f390d160a2fbe1e47995ae4791668102c0b8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711801, "uuid": "0dbb6880-5023-482a-8f9f-0702ca521cd6", "comment": "Malware payload (AsyncRAT)", "value": "825c2fbb0d23256e9949950db01d96893b4af54b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711801, "uuid": "ca197e43-edb5-49b0-baed-deeef10cbc2f", "comment": "Malware payload (AsyncRAT)", "value": "c77bcdd814f947c3dfa5a2c2cf4d61c0ecd30938176527c236aa05b590130101c39ecc77db094752ae3696d6d51ef47e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711801, "uuid": "5242d65c-2a34-486c-97b6-7580af07153c", "value": "T164D24A08B3D48522E1FD57B94C7292048771EE5BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711801, "uuid": "2ea2cded-8066-42ac-9c84-504c855b2798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711801, "uuid": "831e4c99-ca7a-46ae-bc8f-c2ef2e8ce117", "value": "768:QW9RX4ca98J3KEQg/cIRGqo2/Rb7fB/dTT/+:l9RX4398wEJ1iIRbN/J/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770711801, "uuid": "efb21697-4421-4ff2-9d49-5eed86b62296", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770711801, "uuid": "ce751dea-e4c1-4bd6-bfb4-c4aec638a0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711801, "uuid": "abcf5490-c393-4456-af3a-1e8fa7b5ba45", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6885a047-0687-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770731406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731406, "uuid": "4f332d87-a8cc-4d86-a213-68681e5972ac", "comment": "Malware payload (ValleyRAT)", "value": "22d2970bdd26bfaf0d07d4416db584b1", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "Dark_Crystal_RAT", "colour": "#D7C521", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731406, "uuid": "2820c61a-2441-48bb-926c-97367cea5bfc", "comment": "Malware payload (ValleyRAT)", "value": "41bc6bb1ad5d5b11594a6dba168a6a36d951f6bd551d45d9e42e4f57d6376ef9", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "Dark_Crystal_RAT", "colour": "#D7C521", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731406, "uuid": "95f1048a-b239-4692-9039-67febfcc3dbd", "comment": "Malware payload (ValleyRAT)", "value": "d1283d8acac2a1ebe6fbee8d0c077257e7f312ea", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "Dark_Crystal_RAT", "colour": "#D7C521", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731406, "uuid": "443bb6c6-00f3-41b3-8713-45d856a6b594", "comment": "Malware payload (ValleyRAT)", "value": "c2f06c421381887c355fefea4137dd6fa37a5eaeed196f79de5c7b5505e885a4e7e61d3ad52bfdd29f4fcfc7ee5bbf91", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "Dark_Crystal_RAT", "colour": "#D7C521", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731406, "uuid": "fda2bb86-122e-4cba-be91-5bdae5e64366", "value": "T1181733A6C9CC5A36C31FE0464738719933E236A967BD102D95C0C79B68BEA7CD6C47C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731406, "uuid": "2fb306fc-ac3f-499a-adda-b65275e79bec", "value": "393216:mEhAAkOstCRPy8+qO/MImeZZarX1DqsNxDjAYG:thAystsPbO/MIhYDxNpjAYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770731406, "uuid": "40d7a882-3ec7-4e63-a7d5-ca6c32713197", "value": 18962596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770731406, "uuid": "ad3d71eb-ac25-4ae7-ab86-3fa488ec35ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731406, "uuid": "f0233bd5-0ecf-49b0-bf9b-78c6f00ab589", "value": "mfTVt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b685561-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770738552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738552, "uuid": "b21ed654-80fa-4cd7-b9cc-e4b72f919e58", "comment": "Malware payload (NetSupport)", "value": "58712aacf6b0f8149c066bda3a034fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738552, "uuid": "dbcc990a-aa46-4998-9b0a-e59d12828b8a", "comment": "Malware payload (NetSupport)", "value": "43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738552, "uuid": "d26069ba-7a0d-43dc-b883-f08bcb34f317", "comment": "Malware payload (NetSupport)", "value": "cf2da87d52a6b08a3b9502b1f6082b8b76ba4d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738552, "uuid": "8754e138-d351-4bc7-b114-339d17687a5a", "comment": "Malware payload (NetSupport)", "value": "503253c98ae6cb684f798d2dca1ce96026fe63f80c88882d615064294ce2e19c240cde7b99c71c9564dfec32dc440196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738552, "uuid": "9eac7f03-77d5-47ee-96e4-54c9bd876868", "value": "T1E8547C127FF4C43BD6030232CF5DABD4A0FA97A94D20588327C40A5CEA759D6E369E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738552, "uuid": "0ee2f3d8-fd8d-4485-9f6c-b7b1b4c999d9", "value": "c2674610547987e150ca76c2c9c784a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738552, "uuid": "2be2e4c4-8ac6-425a-a254-bfca6b2e4ebb", "value": "6144:t//CluW8GaYMOZjlRRfCqjgs961nr6FX3xgws8wk+u:1/nL4Xa+P++fqbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738552, "uuid": "f81e7d0a-3559-46ab-bce6-a8dcb39dd99c", "value": 303480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738552, "uuid": "29ddbfc7-a0f5-46bd-b2e8-cb63235bce1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738552, "uuid": "41ffaec7-48ec-48f8-beec-89a02e434543", "value": "7z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5e89aa-0697-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770738443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738443, "uuid": "7e50a8f8-7cd4-48ee-a354-efb53106f535", "comment": "Malware payload", "value": "a5df976e9855d969d2f13e5267592c97", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738443, "uuid": "e8776c17-5559-4e2f-b71e-10ed7b2eacd5", "comment": "Malware payload", "value": "4544e6a23f98e153327f1c53221a0df361535dead688fa761038987b54f2456f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738443, "uuid": "90fdc26a-9715-4f45-aea2-57153da987ff", "comment": "Malware payload", "value": "37b23ac426e5e4b4d40b0001c0c73d3140ad7fba", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738443, "uuid": "cf9a65be-a5a0-4e91-ae72-a27012e93cb3", "comment": "Malware payload", "value": "95f70e5874fc79098e237b40e24f0290e5bbd58761652a404ab4a5e3e97de5622ac249faa0aef6691e5f07ee8a772d9a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738443, "uuid": "d621e586-b8aa-47c9-b223-f71e2a130212", "value": "T1F76533D0A4843970DD0C3DDEB5F67E5382AA3109E57C56AE234A59FC92EA71FAD0F900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738443, "uuid": "5d74698c-2c17-4974-b20b-ab2c904dba86", "value": "24576:5jyuwf6L+cWC2xOIvGiSL7m0grmrLpxbTa8r389E6llPgds2NDivXVq3EIuSWijl:p5wy6pkvL7m0grmrLPDj89E6lu62sXVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738443, "uuid": "630008c7-e709-42e2-8d3d-3a9cbd782739", "value": 1512704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738443, "uuid": "3bededf9-9269-4be4-b8df-25beefb5df0b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738443, "uuid": "4919a430-3a80-46a7-becd-c37875329ca5", "value": "at.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1df198-06a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743309, "uuid": "ad9ebc64-b73a-4b5c-a211-a41235f7b817", "comment": "Malware payload (Mirai)", "value": "c38c571b154c10d9dcd096551e0e8ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743309, "uuid": "43c9ccd9-6925-4cb3-b0aa-e8569ca746b1", "comment": "Malware payload (Mirai)", "value": "45587241abee2c00b1c64ebb93375d4bdab685fc21c4a9e6c68d5ff44a0ea98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743309, "uuid": "ac90755d-0623-4a1e-a713-8a8ef1fdf4e2", "comment": "Malware payload (Mirai)", "value": "e70d69b1f0483b6d33065b943f33e4373dcf5099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743309, "uuid": "785166e2-21c0-4402-8271-bfb92052eae1", "comment": "Malware payload (Mirai)", "value": "c427af1ee149052aa39ac897fa0c69324f719a70b5eb6e15f82b4f71bb65e8ce4e283e4f077a806d4ba409a4aa5ffa84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743309, "uuid": "3a33be10-d0c1-465d-94ba-b34728afe914", "value": "T1FB83C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743309, "uuid": "fd710f47-9b76-4c33-8167-6eff36196aa7", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAeEG:x/8RHTgMcJ0fmqJZOpkM/1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743309, "uuid": "20004388-2e5c-40d2-9c92-9fd157e3f5a6", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743309, "uuid": "672b63f9-4660-4842-82bd-821021b5bf79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743309, "uuid": "7df095d5-50c2-465e-92af-14f350d136c7", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7943db4-069c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770740612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740612, "uuid": "32c096bb-b122-4931-855e-ef290d58b8a2", "comment": "Malware payload", "value": "7c28626a03da4103829351ce9b773d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740612, "uuid": "fec8e2e3-f5e0-4e2b-8ada-f1c8127e3de9", "comment": "Malware payload", "value": "460288a2a21f11b2778950dc3869fa84ea5a9c2d4b120132c5d2b3c4ca0f92a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740612, "uuid": "0c292c5d-57ae-460f-bbbe-29031cf67c3d", "comment": "Malware payload", "value": "6551cf6d4bfffca71839104a724b3dea645a41bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740612, "uuid": "60d09e74-6b17-4339-a318-0cf2a603bfdd", "comment": "Malware payload", "value": "9813070d1398a46f5c296274699f54c2fab1bd85f1949773da7bc1c73a261b15763580903ae6ca300628898e4a150e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740612, "uuid": "b6cca82e-8281-4211-9f27-392587bc541a", "value": "T108B65B07E8A145E4C5ADD130CA669263BA717C885B3533E72F60F7293F72BD0AA79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740612, "uuid": "02ddd126-afd3-4186-a1a5-a598a19d02f5", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740612, "uuid": "68bb53fe-8ea6-4311-8201-d7b511bf26c3", "value": "98304:9DjwVjR2wGBwMhULCS4hWJ51HdL4C7E1sKi7T9XAfMY:9XWGBwMlSUe51Hd81sCfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770740612, "uuid": "55207fdb-533f-47b1-9fce-4223868d5e94", "value": 10737152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770740612, "uuid": "2591517a-0d4e-41ec-ae07-f791703beb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740612, "uuid": "ff8f49c6-50ea-4bc5-8e5e-76626e4fc531", "value": "460288a2a21f11b2778950dc3869fa84ea5a9c2d4b120132c5d2b3c4ca0f92a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546d39e9-06a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770745976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745976, "uuid": "72c9b5ad-50a4-4e9c-b585-92477f49fb57", "comment": "Malware payload (Formbook)", "value": "73f2176d6e5e406b2fab7993f914bad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745976, "uuid": "ee986d4e-7ade-4e98-8a72-6b93ee19689f", "comment": "Malware payload (Formbook)", "value": "479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745976, "uuid": "270e6a01-8b99-46ee-913f-e2d794f5fa5c", "comment": "Malware payload (Formbook)", "value": "8ddd5fd4f8a85609786082755ed0900b7cf707e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745976, "uuid": "7eacc4e0-6445-4f30-8cd7-340f6d9e2382", "comment": "Malware payload (Formbook)", "value": "4b335cfa52b8009b36c8998da7627914e1fe540f839237390e21e531099d4dee954a74d697109125d6295a140936c598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745976, "uuid": "e1e54e77-3e2e-4f10-9ffc-00e43b5a9538", "value": "T1CF55235826DCCD67C0542BF408B2C37147B95E6AA413C22B8EDE9EFBBCA6BD05518347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745976, "uuid": "4d71a981-911f-4b4a-a7bd-e3af01670eb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745976, "uuid": "48c79ac5-bbff-4f3d-9a9b-22955c923be3", "value": "24576:SguQmjPsixOCqc9zp01VfqrUiJWXt65F5mFUBC7GaHJqTQEbuUjVict:runTkCqc9l0D7XgYFUBC7GGAcEbtjQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770745976, "uuid": "8cef5f5f-02f1-44d6-8406-f8d644b792d2", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770745976, "uuid": "006bdf34-3175-4de1-9896-97e17bda0598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745976, "uuid": "c7bee81c-dc3f-4ad9-a59d-903d47b05abe", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc3733d-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770718262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718262, "uuid": "f2ba635c-674d-4731-9d31-95fe6fb01a8b", "comment": "Malware payload (MassLogger)", "value": "a4a9176334aa9526cf299388b7dde4de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718262, "uuid": "543d7c7b-40de-4847-969e-0ab8e3abda53", "comment": "Malware payload (MassLogger)", "value": "4825c308253bbb6f7549a3d04d793e62c56032365b505299d18e0c7c611ac1c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718262, "uuid": "3a5d3932-19a8-469f-ab8f-f9ec04c07194", "comment": "Malware payload (MassLogger)", "value": "7db8116ae419c6740e6df2252ea3ed68bb790c86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718262, "uuid": "c9c4acfd-0cab-4935-b70a-4e36de263b91", "comment": "Malware payload (MassLogger)", "value": "8ea8d107bdba6a754abdbfb37e397b7ea0607642bb46787d0e0c7e3e3c3ca95080f70bfc8a3bcef08df6a5b007b9d402", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718262, "uuid": "5915cdd4-a749-4519-82d8-a24c0be83510", "value": "T16635F477E71A54C94780816A5FD61D60AEEDD92EA44FA2CDBF0DC2FEE841E19040CEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718262, "uuid": "26895b65-9a4f-4860-a69b-b444f54254af", "value": "384:Tq88PqTpGqI3c2E8MYI3P807cAb3cWUKoW3dPqJfXuI3PmID96tvlq33lBUatq8P:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718262, "uuid": "541b33cc-192d-4a85-8a64-ee62a4dc207d", "value": 1145692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718262, "uuid": "b2917724-249b-4d2b-b554-084ec7fa5242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718262, "uuid": "1d06b8e8-0bb2-4db6-b369-53f8360bd4e1", "value": "ET7809790878972.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175bada2-06ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770753175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753175, "uuid": "ecf70f9b-4c87-405f-a121-b606632e13ca", "comment": "Malware payload (Mirai)", "value": "687cc7fc6c65591cb34c504161a0d07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753175, "uuid": "010c78fc-0381-4b7b-afbf-d22f88505090", "comment": "Malware payload (Mirai)", "value": "4a8622b94fd53d136473116d263876b703eb0265ea189aaa31900cdba9c95993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753175, "uuid": "e1285c44-8fd4-4220-89a6-9ee3cdd86bc7", "comment": "Malware payload (Mirai)", "value": "7fccd2896b72c57dfcff0f4e13d1cdd95f297193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753175, "uuid": "9b5ccc7d-1385-439a-8439-2d33064c4035", "comment": "Malware payload (Mirai)", "value": "f6d3c4cf181b824a037bc648beeef244920160221a46916b1d450d1b3ff67a8b6d152ba67ad5dd1418b41fce6f64e09d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753175, "uuid": "334f5f50-7df4-4e4b-9027-3759341eb316", "value": "T119D37B32E9396F98C415C130B4658F742F53A69182871FFA69B6C2B44483EDDFA05BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753175, "uuid": "b808e8bf-03c3-43da-a465-e51e4ff8dde0", "value": "1536:EatOOT7IhNOVqDTyfxy0SsbOr6iCAsKV/oVyf0CUDsBhWFCjC5dvbWX6YY:EDuyOVq2xfSsby6iRzVMCUEhW8jCTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753175, "uuid": "66727d2b-695b-41e2-9c40-693dc41b6def", "value": 138404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753175, "uuid": "cea2ee9d-7e6b-406c-8d25-37e6b7e05ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753175, "uuid": "a41e6728-09f7-499d-8fa3-42cef6050aa6", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f19c98-0684-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770730174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730174, "uuid": "635e97e4-5ee1-4ff3-958f-0c37f22448ea", "comment": "Malware payload (SalatStealer)", "value": "405ccaceac280a00469fab86cc0de1c8", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730174, "uuid": "f37e29e0-42b2-4d4b-a6ea-f65b909347fa", "comment": "Malware payload (SalatStealer)", "value": "4af17612474b58b65e9434101472ecde07b8d9d8e425cd59134f02f1fd027d49", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730174, "uuid": "7e0e31c2-5139-414f-a35d-2f670df90ede", "comment": "Malware payload (SalatStealer)", "value": "8358383eaccb81f678e73d24b59512639806a718", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730174, "uuid": "922d8493-3c76-436e-85f0-14a801fbfd14", "comment": "Malware payload (SalatStealer)", "value": "65dc1360e04acc5f60c530953aa560d6ac7e7a27a51752c30b8c7316e86fbe31f63be540f117242385f949e8e6e41db4", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730174, "uuid": "09a73fa8-afed-4f9a-9bf8-f8dab564990b", "value": "T14AE6338D8AB3C6E7992DE1751D2613D0BD8AEBF84CB6B30A712774072E1361FB985D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730174, "uuid": "13fb5cf3-bbee-4521-a03f-e72346f5093b", "value": "393216:3WHUWHdWHWWHwbRBFuONBR1FR5fQEidJ5fDoCbROXktw8:mPEZ/OrRXR5fQtNpMgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770730174, "uuid": "333732d4-1556-42f4-9c11-e197b81efb05", "value": 14842646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770730174, "uuid": "5007c915-6409-49c7-8145-a1eb11039e96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730174, "uuid": "a65f5f31-1dd6-4be6-9458-114c1ea5fad1", "value": "rapid.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acea9b5-0649-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770704835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770704835, "uuid": "d51e43a6-a03a-4022-8c54-1102344357ab", "comment": "Malware payload", "value": "89aab65e3bbe59682049fa8ca21e82da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770704835, "uuid": "3118e08d-4ed0-4912-9a70-cc60b56b69fb", "comment": "Malware payload", "value": "4ba8abe3cc868285f510578b30f374a778771c1da51ec19d6327375190abc2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770704835, "uuid": "f0157b91-9c49-4322-af0d-b39def413f3b", "comment": "Malware payload", "value": "d107422797b5ca7f3d496002b13bb24b1eba8346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770704835, "uuid": "23762ca0-b844-4f41-ab00-10934af553cb", "comment": "Malware payload", "value": "c8bc4dfe6de08690621edb7e8363dece053fce8dda6ef8478b4fc59896853369af13e8d9a2aa99c749e741400df6feb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770704835, "uuid": "f411e74a-c4f6-42c0-b44d-3b0ee03af247", "value": "T1A10533D6AEE3C5CBD9F3EA7994008EBD5462092D5D47070ADE1CE2E16A0DC790F4B932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770704835, "uuid": "61036ec2-1a03-4030-b4eb-8c9e3bda624e", "value": "12288:NjuxpD7EW9dVbz340Wy3w903mEp8LCNqfpdr+XSpbbuikGyJxbyNVO2mrNPc:dO7EQb5XgACLCKdjpfYnWN+ZPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770704835, "uuid": "d0434b07-6326-4fa8-b3b0-9105967a9170", "value": 830568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770704835, "uuid": "ef450224-4d39-4c9a-bfbb-3998321abc02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770704835, "uuid": "2a0fb3dd-b7d0-44b4-9419-c26f691a42c9", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a3f11a-06d1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770763374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770763374, "uuid": "291548c7-13cf-4102-9219-93776c55cfb4", "comment": "Malware payload (Mirai)", "value": "0e0a43e976347641a25d2c2243454357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770763374, "uuid": "9461f85b-1816-4a03-91d4-bdd3c2e2c39b", "comment": "Malware payload (Mirai)", "value": "4e20baf81c47000e9cc055e26fa4f6f6d42a7cdffd0019263c6a696e93abbc89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770763374, "uuid": "9611fcdd-6fb2-4456-9ac8-b1b1f2d271e7", "comment": "Malware payload (Mirai)", "value": "45def1add63802eed126ceea53e44daac50bbb35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770763374, "uuid": "5ac67109-80cb-4617-a86c-88e2abec72db", "comment": "Malware payload (Mirai)", "value": "2d9248d91b5cc3f58c99f16cbd0fe36849557a584373a591192abe02abf3788cd012a129e7483abef911d2290de992e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770763374, "uuid": "a1861325-f456-43aa-ab96-ef9c37271609", "value": "T1BFA35DC5F683D4F2D84715B12037FB365F32E0BE1129D943E7A89E32ACA1741DA16A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770763374, "uuid": "23e790d7-e135-4198-aeb4-6b5d4611a7ab", "value": "3072:qXo/u3HqhJy1ZHeqJ2MewR2eVXldfvi2l0qx:qY/u3iI1leu2Mewi40qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770763374, "uuid": "f77e88b3-1092-4a01-a6c5-40f51bc4ac34", "value": 106728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770763374, "uuid": "260e7aa9-7234-4fa3-ab52-a02b8025b879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770763374, "uuid": "82ca8585-41e4-45ad-af5c-d0d2cad1c360", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ab8265-06b9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770752937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752937, "uuid": "3d45a7f1-b7e9-4c04-90ca-5f2a70be9c9a", "comment": "Malware payload", "value": "f05e133cbe059bbcac2b282c5a86af82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752937, "uuid": "33b1260f-4c02-40ab-ab52-b01dce209b60", "comment": "Malware payload", "value": "4e9033937a48d542fc8de937a5599070758345d704722373ef426c34059b5d04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752937, "uuid": "de94b7cd-3de4-4a65-9087-2aff9ac4b578", "comment": "Malware payload", "value": "12e8b207a93689b9af85c7e41389be64b399ec1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752937, "uuid": "af89601a-5970-4810-89ae-191ef6ace434", "comment": "Malware payload", "value": "34c746c92a6e6917063452cdfc98c999c3f2cca448041ffcbcbdff6fca891bcb5906e54abadabc04e48ef5af2dd741d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752937, "uuid": "33695957-ca0b-4399-86a7-8178228cd5de", "value": "T1D6153317154A4EFAC791AA39D01460CAF3B4EAB81F7DA34931B897301683EE3D57DC21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752937, "uuid": "cbbc9f3f-e97e-4fa4-94c3-440105c6e35c", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUEM:EpCKabVQ+9qlNlpjNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770752937, "uuid": "41175e17-ffb0-42e5-92e8-706d6484a850", "value": 884476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770752937, "uuid": "1db94d00-97d0-464a-8402-2250bd27f4e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752937, "uuid": "398e0c4f-9118-492a-8b79-ac4fa519d631", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9791740-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (Imps)", "timestamp": 1770718282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718282, "uuid": "5e3294b8-b678-47aa-b8a2-afd4cf1b96a1", "comment": "Malware payload (Imps)", "value": "f7d7377b17fc4cdcbb783cc090d6e983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718282, "uuid": "2c996133-5202-4456-8e73-80a6980885da", "comment": "Malware payload (Imps)", "value": "5100e19d229de04b5028cc0c00bfa9f5904b0a5f0e1ae49828580d0973548ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718282, "uuid": "498b307e-3a66-4b08-a59b-fed15aebf3e2", "comment": "Malware payload (Imps)", "value": "03fe81be332f81a0fc590961109e7e2e8c9ad4fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718282, "uuid": "10896b2d-34c7-49e4-9fa5-1a27129abf5a", "comment": "Malware payload (Imps)", "value": "4e74523947529a369961d7697f98de78208bfd2646bac78170b42c748cbf3c6d742cbed482e97afdca951990901e3120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718282, "uuid": "ad14806b-e95b-4b3b-ad07-15a38b0cba01", "value": "T1E0249E5477E500F9F5B3C2748AA55A06EA72785507609BEF03A403B1EF237E08D3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718282, "uuid": "6a5f15a1-f2dc-469b-be44-7c933c062c5b", "value": "f95447fde4c485647d5c7abd65443558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718282, "uuid": "8c233c36-0ac9-4226-8555-f1e0c5122370", "value": "3072:1VwEjye5w9AiBj8VmwV754kwUB6VuhcE6nWCXFHF3QuVB+B2L:1VwE+e5wpuhVnjigchl3HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718282, "uuid": "21fdb9fa-d9e0-452c-8312-73a0221392c4", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718282, "uuid": "b2ffd6ce-77e7-4a35-90df-b91f30f52eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718282, "uuid": "aa198a12-c68d-4cd6-bb0f-b3659a7ed95b", "value": "6bd8a0291b268d32422139387864f15924e1db05dbef8cc75a6677f8263fa11d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc6cc20-0693-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770736623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736623, "uuid": "2d18ef45-7f5e-409b-bc77-3b003ed1639b", "comment": "Malware payload (Formbook)", "value": "bc2cbbe2fd95beb9928746dac1ac6655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736623, "uuid": "9b70264d-20e3-4706-afc6-0eb3f3ded0ea", "comment": "Malware payload (Formbook)", "value": "5299c946157ea403cf57c24d23ced9fb95fc0ddd349ce1c37613df9abc4e3522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736623, "uuid": "8af2c6fb-2b5f-4231-a530-ba5609385815", "comment": "Malware payload (Formbook)", "value": "5ef539fbfed4f19cfb2963ab6e607e4c7a4e1725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736623, "uuid": "e8b50136-a4ef-47c8-8516-279bf47d8e82", "comment": "Malware payload (Formbook)", "value": "67c39d4963a48740188fe4f8ea846c9779d3f1b0e9c33d21f7c50a2e8501733b5ab4a2f42d591784e531c14db461f590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736623, "uuid": "27b7166a-51f8-40c8-861c-5c6c55a2ba2e", "value": "T11625BF69B5E190E1E921C4F20E9E97E08E2773036795199723B802544FA24FF1F6FB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736623, "uuid": "2bd1cea6-291e-461e-bc7e-a2c271958ac0", "value": "ae1d6422c926cf2ae75764c09b67165e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736623, "uuid": "5e3203fa-98c5-4e96-bd3b-c6b9afd1f2c5", "value": "24576:J2yndh0lhSMXlpEBYyp/JrBeKfZDdUdJM0m43HG9zT9b:J2FINJrhCdJMh43mfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770736623, "uuid": "b5369349-51d3-4de0-88ad-f2fb98ac3a0b", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770736623, "uuid": "10f6a53f-585c-465f-b41f-a1c90d4f7311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736623, "uuid": "13fe9249-d6a4-4e20-a233-c01f82e306e7", "value": "MV_ABB_MARINE_INQ-89230001628119191_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8532a51b-069c-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770740474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740474, "uuid": "a193eb13-b38f-4464-a1a9-ba8e72f9c9e8", "comment": "Malware payload (Vidar)", "value": "f0c88c4813902a16a8fd973f9400a441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740474, "uuid": "78fd0b35-f1b2-4619-8ec6-7548f30bea0b", "comment": "Malware payload (Vidar)", "value": "52a7aa17de6abc3908f107ddf7a977033930657031c37765deb406750044d2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740474, "uuid": "5c3ac37b-69fc-4afc-9f3e-7eeb1bfafb27", "comment": "Malware payload (Vidar)", "value": "c3c97beb4565cf86ab86bab57b7bfe134767e485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740474, "uuid": "76bf7954-6f01-449c-818c-7b05449dba7a", "comment": "Malware payload (Vidar)", "value": "d6fc43159e23785389f8510026a6c24837d52d1e2d4a2f29ecab5f6e0e92602d4e38914dc02957232271f030d5d09d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740474, "uuid": "6cf72f28-845a-48b2-bf39-34a30f1e1b12", "value": "T16AC42A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740474, "uuid": "59492267-a244-4611-9461-9f0f9e931a64", "value": "fc960b9f00b5c476474282bb39f86c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740474, "uuid": "a0a8e83d-e3e4-49d0-90ea-1dcc53936ce1", "value": "12288:9cVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:9cVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770740474, "uuid": "a0cc53eb-ce6b-42c8-b638-d700d2426e8e", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770740474, "uuid": "8cc2e6b6-fa84-4860-a8c2-d8edb4f88601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740474, "uuid": "cbbbd8e9-5def-405f-8464-89c5361ac5ed", "value": "a7469b98efceb423c35bb888792aa94041f046b64fce2203e32a1afc03797bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282e6edb-06be-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770754921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754921, "uuid": "4a46d463-e7fc-4f04-a485-aa27233229ec", "comment": "Malware payload (RemcosRAT)", "value": "d6d50af49241ff59ab45c79ad175a70b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754921, "uuid": "e42326fc-d05d-4aa7-a24e-b0141903eb7e", "comment": "Malware payload (RemcosRAT)", "value": "552bf80c1c147d39832de1d766ed24039b5f2996ccab03d1114763efe33dfbc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754921, "uuid": "6c2b31e4-c4ec-474d-91fa-634193a7eb4e", "comment": "Malware payload (RemcosRAT)", "value": "fbd95b81f76f14ee7893bddd462fe2a225fa4927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754921, "uuid": "bbff5de9-6a7b-4ca8-82f8-3f2ec43960c2", "comment": "Malware payload (RemcosRAT)", "value": "99281deb21368f6d9d35e8a9c86976e06b991aaa6cb66ea460588e069d557be3b57606e3b5cb6b150e1f0c5b51e06c02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754921, "uuid": "ccef642d-10e5-4550-9227-ee38f66662cd", "value": "T113A4AF02BAC1C072D57665300D26E776DEB8BC20193A457BB3DA1D5BFD70190B63ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754921, "uuid": "93609bdf-217f-4e53-a403-45536533c6d0", "value": "bd656307ddc92c94811b065b2de91c5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754921, "uuid": "de2dcebe-75b9-43c9-8e1a-ae1a2483772b", "value": "12288:rRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZfW:rx7cyF2eSsewS8W47eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770754921, "uuid": "fbc52703-e207-433f-ae97-5a718e4aa596", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770754921, "uuid": "5a89b3c7-9305-494b-be78-ba70a1399904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754921, "uuid": "e7b2b400-f05b-4212-8528-c22d447f25e7", "value": "552bf80c1c147d39832de1d766ed24039b5f2996ccab03d1114763efe33dfbc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80dabc5-06ca-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770760370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770760370, "uuid": "bae70117-8bb4-4ba0-b41c-8cf982c98ed3", "comment": "Malware payload (Formbook)", "value": "535f4c641a8bfdc5ab25133a0262479b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770760370, "uuid": "7aeba553-95e0-4cd9-b3fe-4002d14125e2", "comment": "Malware payload (Formbook)", "value": "5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770760370, "uuid": "816b1df2-20e3-4ec3-a8f3-cadb75e71875", "comment": "Malware payload (Formbook)", "value": "5bb99b9d599a98bc4ce5098ee001410fa8744bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770760370, "uuid": "209c20f2-f386-47d2-bd0e-5991dd000ce2", "comment": "Malware payload (Formbook)", "value": "de891539dec79ac666985e8b9cb834a402e9eb96505a18a1ea1fae1f4cdd31d3baab3fe83d0d4689678206aef651dd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770760370, "uuid": "f9fd8716-a637-4ef3-9ca4-80ab72635e62", "value": "T122552218365CCF11C5B45BF51472C3385BB8CE66A823D30BAEED9DFB7A5AB062419342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770760370, "uuid": "ca1eb2b2-f6fe-4c19-8452-98a545180e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770760370, "uuid": "2edbb6ef-d84b-49ab-83d3-fb7630f47275", "value": "24576:LguQDpxJqlGAYbVc5w75BECYyf18yU7PQZATZZRsrwVict:UuuJqxyVc5w7b1Yyf18TDQZAVzsMQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770760370, "uuid": "4d26fd8e-6dc2-462e-be25-07e12b10bf26", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770760370, "uuid": "73e4da9f-d3aa-483d-9e26-392c518ed5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770760370, "uuid": "0d9f0003-cca2-40f6-89fe-a731b5f054ed", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76d3dff-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770738867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738867, "uuid": "f860fd4d-767d-421b-8384-c415f85c3e96", "comment": "Malware payload (SheetRAT)", "value": "1d2bad7903a9efca9518a387da174107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738867, "uuid": "c0cf0296-61ab-4680-9b94-697d1efc0271", "comment": "Malware payload (SheetRAT)", "value": "563bcf7c914b868ddde73520e9e8d582275f00f57a7346353d34b9f378ec0fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738867, "uuid": "e7535fcb-916d-4bbc-b6dd-08c997f97906", "comment": "Malware payload (SheetRAT)", "value": "cd20247bbdab3e0975857cf2c44c6374d4c9fe0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738867, "uuid": "a20f6220-b2bb-46d3-a2d9-d8b6c711e5dd", "comment": "Malware payload (SheetRAT)", "value": "68987e7bb3f47f096743a6682bb88081d2dc5bf6220ba589e2546cf43e174910e44cd5062841f86f44dcd8cef0139582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738867, "uuid": "e1bcac6e-9228-47f3-90fc-4c496d6b29c2", "value": "T1F8E4A20CBD52FC15CE6E3DB38BE290A11B3210C63F129116370A6FFA9B553B659A217D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738867, "uuid": "233030bf-7ade-4678-8b1d-802a3ca1c2d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738867, "uuid": "cec02a73-bf80-412a-bd1f-4e4e72b3017c", "value": "12288:kgXiqUDusUBOvQn3uYXjzGsCYXvH18lS7dknDcnR:kgXmKhgvA3uYX3wYcDcnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738867, "uuid": "142dc7d5-6da4-402c-957d-5226fc09dbcd", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738867, "uuid": "1e52e93c-5589-4efe-877a-ddbcf9c17a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738867, "uuid": "2fdefd03-1d82-4a54-afd1-772ffe7220ae", "value": "563bcf7c914b868ddde73520e9e8d582275f00f57a7346353d34b9f378ec0fae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fed9031-0692-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770736063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736063, "uuid": "a330b76c-363a-4377-b2ca-43df3deebf85", "comment": "Malware payload", "value": "236a32e0bfbc5fd4ac2bafd2dcf18548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736063, "uuid": "9e733197-c203-4446-8a22-1f858024bb9d", "comment": "Malware payload", "value": "56f35a4201834e7515c583ef4ef88efb39c2c26209f28154172e05d16cf25389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736063, "uuid": "c721b779-20a3-4529-b13f-284b6ea645b3", "comment": "Malware payload", "value": "0c20c8812f70e9a0737e22a8edaaa0686ead5381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736063, "uuid": "1eb577f7-b4dc-4201-9dfa-cd24f8aa3690", "comment": "Malware payload", "value": "016bb8a216f05aae476f69c8d7d5f2da590042d9e642b05791b50d5d0b21aa8b660c8c6b31fa25474c14b9e85f484fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736063, "uuid": "9533b9fd-6375-49fd-9868-3d88b6d5f28f", "value": "T12B54235C7AE9AE49E22E917CB17740290C026C79EB79D7B9294E1234F6622E1C4734FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736063, "uuid": "771ec295-bdc2-491d-848c-c32c7ad3f604", "value": "6144:/aX90uuoOpCh2Am//Tl3ngfrdYiNeOPLKi7Oabjn58:C+uuhp22Am/bl3IZFOi7Oa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770736063, "uuid": "ec3b1fb6-124c-4c3d-9a24-71c29523fecd", "value": 283259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770736063, "uuid": "d7c45293-d3f8-4f20-9f6d-f16f1ec4559a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736063, "uuid": "2bfa53fd-3a3f-4ad2-a09d-1d9dae0acfc6", "value": "kefmkcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f7dd32-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743155, "uuid": "eda355e2-6412-4b1d-bb16-3e654961d547", "comment": "Malware payload (Mirai)", "value": "ab51aee6b0f669221f245700693b0835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743155, "uuid": "566622a9-e738-4549-9693-64ee85681a05", "comment": "Malware payload (Mirai)", "value": "577c559521279e423274b2b1c8b9e8d15199f079b3bd631b0bdf2afb0a177409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743155, "uuid": "3c8796aa-e46e-4a12-aeed-95f446e087f0", "comment": "Malware payload (Mirai)", "value": "e9787103d0f89c18ad45f89cbab70ddbe6bc4e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743155, "uuid": "828c5a8a-c2c9-4d47-82e6-cfa341459aec", "comment": "Malware payload (Mirai)", "value": "6f9446ba8ad2a058c91b30be23c50c005259a34285ffabf81bd59b0a42b7c6e6a0b0607d9c2570332d874cb40c582e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743155, "uuid": "f4fde870-4231-4486-a044-33a309c5e8fe", "value": "T1B4C2D070F8C17DF6DEFEAD74481185D137E62F0937E28CDA108DDE215616D329AA8A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743155, "uuid": "26adf3cc-1853-4d64-a044-5184c64432fd", "value": "768:4KnqLiChP7gI5gBZw+LajRVb4uVcqgw093:4KqL1h4Zwa6Hb4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743155, "uuid": "d01bbb5e-9700-448e-b1c7-14469da82064", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743155, "uuid": "5d0e36ba-abf6-4fb9-8968-35c5f70bf52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743155, "uuid": "5bac8634-f6e5-4844-b5fc-b00e1ce2190b", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a184bd9-06be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770754897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754897, "uuid": "cc0ce91d-f695-439d-bad1-fc2d4d2f723b", "comment": "Malware payload", "value": "8b62cd887b7a26ec8a9d513dc0ed9787", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754897, "uuid": "3315cc6b-3f0b-4c77-8118-cb29ef8a65cb", "comment": "Malware payload", "value": "57ba3b2866836665e5904cb8a235df908fb8b3937e83e3a2daa68ecea7d7267f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754897, "uuid": "c7555a6f-e26c-4280-81c0-e331e539dd4a", "comment": "Malware payload", "value": "23b5b64eded2b97dc8872f9a1bc065229a350637", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754897, "uuid": "cd603777-c4ad-4768-ab4c-ea303ab0fbfb", "comment": "Malware payload", "value": "40094407677bca28d83b978f9e9f4dddf14beb8d50e23b2413217b87163fc46dd772051a398452962a390726c50e315a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754897, "uuid": "69eddad2-46ac-4f94-9892-6c0f38b690e7", "value": "T11EE4021DAAE50FBACEB41E0878762D4B03A0C2C7013665CFEF6F9D066FD9945156B0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754897, "uuid": "f0d67b6d-be74-4a93-a74a-5caeeb05d934", "value": "12288:/iO1ES6kPaR805PYzgF0ZsCLgiQZBZOFi:/3Gxt5QEUxMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770754897, "uuid": "584a2c7e-491f-48d1-a91e-d89e560cdebe", "value": 671343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770754897, "uuid": "1e363e55-5921-4c60-a1fe-79e746942d26", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754897, "uuid": "ff55ca3a-1eb4-49bd-9445-96d84523ea31", "value": "57ba3b2866836665e5904cb8a235df908fb8b3937e83e3a2daa68ecea7d7267f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d9cda3-06af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770748736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748736, "uuid": "0c705e72-6358-49ed-9742-5c505267a461", "comment": "Malware payload", "value": "46b60f4c6e1371fd424c0d3366e478e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748736, "uuid": "3ddc97d2-9c5d-4f8f-aa96-ceabae681216", "comment": "Malware payload", "value": "583c48c6b811f16b5170468d8b35d93a5c17742a9686b172f7676fc47f1cbd74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748736, "uuid": "1648a713-7649-4381-ae07-9f2a5a400ea8", "comment": "Malware payload", "value": "456aeed9add05d890241685561fa8dbe3ff39ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748736, "uuid": "56dae4c4-512c-4a45-a689-58bb7763d6eb", "comment": "Malware payload", "value": "66f047ab25d77d3162af0fe1943a142ac33ff613ceb85efd7267add0ef6e3754a24035ee8f7375c4d8ba725eee694197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748736, "uuid": "3fb00947-a69a-470c-beaf-1654f609bdaf", "value": "T1896533E3E76B89A083DB23D2BF1F554E8A211058C8C5E476706F0EA933F8558F5C6366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748736, "uuid": "e4cc9174-edba-4c51-a480-ebcb3bcb60cc", "value": "24576:2ZK3pvVNC+7XxNOa5mquYtBmuH/NxKuBc9IEHahhV5znuA2j:26oqXzZ5RtjH/ZYIEHahhVVud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770748736, "uuid": "b1f7c84a-b2ef-434c-825a-e48ea7419a65", "value": 1466357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770748736, "uuid": "b25b1595-127d-42e7-ba51-30e88e7e8886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748736, "uuid": "103dda3f-ccad-44ba-a2aa-2c1b354a35d4", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e185cae0-064b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770705840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705840, "uuid": "5fe2f2c3-94d6-4320-9c37-3203a6073a52", "comment": "Malware payload", "value": "d2e3ec9cc61f2a43043eb94e921235f1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705840, "uuid": "e7062a56-ab79-4faf-a41b-89ba6bccca7d", "comment": "Malware payload", "value": "5c223949438c2a329371a861aabf9dd9b1e734fcf6e5701004a218f78354a6c3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705840, "uuid": "61223d0f-3b39-45b9-9a92-bd35abf02b7a", "comment": "Malware payload", "value": "7cdd2ea8e1893c0d8fd074514162a6590618e24c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705840, "uuid": "00b571a1-fac7-4e81-a42b-c544ade6f039", "comment": "Malware payload", "value": "4d5f848ec51fd3c79ab774862908b566dafc2a3112d10f1d62f87b07658df284eeb46e2c87345ef0ecf649f47c9c071b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705840, "uuid": "cff2e22d-5552-462b-9532-d4833310dc69", "value": "T17206127029DB51F5F093F1F50925A6ED682326C383F1A62D25EC8E0A07B75784EC2F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705840, "uuid": "6c55e731-9030-4b17-a7ce-c33f934585f1", "value": "65692bd87bf583670b342d8a90a1ef76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705840, "uuid": "d5509ce3-da5f-4a50-a858-45332eb14749", "value": "12288:y5oaXFi7jPLpqvKhTNkr0cVkHM8olXCbaqBQVYgkUmmp07ly1wIt9szxRjsUaT9P:y5oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770705840, "uuid": "65448444-e40e-45d3-98c5-3ab63088c28e", "value": 3714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770705840, "uuid": "c29dc26e-41ac-4923-be4e-1286ea13f7d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705840, "uuid": "84681a5d-e049-4235-8c79-4dfd29d9576e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01a0eb5-0697-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770738506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738506, "uuid": "27c8d4ca-99d3-49d6-8f0c-6ec7c49a5d61", "comment": "Malware payload", "value": "4b261a6adf6e0c952b5fb837091ff023", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738506, "uuid": "166e911a-7417-4d49-9362-9fb1ad68f03b", "comment": "Malware payload", "value": "5d821db386c7c879caeabf3e9f94c94a48eec6ec5a3a0efbae9d69da3f52c1db", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738506, "uuid": "f65c2c5c-d4b7-4a87-956d-d8efb353520f", "comment": "Malware payload", "value": "29c46d28aeb174415c2957b5ba62a4512334f886", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738506, "uuid": "7fd4e476-40f8-464c-a93c-2dd9ae9e4ec6", "comment": "Malware payload", "value": "1a6fab81ff91696218a0e317c19dece04672bbb26692f82b57d139f3f03456965a9e49df09f230beecc94e91e4d18869", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738506, "uuid": "7e8fdb56-023a-43a3-bb4a-de74c21aecac", "value": "T11B11B5C2BEC62124C217BE35B0700AE041AFEA14FDA63DB189A323A5AB5B10092420AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738506, "uuid": "8e8d59a3-116c-4395-be32-eb2fad3a729d", "value": "24:TSQwUuIhOXQUtlJ8NOUlw5hK/cowpnOGoyRKKkwBWQyo16:TtDa63SpOWQVwBWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738506, "uuid": "fdde53e9-4987-41e9-b72c-2747b367c4c2", "value": 1056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738506, "uuid": "ec517d94-2216-49a7-b5b7-98f35f76d111", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738506, "uuid": "9738ae84-0163-414b-b672-0a8a49a5807e", "value": "lnk.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034403c4-0693-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770736390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736390, "uuid": "8c66d4d6-0962-421b-8dc0-e16499aae0d6", "comment": "Malware payload (NetSupport)", "value": "8230b85dcc562211711f73723e0ff1a5", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736390, "uuid": "926944fc-5abc-4f97-b243-eaea77fcfec7", "comment": "Malware payload (NetSupport)", "value": "5e99311e08775c742b4f8b765210a4a36d655483500c570a232cc6d495e2cc06", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736390, "uuid": "7144166a-e8a9-4028-8a38-c37d8f24eb76", "comment": "Malware payload (NetSupport)", "value": "b1cb293a2928c544862570627b69c1d8a2840f75", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770736390, "uuid": "42519723-02ab-437f-b6aa-4b458823d812", "comment": "Malware payload (NetSupport)", "value": "d4d683b39a49b0beb03dad711d86591425e0062b3931ff5175ec9619e0585c04e223f1c7635ba55eff57ace2df1522f1", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736390, "uuid": "c4d066a0-ce5b-4937-9989-6a9951b56e61", "value": "T1D001BDABE1A0243AE9470DC86DC61541518F4647440F3A58BBAD49450FA7F3CDAB861E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736390, "uuid": "bbfe0dd5-01e0-4abe-a64b-94c3a245fbbd", "value": "24:1y2A4s9+NdgfW2aBtZP70da2A4Mx2Ag0qG+cTKvu2AQ2AK:1lIBWJh0bM6PAKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770736390, "uuid": "f7094c9b-a9e1-4faf-8fdf-bcd5288340b3", "value": 811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770736390, "uuid": "b1d8b1e4-6370-4aa7-9e71-90f44e7c49e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770736390, "uuid": "6e0776cd-a1f5-4a9c-a47b-ac43c558248f", "value": "xrp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eaf015-0630-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770694175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694175, "uuid": "ac9ce1f1-9798-4f7b-9d3b-e6ac2a658cf2", "comment": "Malware payload", "value": "9c2b6505200d81479cb107e54b836216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694175, "uuid": "d4d860e9-e7da-4bf5-8975-96d6c6452122", "comment": "Malware payload", "value": "60fe4a328eb24b246efc9375244f7caa0c17aa311551661ab8ad44882774735e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694175, "uuid": "d8486693-d72b-4290-9e21-2c2a7adfb527", "comment": "Malware payload", "value": "0ad4fa95c0bf31a30a7e442793a69dd9a595ae18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694175, "uuid": "52680854-2858-40f9-bbc9-072548f893df", "comment": "Malware payload", "value": "2d4136494f24aebf60d96eecf230dcb41339e28986fa613d4a8dcd552f1cc2f04a5094a6c3aa33878eff01b27ec38d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694175, "uuid": "8cfb52e1-7e51-4356-9152-e9c40de92d9c", "value": "T1FB770221D157543AC183E4B66BDB4BC6FC35E3E9D061AA0E06E082CE9CD6AC947237DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694175, "uuid": "4bc006b6-eef4-4b1e-9ba4-ca41e9a7b0a9", "value": "ef4c7834967a3414ee38fea3aab1d54e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694175, "uuid": "815160a5-11b2-4c54-b706-9e8d276f5d4e", "value": "786432:Uyu5dXN/iyLa8+TjyqQrHkul9yJcW+lAgSIPYNG3dBqrjDBIiHM:UyujXNKyW8+TuDPl9yJzsdbIadkbBIis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770694175, "uuid": "2deac4dc-ed82-4cce-afa4-9880190e5322", "value": 33428071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770694175, "uuid": "a4d4e1b9-5df5-44eb-bda5-bfd5762bdd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694175, "uuid": "8bfccda4-c037-44f7-8ad1-d7ca6823bf9c", "value": "_60fe4a328eb24b246efc9375244f7caa0c17aa311551661ab8ad44882774735e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9274b5-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770707657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707657, "uuid": "087b5d26-2bc2-4fbb-81cd-af5dc9c245c0", "comment": "Malware payload (Mirai)", "value": "310e86a9935eaa1e1827a356295e1d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707657, "uuid": "1d255b86-ffc6-4527-9762-0ab3647359e9", "comment": "Malware payload (Mirai)", "value": "633c751041099073ba37a7290215c08354dfccc9fb90e4ddf84892591750cf2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707657, "uuid": "2cab5032-4ce0-4cf3-a3ab-7aacaaa00cf6", "comment": "Malware payload (Mirai)", "value": "0f7802d1c0488a52edd9966a67f6a23ea12ef1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707657, "uuid": "b4a7f0f7-83ad-4c04-9c6b-007e261a025e", "comment": "Malware payload (Mirai)", "value": "61de738ff9ed97d1293efda89f5f9fc93bee7568f9586618237136ea8616ad88bc23d194beedbf1e3741435a634ff4af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707657, "uuid": "d0b81b76-350e-44dc-98a3-d628b1138e65", "value": "T1E193C54DFA64A72DC3E272FEF64902CE332B1B98B7DA71258E315A4533C4BA66435134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707657, "uuid": "56d6c6ea-7a99-4ce9-b2a8-17a2df781601", "value": "1536:Oln0jnmGEYt13rUWSC9Vh0Xo4icGd2hhwGJY0Q7MpizgpWNp4r:jaGEaBvN8oHGhhDigpWNp4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770707657, "uuid": "1fa68e0f-c919-4bfc-bb8d-ca6cb3c8d65c", "value": 90008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770707657, "uuid": "7850f52e-7745-4b8b-9b87-0c31c4af4e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707657, "uuid": "73454956-5591-466f-93c4-93997e018deb", "value": "kaizo.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58ae7cb-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770742676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742676, "uuid": "a96583f0-7a57-484a-aca3-fbdadd8db935", "comment": "Malware payload", "value": "5318c3d161945acd6a9e33569242a5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742676, "uuid": "12b03354-f331-4ca6-9d51-699c07904aab", "comment": "Malware payload", "value": "63e7fe8945be18dcd296c456a4a314d336c3c5c798d5c70066c02e7627861870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742676, "uuid": "cff16e74-3ab8-47fe-a10c-0e2fd7832cc8", "comment": "Malware payload", "value": "b726e90f3d791f82e83190e0c849dd400557e174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742676, "uuid": "0fc7649d-9016-4600-a9ab-57640ad52344", "comment": "Malware payload", "value": "08d2a27217c41da45592e7757610e4025cefb01360b6455acff668ee2c4450e360b1019cb4a07121a2743a3da8e5a56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742676, "uuid": "3a6690d9-0ab4-4fd4-b658-c1aedab04283", "value": "T10263C8CD3BC3B6754A43343B285BF09AE23E8E84A05C8054C75AFC7AF9A571CE975624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742676, "uuid": "e78a863b-0474-4c52-b2d6-12d5ff7d306e", "value": "1536:Kn64wFOwBTmqpyPh7VuqBL+85fRtLE+Fg:Kn6BfBwh78qYiK+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742676, "uuid": "47e3b11b-9b7a-467d-bc12-05dbb9f90ba5", "value": 71183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742676, "uuid": "11243838-c2d2-47e5-a21d-1580e5ddd282", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742676, "uuid": "3ee900a2-0e58-49de-a9f1-3d21606a6afb", "value": "New PO_94095894 VG940858_Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481988f8-0669-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770718467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718467, "uuid": "911c69a8-58f2-4994-9985-c59f27dd8336", "comment": "Malware payload (DarkTortilla)", "value": "d202b91c32c406610c848394b3cb5af0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718467, "uuid": "4d514f70-b029-400f-8be6-14d00c3a593a", "comment": "Malware payload (DarkTortilla)", "value": "64ccdd6f56c0c70b847fa90c20c58b3c039b39906cddc3f90122f02875760175", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718467, "uuid": "a31739e1-a9e6-4edc-8662-689df349ac69", "comment": "Malware payload (DarkTortilla)", "value": "76e8546afb561fce9ca83b4d56a190f0eb834f04", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718467, "uuid": "9ec6381e-a45d-4124-af78-c12b59409bc4", "comment": "Malware payload (DarkTortilla)", "value": "458d59c009cc557e572a55518580d01cdb6d0b3d3b91f78ab4857dae6e8ec1f9a409e2cc7f9814687ad18f4bf4ff0762", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718467, "uuid": "6a34cf34-31ae-4660-8780-41ad64219357", "value": "T1D8E4BF1523E85B6CF8BF97387839111487F1F91E9B22EA2E6F5941E90862F4CC562733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718467, "uuid": "fbb5bb4e-28d5-4db5-ac70-51034713356a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718467, "uuid": "94330cb0-659b-4faa-9a2c-59f6abdeb09d", "value": "12288:y1WNL/roSUdKxuNHK67OUXEsJCW4AIjXWIIM5CzOJu7VlZZ:v/kfd1HK6/XZfSUM5QplZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718467, "uuid": "3e790af1-2095-4466-9d6c-6a8e65d9fcc0", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718467, "uuid": "05bcebdb-7979-4130-ae66-7d6701da9207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718467, "uuid": "e10043ca-09f9-4ba1-9bf3-1980d6580a20", "value": "2026021000094_STXF INT Tr\u1eadt t\u1ef1 m\u1edbi_ BOQ.pdf(73KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e93b6a-06cc-11f1-a129-42010a9c0007", "comment": "Malware payload (SNOWLIGHT)", "timestamp": 1770761004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770761004, "uuid": "cf69f2e9-b4ae-4324-af15-396584743659", "comment": "Malware payload (SNOWLIGHT)", "value": "8899630f312a9df87d46538f00e9ae17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770761004, "uuid": "39d5c6d0-c7b2-4e04-a3ba-ba8f6cf8d719", "comment": "Malware payload (SNOWLIGHT)", "value": "651aedc8c53c88f8a224bec3abdec426b8814f2e388248b5ee690a579dc7c048", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770761004, "uuid": "6eaba263-7485-4f20-b349-5403db193c0f", "comment": "Malware payload (SNOWLIGHT)", "value": "5f2ae0f6e312e0d1fcd028069b11596650aefad9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770761004, "uuid": "1b9c59ab-f2f5-46c5-9c5e-960784335508", "comment": "Malware payload (SNOWLIGHT)", "value": "6df114ca1f85a5f9ed55dbddb997f33c98c362454e12ec781eddb56392ad9d1860720cb39977840ec855a68b6e16a1a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770761004, "uuid": "1797817b-b8b3-4166-8938-7b9388292285", "value": "T16DB46C607CC08172DDEA21FC46ECB435056DA4F00B649AC756C80BFADA605D1BB37AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770761004, "uuid": "01ab49a2-2f10-47b1-9466-f123654d6701", "value": "614efef6776be90efb943269eb259e5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770761004, "uuid": "b6c7acc3-8e11-4054-822c-d633353b0c63", "value": "12288:HdI85CDJclFDD1yjfTjL16teFLAFuBF1wC:a7Tj0Wk8wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770761004, "uuid": "5728fc3c-c9fe-4fe9-8059-56fbcc772e9a", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770761004, "uuid": "1626ee55-c99b-4bbf-8854-dec481f5d747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770761004, "uuid": "9bbe8c63-f3a1-4693-a932-d96ea721fdc1", "value": "d3d9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8a4578-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770738845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738845, "uuid": "6c01c538-14cf-4331-8618-e6b5c5d2e068", "comment": "Malware payload (ConnectWise)", "value": "ad201d526619d0979313c0ed11ac3e95", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738845, "uuid": "244dc469-fe6e-4b3f-8e61-4698cff379ee", "comment": "Malware payload (ConnectWise)", "value": "65e0c1460b7d36467bb78514083b5fe441822063ad1f24cb1896b317a637b4b7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738845, "uuid": "13a26201-d541-4e29-a49a-0b8d8ad9efeb", "comment": "Malware payload (ConnectWise)", "value": "0b7c32f124b52cf3010f347625e04b3b7a4625a4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738845, "uuid": "2529331d-3bf6-4c86-aa4f-e97dc8e8bdec", "comment": "Malware payload (ConnectWise)", "value": "7a3d92dc5272a2ba64908811efed59b8a3320cb7f9b6d6bcba076c24500eb7420c69ddc9b42dcb48e77886f5f80d5641", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738845, "uuid": "6772a6fe-2b0e-4097-ba59-c9c14061ad7f", "value": "T121A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738845, "uuid": "90b3f2dd-716e-4a11-b324-857c977f8d80", "value": "196608:EKaLNkbgii4Q4KaLNkbgRKaLNkbgdKaLNkbg:6WgiiHeWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738845, "uuid": "9ede8ba5-b85f-4f9c-8fc2-dc9d89269285", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738845, "uuid": "d5f5e4b7-91bb-4c33-a876-2d801ad07b4d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738845, "uuid": "e54f1acd-6ccd-45eb-bcdc-84afd4c600fd", "value": "65e0c1460b7d36467bb78514083b5fe441822063ad1f24cb1896b317a637b4b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2853b629-0651-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708106, "uuid": "aa1aa2d3-d678-4f3f-808a-1f07439dc6c6", "comment": "Malware payload (Mirai)", "value": "99a34e32802eb2f90592e7de424b1444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708106, "uuid": "4c02f0e0-2388-40af-87dd-3488862fa1b0", "comment": "Malware payload (Mirai)", "value": "6647e8ad9e5acf8c9f7a7908b4cbdeedce9fb1a51c6aacfb27e987b0b1ec6129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708106, "uuid": "dd23a920-21e1-457d-8a49-3b3c3c13cb76", "comment": "Malware payload (Mirai)", "value": "1729e24b8a23879dd55e20a842cbe129bee7047b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708106, "uuid": "fbf755de-1fe9-45b7-b7e9-b3def4a28335", "comment": "Malware payload (Mirai)", "value": "ba1a75eebbdfe18be7777090ea8f2881121f49f8c6ff43d291406b9e0962ca3f67f7e68959a2e36c3df6c09f0b48b4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708106, "uuid": "f3148f36-40e8-4353-abce-5f8a5396a42f", "value": "T19C333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708106, "uuid": "583eeece-e085-4bdd-831e-345aa48a8ad0", "value": "768:Jw5A3X1eCZWUJ2SNpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98eN+s:Jwkt3NpOzwLMU431ANA0BLBCyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708106, "uuid": "733cfa6a-e787-481e-886a-a74fc6f23158", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708106, "uuid": "8d8c03b2-170a-446e-8002-1bd028f1212c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708106, "uuid": "64d9ea39-7788-442e-8685-cd27619eb335", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005490d2-0683-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770729514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729514, "uuid": "de33a684-d940-4b73-8373-23b8d1ea73ab", "comment": "Malware payload (SalatStealer)", "value": "e448f5a80e50f728890af8c2e6800a93", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729514, "uuid": "1a9cd25a-1590-42b3-8cf4-7f8209d3c661", "comment": "Malware payload (SalatStealer)", "value": "66574243f710a2291861c0df919310835299a2500ec7e457e34c0da4a319ce46", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729514, "uuid": "6678f3b6-4f8f-41f4-b142-332f022978dc", "comment": "Malware payload (SalatStealer)", "value": "672916174d2df2440d3bd4ccd8fd24fae57d1bb2", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729514, "uuid": "ca08aba3-c5e8-4f0d-9206-733871e5a602", "comment": "Malware payload (SalatStealer)", "value": "4c25598ec38b2b58799e83c0600645effd5993c08943df2984754fe5fa75a82b9e8fad533974f7755d7346b588bf5063", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729514, "uuid": "f33aae06-af91-4e45-b43e-c7167cef5860", "value": "T19A963376D2A4CFE3540AE1B74D7A42E1BCE075F49825B707F0A9381B1F31A3BB999850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729514, "uuid": "db74975b-c57e-46f9-9777-a42da42d0574", "value": "196608:ub6SSNDDDaNBR1FROh5xQk6IXq5d/M+Y5QfDoCbRanrIyXkjT/Nwk:ubpuONBR1FRUXQyidJ5fDoCbROXktwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770729514, "uuid": "46f34e2d-fd99-43b2-8be9-e248ff5c9da1", "value": 9404858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770729514, "uuid": "e898812a-8169-4d09-ac15-0a22d9422732", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729514, "uuid": "8ced0195-1033-4548-8ffd-afc552a0bb14", "value": "unlock_all_tool.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b3d981-0666-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770717361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717361, "uuid": "82446875-6ae9-4bf5-afa6-f0c6c22bb903", "comment": "Malware payload", "value": "0dff3a55b0cf827bb431cd72bdb6ce34", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717361, "uuid": "5772225f-0611-4342-a5d2-f84362bec4dd", "comment": "Malware payload", "value": "66c6145976275f9dafd40e291d3c4ee9446a11dbf93aebba6097068ed922ffc7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717361, "uuid": "a24dd4fc-2194-4e8c-809b-7b121b1c60ab", "comment": "Malware payload", "value": "0c918cd9898b370defd075903ded93fd609ab609", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717361, "uuid": "b2f7d01c-f25c-4146-a74e-079eb12dfc70", "comment": "Malware payload", "value": "bcd607b6f87f391602972c542a157f86bdf2eed050061fbe32cd8ed7dbebedf2f5a64a42464e3d162536cbb2cf704a7e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717361, "uuid": "a2c4c617-2f8c-4386-87c1-7c8deb14b912", "value": "T10ED5DF21B3DFC526D71D02B6E92DEA0E943DBE77076040D377E4399A68308C2677AA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717361, "uuid": "af5759be-1768-4f75-9fb6-a858d9a88bab", "value": "49152:xXdMSnkxFozxoX/HZB/uFYBdSwug4h1GQuTzt7Nl8ffUAUX5qWcM:wSnqFozxY/XuFqzt83UfX5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717361, "uuid": "e3c9521a-e516-43df-aa5d-277e987f39e7", "value": 3002368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717361, "uuid": "dbe8ba3e-fddc-4d12-a191-d638215ac49f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717361, "uuid": "a4a6774c-f0a1-416b-921d-a487dd6c090f", "value": "C__Windows_Installer_40ae98.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3340e87d-067f-11f1-a129-42010a9c0007", "comment": "Malware payload (Kinsing)", "timestamp": 1770727881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727881, "uuid": "57e52c22-7fe9-4832-a842-b689c3ad3e6d", "comment": "Malware payload (Kinsing)", "value": "b11a31ef6947c9b067b1a91f962219d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727881, "uuid": "f3454221-0c97-435f-97f5-f9cad7b8ce84", "comment": "Malware payload (Kinsing)", "value": "6966d265ffbe5c933f0e098473fd9c31344fe0c4e6d66654150b6f42e0c4ccf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727881, "uuid": "9826bad1-c3b9-418b-bf69-8dd6fa6c5477", "comment": "Malware payload (Kinsing)", "value": "c7ec69f98664399f128407682eba73017af61dcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727881, "uuid": "31ae5f65-80f9-46f1-9547-711a40e92d9d", "comment": "Malware payload (Kinsing)", "value": "d83857f9fadf1ff9248e878a8c26ef259127268d9e9d5c185997a02678986d66feb3b18916938e95988215714c0a52e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727881, "uuid": "591f850b-5c2b-44b6-b40c-1df7cb2fe4db", "value": "T141363A11BC6DB463E9CC7630777582ED313EB988CBA18133AA60EEBD95F17588E13521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727881, "uuid": "c2975111-d50b-48b5-ab48-1d4e71fff0c4", "value": "98304:Slds3UPXBQSH14vZh7pIDhG9By8uCGUGan5UPiK/AF7XlzcKGYH0ye8nanVFflp6:ZUDIaLbI+ED2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727881, "uuid": "092ede7c-fe3a-468f-b014-6990a896c3a8", "value": 5096700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727881, "uuid": "0062045e-ab04-4c10-afaa-8e5c677cf056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727881, "uuid": "5a3ee2af-c61c-4844-a41d-84b90677adf9", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a1cde6-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743162, "uuid": "ae1e215a-bb69-4e3f-bd19-d82e6c606489", "comment": "Malware payload (Mirai)", "value": "0ce611c4524fc45903b45913083fd2a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743162, "uuid": "64bb73a7-8a59-4ab6-875e-a49b8b7c5c94", "comment": "Malware payload (Mirai)", "value": "6b8567cda7beaa78dba6fbae9c09fd7b6415d15b9eee533f247eb146f88bec84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743162, "uuid": "901eea7f-8f0f-448e-a407-f1f80644043e", "comment": "Malware payload (Mirai)", "value": "9856275f8e3201b3f2fe1d06004ce4bd90c396c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743162, "uuid": "678bbe36-cd1a-4ff3-a90a-02b8afbcfd31", "comment": "Malware payload (Mirai)", "value": "a659152bbf117a3585cf9d7e15064bf7ca72c75b9b98350ffeafdd3004de62b53556aafc1e43ecf0ed9c1c12b5a86f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743162, "uuid": "58a59c36-77bc-4076-89d1-cb6f194f6dd4", "value": "T197533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743162, "uuid": "428066f9-74ff-47fa-ae89-f4af5c4fa4a6", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozdyI:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743162, "uuid": "4af7f8f9-df49-4260-9185-9dc92ba0dac0", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743162, "uuid": "b6e637f9-b84f-4cb9-b3b9-495f0a2e26ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743162, "uuid": "cd31e250-80b8-461a-9742-591e4f6a4dcf", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f9b719-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (Imps)", "timestamp": 1770718244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718244, "uuid": "5ca93e45-c16e-4513-b3bf-095a64f0d061", "comment": "Malware payload (Imps)", "value": "f0bdb2add62b0196a50e25e45e370cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718244, "uuid": "74df3151-23ff-44b5-86ce-5b948581f776", "comment": "Malware payload (Imps)", "value": "6bd8a0291b268d32422139387864f15924e1db05dbef8cc75a6677f8263fa11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718244, "uuid": "30544c74-b23c-4052-8539-5898dbbb43c3", "comment": "Malware payload (Imps)", "value": "6dae1c4879d951af60f26c56b8701a2c1a8cd550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718244, "uuid": "3d90eeed-c5b0-4a49-b70e-0cd1a4ca051b", "comment": "Malware payload (Imps)", "value": "852a0705d8e8f87fb9c9418755ab9ed9f668a2bac201b451534eff1913a5a6abc8b82406f0787c4fdd6003f84047d1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Imps", "colour": "#778C41", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718244, "uuid": "a3b8d176-24ce-41fb-8e76-9ee5e81e60ad", "value": "T103C3121DEADBB52ACA5E0F7110BF5C05734221E0B9C2D8A4B259B237E63F1F8056EB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718244, "uuid": "606d9c40-8b18-4cb5-ad5b-27e9726239ed", "value": "e0e1f2570066873a57b410327671b6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718244, "uuid": "3b62637d-b68f-4334-b05a-52ce156cf317", "value": "3072:F/4mSq/XeRB6sJEH1/WxwWlg18AAgyhk+GjVp:FgmSYo6sA1WdlphOVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718244, "uuid": "9f5888b4-d5ba-4415-b7ab-c85a9d242a47", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718244, "uuid": "d7f32bf9-e369-42d4-a885-e861c1cf1f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718244, "uuid": "c732a2fb-53ea-4d2e-ba2c-d1ccd95e7590", "value": "6bd8a0291b268d32422139387864f15924e1db05dbef8cc75a6677f8263fa11d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f554187-06bb-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770753779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753779, "uuid": "320467bb-0ea3-4eed-90c3-e2cef0dc3ec5", "comment": "Malware payload (UmbralStealer)", "value": "7ef8f0bd3ba9a360356a280448fcc3c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753779, "uuid": "fc9d78fc-bb6d-42cc-b566-3c3b5aa75d54", "comment": "Malware payload (UmbralStealer)", "value": "6e4d7868b79fef7045fbad79ec759dc3f531abdcfd184331e2b8a84f5e20508f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753779, "uuid": "80071786-26d9-420c-924c-91f7c8e4a012", "comment": "Malware payload (UmbralStealer)", "value": "11a628aac4a662792ee768f32959a5136613afe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753779, "uuid": "8a700e49-fc49-4f23-94f4-fc236f5df8a4", "comment": "Malware payload (UmbralStealer)", "value": "4986d1936ea4496beafb8fc0e41e41e43b0d98571fce9a788a853f0ad67ad28b0d6b23e6b5cb09adcf422e9a2d015705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753779, "uuid": "28b59d17-351c-4fde-9a9e-8c49efd086b4", "value": "T13B6439246644C821C77FDB74AD616A9E77BC5523FA46EF5F0A8088C90D92B2EDDC60C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753779, "uuid": "67c908d5-77cc-44b9-9950-84f2ff33d76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753779, "uuid": "fa73369a-eb08-494b-8e24-fdf4138411ee", "value": "6144:N0dqFosijMfOTBrk9jn2ITkotRPlbR8DxA8eV5FTfI/:N0d8WoO9Pmd+DcF7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753779, "uuid": "abd6a2f5-efd8-43a0-80de-6deea836631f", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753779, "uuid": "280f43c6-e11a-4711-92e0-7710cb7f2396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753779, "uuid": "64e97c4e-5320-483a-9f55-a0a6d763ad74", "value": "6e4d7868b79fef7045fbad79ec759dc3f531abdcfd184331e2b8a84f5e20508f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dd65d7-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708015, "uuid": "46f48125-db0c-45cc-b931-12d3d1048855", "comment": "Malware payload (Mirai)", "value": "5c4ac43cde15c232d72ec8ffdafe230f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708015, "uuid": "e43ecb6c-0d42-40d1-8ec3-69402c871aa2", "comment": "Malware payload (Mirai)", "value": "6e72285fecee33932da6d2d4b998a953bf13122add42070a5812ae5aa77cc663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708015, "uuid": "21297cfb-89be-4415-a950-502e5e39fadb", "comment": "Malware payload (Mirai)", "value": "8d32248e0dae5139f00c354fa978062e4cef9fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708015, "uuid": "f50f64e8-320e-44ed-8d30-fa5247bd4220", "comment": "Malware payload (Mirai)", "value": "bb2ef66ce2ee686ea5c3ea12cadd7fb65845886faa25aa15ee22026acfdfa4618b6aa38eb2845d1c5f8b6dda057d3542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708015, "uuid": "cd86fe49-0b5b-4c9a-8e26-557546b146ad", "value": "T157930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708015, "uuid": "baf35555-139a-42a1-ae22-84b896c6667a", "value": "1536:wqnZ18D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yun:t8NUv5nTacgzafVAwe4BNRIbT2gXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708015, "uuid": "33717f24-9a7a-4ea8-8204-398aacab1388", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708015, "uuid": "416941da-7e8f-4a69-87ed-fa1e0b67a5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708015, "uuid": "156b4c55-3dfd-4705-8499-afe46afc15a6", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d725d3c2-06b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770752637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752637, "uuid": "c8ae1e26-95ee-4c72-89ce-bc6635dc8e67", "comment": "Malware payload (Mirai)", "value": "0498f4ca3798ef797fbd94a31947274d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752637, "uuid": "8a8bad01-4955-4a37-806d-b9ab049e11d8", "comment": "Malware payload (Mirai)", "value": "6f3b176ed8fef769bc9e05fe5c4295b95e73fb2775bdeb175a55c515546785fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752637, "uuid": "900b0f8e-83c2-4747-850f-d99cf617f0bf", "comment": "Malware payload (Mirai)", "value": "497ac69500a113ada195547c82750b455621431f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752637, "uuid": "1ea43b0f-ce2d-46fb-a446-44b5a300d3f2", "comment": "Malware payload (Mirai)", "value": "c9f0bf6b8d3b1454647caf31dee0f745238903cfdbc77c854ba981c334db48da2d09ea32fd73b8c45973d121832ace2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752637, "uuid": "df5a3962-6745-49b8-82bf-5b823e360eb2", "value": "T16AF34BC7F901DEBEF80AE33B48130905B530B7D250925B37625B796BEC3A1990927EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752637, "uuid": "3044b73f-87a0-43a3-9aaf-dbb00088a4d6", "value": "3072:coSIgU/W1GW1qoVZaV8XWYhsnwqIcVvjbi8L4mky9WGQS:9SHtnaV8XlhbqIwL+y9LQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770752637, "uuid": "045b78dd-c202-47ff-b817-3ebce88d4c17", "value": 171136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770752637, "uuid": "bef69b90-a2c1-4f47-bf10-aec693db667e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752637, "uuid": "3b51443a-41d6-43a2-95dc-966ba060e95f", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f5911c-06b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770751338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751338, "uuid": "2faffad9-3931-4f2e-91dd-946201a7da01", "comment": "Malware payload (Mirai)", "value": "eee5215ade6ef95232bbfc83d2207c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751338, "uuid": "5f3b8663-f8fd-4134-8952-aae32cb82ae7", "comment": "Malware payload (Mirai)", "value": "6f52b3286fbbbba7ca46548ec90d0d6c8f3ae7a50983a44105bf1cfb29a6cf1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751338, "uuid": "87d85c69-91b9-435d-94a1-cef75a0b604d", "comment": "Malware payload (Mirai)", "value": "74c2be52ec5ecb66c265f4e9b7b8dbad371aa241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751338, "uuid": "b5028b8c-b983-429f-9af3-0964ccdba3b1", "comment": "Malware payload (Mirai)", "value": "3015cd4baa28e6dee0cf8380a52322ebcb260c5ac38f3b3daae93d341e02fa16186116ea713279e27f70bf0effa15d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751338, "uuid": "c4e5b0a9-c4d1-4c9e-bf25-de4a835654a5", "value": "T17DE32B86BD919E11C5C636BBFA6F008D3312ABACE2EA7102CD245F6427CE85F0E77545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751338, "uuid": "b42cd2ff-f138-481f-adaf-54826fac3d6b", "value": "3072:B3yMbz1Pcb3ebho9qr4HbboLmpMguHcUGVUHalw7WsuH0xsfCh38Xab+mqX/JxgQ:sMbz1Pcb3eCboLmpMguHcUGVUHalw7WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770751338, "uuid": "ffe2e5ff-a9b3-499d-a917-93e60da7e028", "value": 154144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770751338, "uuid": "a5c7efc6-cc4b-4b36-9024-2f5cf1379654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751338, "uuid": "4905c6c2-77b4-4934-9536-69c5d5a161cc", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb27e5e-0683-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770729618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729618, "uuid": "e07bf101-f44d-4dd4-afd2-5913f5de8126", "comment": "Malware payload (SalatStealer)", "value": "b60e4ea5cee4aa57da8c3a69d35a0008", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729618, "uuid": "543ed3cf-73c4-4199-87b1-c86abb57a9c7", "comment": "Malware payload (SalatStealer)", "value": "6fa1077189e77f1ce8ce0a55fbc74c35a4b364b51ae23f78bcae171cb065e0de", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729618, "uuid": "93b9e92d-dfb9-4a33-b507-0f326c5863dc", "comment": "Malware payload (SalatStealer)", "value": "3025cf79461bf07a4a184d2bdb4e9387e2c3073c", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770729618, "uuid": "c8ba6d49-4e96-4683-ac11-7b1bcafa08ba", "comment": "Malware payload (SalatStealer)", "value": "296abe9662fed32213733bfb58be423690cd1872b45158cbf9505bea1c3fb3ef29e25b2f47bbc3ba1bad9ab6552e3f68", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729618, "uuid": "efc6f778-4d87-497f-b8f9-0dcc60b05c28", "value": "T197F633880AB6C6EB5A6DD2752E0617907DCAEFF48CB6F306712764172F1311BBA87D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729618, "uuid": "6ff16bf1-6003-42a7-8cd0-0b692c667815", "value": "393216:/WHRWHCWHDWHdbXJ8zKiuONBR1FR5zQmidJ5fDoCbROXktwh:+A96VOrRXR5zQnNpMgwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770729618, "uuid": "aa129942-8c8a-43f9-b3ce-2a441f575eb4", "value": 16787045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770729618, "uuid": "51bc9f58-be82-4745-b3f8-469ff55c416e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770729618, "uuid": "5c2b8d1e-a37b-4022-a774-bc805d874cd5", "value": "vmx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215879ca-06be-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770754909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754909, "uuid": "4291115c-c1de-45aa-9726-c1385d7a4117", "comment": "Malware payload (RemcosRAT)", "value": "87e28ddabcdf65607627f7389687522e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754909, "uuid": "c4b3376c-2967-4a01-9354-5bca108fb137", "comment": "Malware payload (RemcosRAT)", "value": "70115960f384f237162bd6a7533441b322afeb16a2364ecc6bc36b54945d8f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754909, "uuid": "0c69ddd7-70d4-43f7-b757-38658163ac63", "comment": "Malware payload (RemcosRAT)", "value": "25fdc0bf52295519190943edf55ec6c3457b1632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754909, "uuid": "e1a46d83-ccd6-454e-819b-a0f6ecc5153a", "comment": "Malware payload (RemcosRAT)", "value": "01bf88e7b5761111e372d2b1d7f3a15ab157fc650cc90bfb05929f7d8ab7f2566477c707ae0b2e6cf86e590842fcdf85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754909, "uuid": "b3deff72-3152-4c32-8bf5-1a5b8addf020", "value": "T167B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754909, "uuid": "1c7d181f-28b3-48a8-86ae-8054e7c657c3", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754909, "uuid": "143e2fa9-c30b-4d6d-843a-112a3c157647", "value": "12288:U6pxxGI8gvGOHJpAbDYGxLhZ+sPZt5mPFN:U6pxxx8U+bDYGxLhZtZKPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770754909, "uuid": "b8af98c3-413a-4842-b58d-12906fbc9a4a", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770754909, "uuid": "2a3edcbe-f7df-46dd-a1fc-674cdcb18803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754909, "uuid": "1f3049a3-f3a0-454c-b266-27753c887980", "value": "70115960f384f237162bd6a7533441b322afeb16a2364ecc6bc36b54945d8f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc379e4f-0659-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770711897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711897, "uuid": "96ed9020-53a9-405f-b7db-3f10eea40da5", "comment": "Malware payload", "value": "0e3493146f5ac79f3bde03394bbc78e6", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711897, "uuid": "cdb1376f-ad5a-4f89-9aa9-4e53b4aedd7b", "comment": "Malware payload", "value": "70cc470e29e1bdddb1ec1361cd6cf64bb28a6a2d65156f9a24e4bba1ba87869f", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711897, "uuid": "9e8b9d45-8e80-4176-a608-9fd7f8b760cd", "comment": "Malware payload", "value": "8c6ef908b9fbf717f9a73ab07ba388cfca7add57", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711897, "uuid": "f8c65a10-92dd-4a16-ac58-16f365bf826a", "comment": "Malware payload", "value": "3f1077ff41e00cf020c5ca6502dd6b49c24ec2477e949eebd33f4f9dda2194721132cf06324c136022015bd3c133e7be", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711897, "uuid": "38e9e116-2ed5-47ea-be89-999e9a169f94", "value": "T1DAF09E50B372D4F15C9C4A116384DBCEA83A225C60E83A0558DECBCC66DB70B576E4C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711897, "uuid": "d5e1c455-fdc4-4452-bb39-10d8f94aff4a", "value": "12:Cy5SBZ5iSxVmsXKC2IS1CFASQWifg8MM3ifrNS:95OZ5RmIKC2KznaMq+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770711897, "uuid": "dac1248a-7be5-4c5b-bff2-c49fd03e73d9", "value": 488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770711897, "uuid": "3d7550f4-f9d8-4ecb-a3bf-ef310d802a65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711897, "uuid": "5c1cf02a-11d1-4226-806b-ecc5cb2c254e", "value": "70cc470e29e1bdddb1ec1361cd6cf64bb28a6a2d65156f9a24e4bba1ba87869f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f516761-0632-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770694964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694964, "uuid": "7c24965b-9fbf-4959-a73b-5aca9b7f46a9", "comment": "Malware payload (CobaltStrike)", "value": "9f5ab54d5fe4f71819c68e6a7ce55390", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalSusp", "colour": "#F228B5", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694964, "uuid": "7a68d530-37e3-4117-aa85-1a944d4fd946", "comment": "Malware payload (CobaltStrike)", "value": "70eb836ff3d3026bcc703bef4ebab0a690203d3c595710ae079de66d6af45c4d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalSusp", "colour": "#F228B5", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694964, "uuid": "795f2337-7c98-4eca-b810-179a9431fb99", "comment": "Malware payload (CobaltStrike)", "value": "2a90193b8c508cc8495a5f7eea646ca522bd46a3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalSusp", "colour": "#F228B5", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694964, "uuid": "7614dbf6-8593-4b0e-9c23-6b95e95c6650", "comment": "Malware payload (CobaltStrike)", "value": "384668c19b0828f9a1594e69fd3480302700a64fa49b87dd535a862d29386c790c84c92f408e9ab4ddaa8765de6e72e9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalSusp", "colour": "#F228B5", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694964, "uuid": "2865eead-f026-4796-b140-464c10ca2958", "value": "T13BC5BF17B8E508B5D8BED27155368225BA32BC090F7A23DF2691B3342F733E15A79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694964, "uuid": "43f2ec71-f53d-4342-b308-93327096ed07", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694964, "uuid": "59ca85f8-a2d9-4af9-844d-96a601f57919", "value": "49152:ZlNZOhH2BLIrKMPf5saTpIK0aaBsLCy+:nmH2BiKMH5salIKas2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770694964, "uuid": "502b794d-23ec-4f9c-8428-057c26733d6b", "value": 2671104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770694964, "uuid": "52b2df4d-21a8-4184-9333-a362dae18a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694964, "uuid": "fd7dc52d-7d21-453c-872b-ba88b8891746", "value": "\u738b\u8005\u8363\u8000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278f9d5d-0651-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708105, "uuid": "ed54315c-18d0-46cf-9310-1d9d8d6f41b8", "comment": "Malware payload (Mirai)", "value": "0ad04150067878a75f53dfd2ee6c5ae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708105, "uuid": "cf992709-b8d3-4ad9-a0fe-8255b4ac3c18", "comment": "Malware payload (Mirai)", "value": "735c326f8784f0f8d4d76da8221f8e545a4b731840595f228d98aba5a19d10c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708105, "uuid": "c8b8f13a-9c10-40a4-bdb2-4ead8678da42", "comment": "Malware payload (Mirai)", "value": "fccb2b2d2f2109b4e6e8c8b9d5f94c966845b939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708105, "uuid": "9dfb3948-f3ca-456c-95d8-3ad87e80dae0", "comment": "Malware payload (Mirai)", "value": "93282db1299ff9d7eedfcc19d074074fcaa3c5172566f7139accccf2d91939370298f81375dc772a61510a6b8016541f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708105, "uuid": "96a3d468-6669-45a8-be5c-63cb99daee4d", "value": "T1C4B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708105, "uuid": "ea027c28-f56c-420b-9844-9606dffb737b", "value": "1536:vUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvx:8ixnUHz4Z+5ypkn3E8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708105, "uuid": "2a1c4298-525f-42e0-aaaf-deead6b4c7a7", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708105, "uuid": "a296405b-16e0-452c-b895-c0e8f48c1f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708105, "uuid": "89c41693-2d48-4d29-9640-36fa35830c31", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224cb5f3-0616-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770682755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682755, "uuid": "f443d68e-6c16-461f-bec3-f75cf612dc06", "comment": "Malware payload (Mirai)", "value": "4ee097b394e9e15669ca624670368c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682755, "uuid": "9001d122-aeea-4474-9d68-068c9f0ceadf", "comment": "Malware payload (Mirai)", "value": "73c4f6c5fe526531beaa49a05cf006ac4f854352f7f41d2a052d6d535d690b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682755, "uuid": "1b0b8ef1-8a82-4051-aa89-7f9f021b23fc", "comment": "Malware payload (Mirai)", "value": "328761802ce6c114d72564260f0ca67a237c6650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682755, "uuid": "53d99e0a-aab4-42b4-8976-bd35547d0c9a", "comment": "Malware payload (Mirai)", "value": "cca702b8c042e3f9a5eeb95a16bd62943ffcac059b0fdcfb9884e30a3237b42984014d2b617c864d257cc659d144e9bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682755, "uuid": "eb3ddb40-f367-4325-b5f7-6d9656ad7965", "value": "T104C33B92FD81D612C6C766B7FF1E428D372713B8D3EA72039E256F21228A45E0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682755, "uuid": "2596bc79-ad6e-4354-a607-6b899c0a294e", "value": "1536:Rh1aAgQgNxST1GnbpQZr8nZnP/DGuGzP2/542ppaDjwveaTpll59iOGOL0cIMUY0:Rh1aRQgIw3Ya5tpzvplfpdIPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770682755, "uuid": "8e3ac90b-6310-4c39-a12b-99689a238d01", "value": 128212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770682755, "uuid": "925cf640-6144-4e30-9ee8-8ce1b2005626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682755, "uuid": "f5ce0ed9-7a06-4a34-95f8-b59621826902", "value": "arm5.go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc8933f-067c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726795, "uuid": "c149f1bb-72af-4a0f-9ae5-02100b59acfe", "comment": "Malware payload (Mirai)", "value": "9fc99e6efe506958a4f1fb396166c235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726795, "uuid": "b53d4faf-1031-4225-803b-f68b16f277c2", "comment": "Malware payload (Mirai)", "value": "76df53ad7945543c5c7c0427cf1ad304fe28c766fc10c3a2136b55a2748cde43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726795, "uuid": "2d8a5cee-e834-48bb-a43f-aa37fc97f709", "comment": "Malware payload (Mirai)", "value": "a518b4bfaf52538f3497d6ced423e7dd5f45f0cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726795, "uuid": "48ee4eb2-f538-469a-a9ec-cecd2818b7de", "comment": "Malware payload (Mirai)", "value": "f2af26c2778c5aadff37bd48a2f9f5c8b5e8ca20ab2cd83c3744d940595ac3ba8858ec3f1a649392e205823bf95ddbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726795, "uuid": "ee8ca65f-adc2-4af5-b47c-42de20ad9468", "value": "T176B3C61E6E218FBDF769823047F78E21975933D627E1D645E2ACD6011E6034E281FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726795, "uuid": "a0886823-7237-4654-92bc-51f379a6cee0", "value": "1536:N1jLy/jmsE/mq3i2nUyah2yHP/QGHVevMLrn61a0y:Dy/6sJ2noh2yv/QM361/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726795, "uuid": "bf622d38-b7c3-44d4-8f8d-a5b41e5385f4", "value": 114044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726795, "uuid": "2e1fb0ad-747c-4ae9-9aa6-d62b9c807b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726795, "uuid": "37d7ccf5-e30c-4a1e-a101-e8b02c3fa386", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05abf322-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712343, "uuid": "3ce35e69-0281-46e4-b97b-b1df27045633", "comment": "Malware payload", "value": "c43207ce139916a5d23e61e07a3be8fc", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712343, "uuid": "bf2eccbd-fbcb-4dfd-b7d0-e604886ab919", "comment": "Malware payload", "value": "780af28f713787ff968468ed2a2c91264c137770c97fc38bb2143669abef0659", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712343, "uuid": "e9e9b92a-5008-4021-af1a-8a8c2f3389da", "comment": "Malware payload", "value": "3c9abaeeef98193d20599464db3797619e60f2ca", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712343, "uuid": "60bca735-dd55-447d-bc5b-06b20e111e35", "comment": "Malware payload", "value": "b1917bbe705f13a326e1aa62b75774305038174daf3bbaa063211808563a9ee9aa0f7fb83038b8faec5c64c0542217ad", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712343, "uuid": "de856722-241f-48d5-8514-dfb8f14a7436", "value": "T135E34A724517FEFD3A7D2EC0D8002E891D6C29970A1AC198FFCC51FAA7EA950CD2A475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712343, "uuid": "e079534e-f432-4b02-8191-1edc41f137b4", "value": "3072:IFbREbmYU6x8OP2iXSl8CEx3YKZEVmlnr0wpHkxP:yRIjSa3YKZEVmlYwpEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712343, "uuid": "4a38b3a2-0ab5-415d-83ae-b6259cc5e495", "value": 153069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712343, "uuid": "4eaf5ca7-87d0-4302-9be4-ddf9f1d0574b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712343, "uuid": "797c4dcd-832c-4d1a-a91b-afafbd786976", "value": "780af28f713787ff968468ed2a2c91264c137770c97fc38bb2143669abef0659.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ced78e0-0628-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1770690612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770690612, "uuid": "236499f8-8a43-45ca-b77f-773465b04261", "comment": "Malware payload (RedLineStealer)", "value": "257ed84eaac0ca43391ccd094a5e2317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770690612, "uuid": "f382f4a6-9555-4b04-bfca-536c3ef219a7", "comment": "Malware payload (RedLineStealer)", "value": "7dce26dea5fe8cfee7d161ce30d45f009d4d10978b3a11942aa2344a3abe15d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770690612, "uuid": "53eef25f-4e92-4dce-83d9-674040f31b5b", "comment": "Malware payload (RedLineStealer)", "value": "1061afa294912351c71a605cb4aff53ece93d34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770690612, "uuid": "37f15fb2-44d8-4a4f-868e-e5ac8a8c3e46", "comment": "Malware payload (RedLineStealer)", "value": "fe20d515599395fa7817b9a94539573187c32aee979a5cfbe5c704eb559207a06f3aef1db85cceb039a5d4a43bb0d004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770690612, "uuid": "3b6cd4bf-aad3-4c4f-bf8b-41162acbb12a", "value": "T1C296339993B009EAD8676D3F4A755053D3E1B4250BA1C9CF1BA0832E2F9B2FE2C35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770690612, "uuid": "eef8e113-c72b-40bc-8f49-0465a2daf648", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770690612, "uuid": "c9661df4-ba9c-4723-9edd-e82e98e80844", "value": "196608:noOLtbW897GXPHMe81SF2RPUewce97BtKZ2/HsMRq+bRgFtDUq:nZL1wPsZg2KeGxK4/HsMRq+bYtwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770690612, "uuid": "432736ed-8ad1-4163-ba28-700446f2e568", "value": 9435276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770690612, "uuid": "6c5d24a0-5346-446a-beb0-eff122bf20e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770690612, "uuid": "e06daeeb-9e67-472d-8822-0c8c8ae0506e", "value": "x7dce26dea5fe8cfee7d161ce30d45f009d4d10978b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e32ccf-065e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714039, "uuid": "4b5e28df-fbc2-45bd-8aea-a3f7b37fef41", "comment": "Malware payload", "value": "6724bada326959a19ca242ce96fd1923", "object_relation": "md5", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714039, "uuid": "dac1d340-020f-4fcd-aa42-daea9d9cce58", "comment": "Malware payload", "value": "7f6dbf9b29f7b4951acce9d373a0b273ce472fe2e21299bb8bd21e397e9b5cae", "object_relation": "sha256", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714039, "uuid": "af61d268-915d-421b-beef-4b1ba42ef659", "comment": "Malware payload", "value": "20b44fa62c9df025c2f751602914f8d4271b73ac", "object_relation": "sha1", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714039, "uuid": "ff7361dd-bf5a-439e-b4f8-f48e2ac7b339", "comment": "Malware payload", "value": "8566f3199170baaf8677ac71f8c80c90bdd639bb3c93a710b96716fe1cab8847b43ae846e5a7e460e110f107988f27f3", "object_relation": "sha3-384", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714039, "uuid": "6ab7efca-4a77-43f1-b1c4-9b07ee3761f6", "value": "T1AE36ED4C25DBC3B2B05614924A5BF7C98E87E9543B0B9428FC3754C1F861FD9BBA842B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714039, "uuid": "2934519a-76de-4fa9-b25a-2313061dfe33", "value": "192:Yu5OOwfvLI4LUBjw3RHNiHO5vFW3tX3y8l9ifDBahBJxBV1VWQ41JmD3ktv+H2q6:NjBsEVnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714039, "uuid": "fc8c7840-4c25-4bdc-a4a4-c1edbb44b114", "value": 4873424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714039, "uuid": "ee9889bf-8544-465d-9685-08e436cd1f68", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714039, "uuid": "0b03a165-3d6a-4783-9a06-3f5ed8e05aef", "value": "7f6dbf9b29f7b4951acce9d373a0b273ce472fe2e21299bb8bd21e397e9b5cae.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ac54df-0681-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770728885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728885, "uuid": "9f7cdc7b-670d-40bd-b902-b0aae21e97a3", "comment": "Malware payload", "value": "41ca612a7a14a87368961802c4d22830", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728885, "uuid": "060adbef-b5d8-4d5a-ac0e-8d21affd849e", "comment": "Malware payload", "value": "8048d3976ded937f977a7ea4b64e58672170c914f1f4ae9504d147ec500b7b93", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728885, "uuid": "f3625355-c814-499a-9d78-4c0297638b0a", "comment": "Malware payload", "value": "53b74f0ac1e87760557b0a78607975d6e04f51ab", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728885, "uuid": "f14b0bac-efed-49a9-a402-3ff4a0c940da", "comment": "Malware payload", "value": "8ebb96df5240890f8831b0f839ab77d79fcc8f6a8d2ec6c418aea718c66a17886041921526ba8de072293de1c6774728", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728885, "uuid": "621dd425-0488-4373-bbfd-64634103718e", "value": "T149C733C09EB1975BE707A1BF6C92E6DCFA309A27B9FF8675C579808981431C84C35827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728885, "uuid": "a176d612-8d81-41f8-ab1c-e7e26f09413a", "value": "1572864:3jkukZqN08T4yDZiwlT48KjHEfBF1Ln+Z0FJ5m7hULP:3R/tiE88KjHIBf3PmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770728885, "uuid": "be564d56-30f0-4906-8841-d5bf5d151aed", "value": 53157157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770728885, "uuid": "5ebf0f4d-30c5-4964-bf48-4c45b6de720c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728885, "uuid": "92e5da41-7498-4b19-b7ea-906619cbd1c1", "value": "func", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3689a017-06b2-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770749791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749791, "uuid": "96910455-8fce-4781-811c-d4e4bb415c02", "comment": "Malware payload (Smoke Loader)", "value": "697880f1e9dd872a1f78d7cd2ae6dbfc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749791, "uuid": "7df27e2d-819f-44ad-bdc5-31e91be9767c", "comment": "Malware payload (Smoke Loader)", "value": "809df87e75b0f659f2e4017692b1c66418fb6b458b7cf43b6ee918de14cf6ca1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749791, "uuid": "d4436317-ee61-49e8-b6b5-241023ae66b2", "comment": "Malware payload (Smoke Loader)", "value": "c462cc547382b90bd4c959f482ea49d7d79d9999", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749791, "uuid": "4430ca34-ac22-43b8-8c62-bdca3860bf66", "comment": "Malware payload (Smoke Loader)", "value": "2bf4031c29d2c2f7aa9ef1a6c0836bbd772eae832b31e93cd2af4f9e7c12b62e2ff6d0e6c343a8e3cd82d746cf798429", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749791, "uuid": "8e6fa856-d7fb-4039-a2bc-81a39c341f05", "value": "T15DA5CF663C2FBEDBD48846B1847192332BB4FDB40ADA70526781757A8C169762F3B433", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749791, "uuid": "3c2c42e4-fbb2-4fbf-943f-f01c12452c29", "value": "5795f08c013f31772c4f2dfd7361876e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749791, "uuid": "c8ad5814-312a-4fd1-aefa-51a9b4f2dc32", "value": "24576:VODY5sCJ78w61N0iG5NGpHvn4A7sjiyNpXzRB7yL710kn4ZZna2GiXw3cn6h6+rN:oSsoQ0rGZPvOikpFVyaO8kM6hbjKmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770749791, "uuid": "e3f746a8-71bd-45dc-b2b5-95ac6adf478d", "value": 2120240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770749791, "uuid": "c73c4aaf-283d-4db4-b899-db8590c42aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749791, "uuid": "32cfdb47-53e3-4411-b247-1c3b5de11f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625c742f-067d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770727101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727101, "uuid": "63612296-6cfd-417e-933e-ed171575be2b", "comment": "Malware payload (Mirai)", "value": "f3ff022922aaac6e0e53b6b6ad02f70e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727101, "uuid": "de76e9ba-8ba5-4a46-a5e8-a9e8072ebb9e", "comment": "Malware payload (Mirai)", "value": "809efcdb02c842f1921ba77b2209aa4863ce7d24b23dd87b96637312411b023a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727101, "uuid": "727f59e1-af33-4389-b44a-2e12ac810ae1", "comment": "Malware payload (Mirai)", "value": "86c303496c81ff6823248653a233d9759bb8d261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727101, "uuid": "7fd3fed8-b9e4-42c1-ae45-3ca0beb928d0", "comment": "Malware payload (Mirai)", "value": "dfcc133b11eba69d48229853794afe0d852bfd0c44963a73a3d8ff103c70ab64067bfa3ea50e657b799d38f2421b43d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727101, "uuid": "fe2ed914-ad39-4b81-8f46-83f7f1834083", "value": "T174834981F54B80F6D01749300067F73FDE32E1B58161DA1EEFA9DE36DA63542A62A78C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727101, "uuid": "dc73175b-e6a5-4abe-a198-9b84c1ce0984", "value": "1536:dDtsCEtWMU4IZLlcdETR734Jq9WfS+5VuxP3QkhdBbrvnjOaV:9tsCE4MULZL2dETR734Va+5VuJgk5SaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727101, "uuid": "eae63572-897d-4dd3-9c99-996542a86aec", "value": 83604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727101, "uuid": "1153b623-ef62-4355-8e7e-9a39b6ac9f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727101, "uuid": "64ac7ef8-527f-4a79-9d80-c37828e93969", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbc6e10-0655-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770709994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709994, "uuid": "500dd0f6-d913-44f0-b04d-4695e0d00ddd", "comment": "Malware payload", "value": "2f2426962806572b1b70aff5c5a87cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709994, "uuid": "f7afd4d3-272d-4c43-aa75-9323efc3edd0", "comment": "Malware payload", "value": "8232c36b425db9baf89fbfc3f5dcab56670dc97efb65e703d4f09b98949f6ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709994, "uuid": "c67ecb98-a7f1-4eb1-9a16-a9961f277718", "comment": "Malware payload", "value": "094c0c70df222619b2a481599dac15c42f984392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770709994, "uuid": "31637cda-0b75-4804-b828-a6450d988d4b", "comment": "Malware payload", "value": "6e778fc66434ec6addf9a16f95140b97624dca10d435360e09e15315ced0a6c32effee7fd31bc79d6f1e02cd6987619f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709994, "uuid": "4709a457-9728-4b63-a732-3553553851cf", "value": "T14B2533DA7B4913EDC13CF09D9948EC28B9DCA0388BB72C04DF9048CB7652FA5C9495E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709994, "uuid": "18645750-16fd-428c-96cf-957b9002d624", "value": "24576:yaOwVvvYm3CwpbTqfb2tEZYclsK21F9vi:y3wDTqfespsBfxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770709994, "uuid": "c2b41df9-69cb-4862-b782-5e39f086d7f1", "value": 1015548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770709994, "uuid": "d6c99118-03f0-47b2-bc23-317dccff0627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770709994, "uuid": "75c6634c-239b-40b9-b18b-5c0939d92731", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac947d07-06b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770752995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752995, "uuid": "6cbc75bc-50d6-486e-9758-32f0e69b1604", "comment": "Malware payload (Mirai)", "value": "17fcac39a7d3ffbf3d7584d2dbadebe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752995, "uuid": "0b90351e-78f3-4664-8001-ec212af41b80", "comment": "Malware payload (Mirai)", "value": "82459eed34a837edd40e0ad571881fbb23e2817deaafcc51c6aba61390aaf9a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752995, "uuid": "6785ecad-0f9d-420c-a0f0-4e8becbcd969", "comment": "Malware payload (Mirai)", "value": "6e512907b66e6265f60d7283d996d53188fd8402", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770752995, "uuid": "ab0a25ac-e9ad-47e6-9fd1-48095e588037", "comment": "Malware payload (Mirai)", "value": "6c4b3bb1fe0e5ec48142c6c32eac12c35f56227be97cf56ef67ab52c40adab8385a4a2991fcda0da2372399d24553f5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752995, "uuid": "90ac8ba8-889f-4c6a-9042-04adbb0e6a1c", "value": "T163E34A06B31C0A07D1A32EF43A3F67E083EF969125E4F641245F9B8A96B1D371586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752995, "uuid": "cc948dca-759a-4152-a638-fd0c1d7fe6ef", "value": "1536:208ZTYR7rYb30AkWsl8RXpyKjn9DFFBx1JEqF9PSscV+h1wydK4enBbZnvA/tEj1:kZTcrYbKslPBx1tKaa4eBbS1S5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770752995, "uuid": "4c8241c0-fb71-415b-b08e-bf569ad0b183", "value": 154396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770752995, "uuid": "7c2211b2-2469-4090-99bd-ef29c66c8243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770752995, "uuid": "40f6d221-dcad-4df1-883c-c98b7b0136c3", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346cdce6-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712421, "uuid": "6502428d-a1aa-4805-b524-2dd908e81e9f", "comment": "Malware payload", "value": "0a6726e960b90dac323f4800144732c3", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712421, "uuid": "654dd8ea-ed3a-47f3-8224-a091aa000ac2", "comment": "Malware payload", "value": "8400c0d59129b97c7dc07d444fd1de2631c0616f731131c9f79526195e710207", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712421, "uuid": "abccd131-e195-4164-abd2-94835139cb37", "comment": "Malware payload", "value": "393de5a081b89d3482ce3e77a4e819e6ac4c5dba", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712421, "uuid": "2fa3c305-68af-45a5-8dbe-ad3b2d7ea5c1", "comment": "Malware payload", "value": "51dea7a8bc0390370b00c502cbea6e0f6a5e9fa6f6a8091796ca355e88296badc4b6786380c30d60f7d2f32b73d35ed3", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712421, "uuid": "f04560bf-eb0f-42f3-9255-cd7ca866b31a", "value": "T102D46C4763A500BBE1368678C8634E46E776B4114B64EFAF03A4839A1F53BD18D3EF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712421, "uuid": "5b519b3e-4e9f-420b-ab6e-9624bbed10f0", "value": "12288:FRBBC+ktPksN4+BBC+ktPksN4TBBC+ktPksN4kBBC+ktPksN4qBBC+ktPksN4Z:bEZS+EZSTEZSkEZSqEZSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712421, "uuid": "da27e2eb-a7f8-405e-8652-0ac41df0be6b", "value": 602419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712421, "uuid": "4512a46d-7082-4f0b-aa21-d8cbcb733d40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712421, "uuid": "211abb44-d079-43a8-82ef-a2bac3692d98", "value": "8400c0d59129b97c7dc07d444fd1de2631c0616f731131c9f79526195e710207.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc8536f-061a-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770684518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684518, "uuid": "f2f055b7-b41b-466e-b43f-d4cfaac44a23", "comment": "Malware payload (Formbook)", "value": "0b4b328398d0e1f31819de946855f2fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684518, "uuid": "d9a84ef0-d769-42d7-b9b0-4c7efbe45a61", "comment": "Malware payload (Formbook)", "value": "8408280ed0ea2c437c19450847ba3209263f2cec14ed3803dd41ab4f74ddd566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684518, "uuid": "7fc793a1-cbaa-44f4-961f-3bdd51deb7f2", "comment": "Malware payload (Formbook)", "value": "917592f3843354258b2dacaf93066060c1582408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684518, "uuid": "932429d1-1441-494a-b980-47362bb2f119", "comment": "Malware payload (Formbook)", "value": "80a04c64f66c7b2709f78f0c8147d99069560df1d7463b8aba83f1aef63f196a65478ff5535cf051b630e5c0a8e693ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684518, "uuid": "478ffbbc-cb06-4043-856e-0dabf7b4a87b", "value": "T17245CF0273D1D062FF9B92334B56F6115BBC79260123AA2F13981DB9FA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684518, "uuid": "be9f1b7c-a311-46d9-8be5-e5c47fecb14a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684518, "uuid": "fa149c2f-4b21-4472-82aa-2a4140818273", "value": "24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXdaB7fPPfpN3lu2Q67X:ePVt/LZeJbInQRa1fPJXs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770684518, "uuid": "3bc4e993-ab54-4d4e-84c3-fb89c5e796af", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770684518, "uuid": "55f4258d-e662-4482-ae09-52872985a6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684518, "uuid": "d3478755-7bde-436b-b97f-71b77384c77f", "value": "TNT Express Arrival Notice AWB And Tracking Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e332991-065d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770713323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713323, "uuid": "83a9fbd6-97bd-4a71-8b8e-ebb497380afd", "comment": "Malware payload (Mirai)", "value": "fab41762897a3b044f80991c1b9cafb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713323, "uuid": "76c626d2-78b8-4e04-a8d1-c47196f95273", "comment": "Malware payload (Mirai)", "value": "844699b84c4bb55344278b40415e2b29c80fa4ac019c40cd7eeb2c2c20db58e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713323, "uuid": "8e68dad6-3ad5-4b28-b6af-8db97c243c81", "comment": "Malware payload (Mirai)", "value": "6ea41d87ea30e7105ac83470341e9a9f649f1a2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713323, "uuid": "59f13837-a4e1-46a1-8d44-06738cb51ee2", "comment": "Malware payload (Mirai)", "value": "9bb357a435c6dbd7f1dbd5006b5c2722fb06fa6b46c8db52dfa29096b53785b92541f3ab307a9ca86957be772d8ecaa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713323, "uuid": "cd3ecf58-805d-48c8-93f5-0212a44acf79", "value": "T1AFA3B7053B250EFBE856CC3F86F47715058C682A61EAAF36F934D488B44725F26E76B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713323, "uuid": "10bb218f-6213-477b-923f-72e135113a14", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPE:J3CTRdrD5GFnrP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770713323, "uuid": "897b2cdc-56a0-41f6-89e7-63de6bea6b54", "value": 101095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770713323, "uuid": "3669001a-dcd9-4e73-be2b-701ff9ce8e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713323, "uuid": "4514a336-528f-4923-8541-d4075cb5f499", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31048314-0691-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770735608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735608, "uuid": "a1089bfb-3432-48ac-857e-df9a391fb549", "comment": "Malware payload (GuLoader)", "value": "e224f5c042ad3518fd8405ef0147530b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735608, "uuid": "38af650a-a14d-4949-a52d-19810d18dcb1", "comment": "Malware payload (GuLoader)", "value": "85613912329269c1f21b898c2a033fc4acb6b5c8f6b78a59dddfa7574d59157b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735608, "uuid": "6455dc22-95bf-4e72-8295-2cd35f5fd031", "comment": "Malware payload (GuLoader)", "value": "bf723f6a7f92fa453dbedee8417e8011fd977f03", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735608, "uuid": "6af79ba5-34ce-4ac0-87b3-c3f809feebfb", "comment": "Malware payload (GuLoader)", "value": "2a03e816a5e8ff8546c04492d800b59e8afedc0458403c910e63b289e180a01ebe87afa5f83426a49d76e93a0d438c72", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735608, "uuid": "bbba5e2f-faeb-4f7e-a921-75d50e1cd29e", "value": "T11D51D768BB0B9DB7D29F03713B139B86043E7EB436857822475CBD7A44461E4226688E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735608, "uuid": "b12d150d-fa61-472b-a158-97338c0bbc76", "value": "48:bqUatxG2dcCmpdgbRev7w7gm2CDZDm7r+g8RbGLWwbxWKLUhyWvN6C:bqUatxUCgRv7dx7q3NYWI8Ke1vN6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770735608, "uuid": "63370a69-8cef-4d40-8b0c-5222b410313c", "value": 2802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770735608, "uuid": "aa12845d-5f46-4c8c-bf04-9772e0644cfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735608, "uuid": "68ee2dc6-803f-47be-b185-a283e8937186", "value": "rRequestforBestOffer-HSCODEREF102195ET115959.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b125a6-063b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770698757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770698757, "uuid": "dd3548cd-1c36-4d17-a918-18264bfa218c", "comment": "Malware payload", "value": "e5c141dab89d183a378942fe9b3c7f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770698757, "uuid": "57987dcf-b032-44d5-9bf2-edb8abdea057", "comment": "Malware payload", "value": "8571a476c97c7de10ec7fb93315a0e0aeb040fe9f99dd2bf8894d1775a9fca46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770698757, "uuid": "153eb404-72c1-49d8-9f5b-dca8fa69ac64", "comment": "Malware payload", "value": "8f6dc6a3198b2ec368a17ea996d28fcadac451b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770698757, "uuid": "2ee2bde0-7c05-44dc-b162-8efd71bfcb7d", "comment": "Malware payload", "value": "9da1f7839eb8d9bdc00e7dcdcdd2116710a5bec653f716b737fb6bf46b803ea278ceda8cd93d9032a3fac3ddcd8d8939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770698757, "uuid": "041b0189-5edc-45ca-9f3e-4663846e63ec", "value": "T10AB6BDACABC4ECDFD015E7218E22951549BF44F12E4DBC8D5437A35D2FDA1A8E38E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770698757, "uuid": "bad0f1c3-d516-4ec9-852b-e4d0f6e34ce6", "value": "c29ab370ed500debe05d495f2d8c12c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770698757, "uuid": "fb3c14d3-dcef-4f8a-9c83-1cbbdd160cfa", "value": "98304:jMg5kmVV4nzzpk1yWc5DiI2atLqhtKvuyazU2OIcM3mPaYbfHBHlwAetW:jN5kmVynzNk1aihSMqus2KA/uHBHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770698757, "uuid": "804a84e4-14de-4d42-ad3a-61c223b4cc9b", "value": 11403543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770698757, "uuid": "824fee81-8499-45c2-b263-94e2ed2a5169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770698757, "uuid": "3931ecb7-08be-434e-b709-2555e84f6b75", "value": "XyloTrojan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ddbfae-06d3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770764123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764123, "uuid": "82e4bbc1-1320-45bb-88e5-034f95b53bb3", "comment": "Malware payload", "value": "232e46f901d460af1d8a76c51d999f44", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764123, "uuid": "ccbfde1d-5acd-41c5-8469-81c365ae8285", "comment": "Malware payload", "value": "863f8e761905985d4cba870b9aec44982cceb6209c05e72707522fd96e2d4e18", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764123, "uuid": "6a2d340e-22d8-4466-a4d2-5876d50bcace", "comment": "Malware payload", "value": "82e7ba597784cd12d283b998d54e74c7abe7778f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764123, "uuid": "e74e41a1-ee4e-4a71-8ab0-d7a2040ae57a", "comment": "Malware payload", "value": "938d90271c5b0de3c4de52112f016edd2c1ea6e7a58f7fc73faedd1856f48827e0fd68fc22b6ece0d2477c98bb3d444a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764123, "uuid": "f68cfecf-6ad0-400f-92e5-25b7bff9bb13", "value": "T11D537B0BA38411FDE187917CE6565A03E5B5B40B1322ABDF43F016660F96BE2AF3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764123, "uuid": "0f7ef765-408c-4e8b-a931-6da2c7a01671", "value": "cb96eb953e5eab155d563c889c70dbe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764123, "uuid": "2ee87df5-f5cc-497a-95f4-ba23a2b61b38", "value": "768:OkmjcBzBWogGZy4ytDFET5W+orIFOlEOQLaMobkGFVh+1cgPC+L2o:CjusWUh9+8TlyxHCi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770764123, "uuid": "f6629031-2761-4978-9afd-c2522f3fdbed", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770764123, "uuid": "5299bd8f-7fab-4207-856f-7bd676be89a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764123, "uuid": "e9151e06-bb15-4c71-b4b6-22ef94e22400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7164aa06-0618-11f1-a129-42010a9c0007", "comment": "Malware payload (Ladvix)", "timestamp": 1770683747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683747, "uuid": "4a8aa9ef-1c3a-46ee-add7-7d4547263740", "comment": "Malware payload (Ladvix)", "value": "0a930b48147a197229787a6ab7e80a00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683747, "uuid": "2795faef-2557-423c-bb74-5d9e150f69dc", "comment": "Malware payload (Ladvix)", "value": "8939c94619291d57abe2ea96bdd9bffb4f3aa73cf9c041dfeddaa9aaacd77108", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683747, "uuid": "3de0a5ad-8b62-4f4e-9558-3ab3983cf6d3", "comment": "Malware payload (Ladvix)", "value": "cd6de7676bb7bf450003f0d3a55d572c979119e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683747, "uuid": "593d6136-7e9d-4391-bbc2-8991b6fec248", "comment": "Malware payload (Ladvix)", "value": "bc2d66073b79441f3c8b8a3c1cbd30c9482d5a173fb45e11e058af7a8d2f928d54648185607fce7d4d2d2b59925971fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683747, "uuid": "dcbd8599-d27c-4e3f-9f6c-1a2b9a2bf0b0", "value": "T163F2E50BAAA9EE3CD089C3708FCFD270267174756B33611F36C173762592A646729E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683747, "uuid": "31d8db79-d26a-42c3-8b40-49e2f0fedf71", "value": "768:AFTaLRRqJUvnfXPH/3vnfXPKC6yqiaSK+UbfwXZVjUCVLgJ2Amuk:GTqRRDUbfwXZGqs2Amuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770683747, "uuid": "6abef4e9-6a62-4163-9195-6c46824fe2db", "value": 35175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770683747, "uuid": "97d3cb7b-996a-43fa-aa95-16bfd9baf6ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683747, "uuid": "d63d58fb-ef43-4ef0-99f3-376df66d94d8", "value": "mig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621851a1-066d-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1770720229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720229, "uuid": "97cdae67-cf2e-4797-a56a-92e3fd578e2f", "comment": "Malware payload (Amadey)", "value": "2ad2c9a36050cf100d5810ffff6ebbb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720229, "uuid": "142ba1b1-a764-48ec-b5a2-9ec61ef7ddb2", "comment": "Malware payload (Amadey)", "value": "8a214a1d5c7767e5018737f6961886f2bb621f12af5dff34d3de145ae2b103c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720229, "uuid": "eaf5d95a-62ff-44ff-8885-ad11e7471d4a", "comment": "Malware payload (Amadey)", "value": "500ded5f47854bc35ca6f50bf514e15919a1b0b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720229, "uuid": "cf05ea65-4bcb-4594-800b-c7c84fd964e1", "comment": "Malware payload (Amadey)", "value": "2c7bddf8668aa3dec6ba0198df4db46d298271bf050ca2134af092595c2219df0f4cd7e265b96fb04070cb5b87d0a25e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720229, "uuid": "086f3139-d3d0-416b-84d1-cfc01e188d92", "value": "T127557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720229, "uuid": "a47686c1-3ee0-45ac-9b42-4088b4cd6c9a", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720229, "uuid": "7dfc8922-d399-4f01-b279-280741fe14d0", "value": "24576:OrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRgHOnW:OkHmiyCkhh2Bamituw+U6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770720229, "uuid": "a90bb0e6-3bd7-48f4-afe0-72a1653be353", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770720229, "uuid": "c390f8da-7526-4997-9d0b-37dd3fab865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720229, "uuid": "abdf746c-bcc5-4964-a3e1-d58b8bbd5183", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbdbd9e-0659-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770711843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711843, "uuid": "470cc326-f4ae-4ca6-86ca-bd20cb77af8b", "comment": "Malware payload (ValleyRAT)", "value": "72f4c185252e1005dee45c5ff2f94d4c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711843, "uuid": "c1487545-772f-46df-82f7-aff752c38811", "comment": "Malware payload (ValleyRAT)", "value": "8cd23d5552c846482cefa3a0344928e924312416a9ac6f1b9f2e6a1f05ae13f2", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711843, "uuid": "1bf34f20-1f21-437e-8990-6dbf09a146f9", "comment": "Malware payload (ValleyRAT)", "value": "8d1ad4f9bd7ced8facc2dc0279f90875c5f4afc2", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770711843, "uuid": "e62a711c-8439-4941-a791-232613099f4f", "comment": "Malware payload (ValleyRAT)", "value": "67c3e523d021380a5fd8a1872e53459a821777e54336aad717bb493dd5acb225e0e42cef445a22de4d682d9bb2aba5dc", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711843, "uuid": "c31192d0-1c9f-4d0f-83d1-02890b46ba73", "value": "T12FF4015DABAD44E7E4368278C8911A19A73AFC854E20EB6F0F27035D1F732E45E35B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711843, "uuid": "5a95aaca-07e9-46d3-9f8f-fca58fd7dc44", "value": "07f0d14c05ea4be19149047c6676ec0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711843, "uuid": "62a47642-ce48-4c66-bc49-d0104d0cb07b", "value": "12288:92I/O5Ue35HEBtOKdk2KotQPsZSLRpRDDn2B5drTlJqkN+Xn0:92d5JMIKdk2dtQlRjDDiXTlnNSn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770711843, "uuid": "7f3ddaf1-818b-4e50-bcb0-b260ad72ac90", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770711843, "uuid": "ef9080cd-cf2f-49cc-a1c1-74b3665c7d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770711843, "uuid": "f87b2881-a8cb-4701-9f90-db86959992bb", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u5185\u804c\u4eba\u5458\u540d\u5355\u4fe1\u606f\u516c\u544a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdee75e-062e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770693328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693328, "uuid": "a8fe15d9-e9ee-4e44-b9cc-fbc317c1d2d8", "comment": "Malware payload (Mirai)", "value": "92df90d8f0c02907bb5fffc14f1afd0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693328, "uuid": "0b2f42a6-80b0-4224-b87f-2ca53facb635", "comment": "Malware payload (Mirai)", "value": "8ea72ca9dbb751bcc965ca4513afe9820860fb02b4719ee46242cf1cb0d68f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693328, "uuid": "fb3b4c54-8f0d-4cd4-bb7a-d719c5d31949", "comment": "Malware payload (Mirai)", "value": "06b1dd1c9b86bb66aa5e849d51da37d125b823ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693328, "uuid": "8d34abbc-f5fb-42d3-b3bd-470079774503", "comment": "Malware payload (Mirai)", "value": "e4b06164d0dfa5e9702a423b3ac786a9e8948f410c7574b37f8abe9e0c30927ba1e77aa9973ef26bdcde1dc55e012702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693328, "uuid": "1141d3d2-2788-4182-999e-646faaad8120", "value": "T1F3C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693328, "uuid": "6a1c8b92-e351-484f-9429-e6cf41f5b867", "value": "1536:UPAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3y:UYFmSmviqS1Bs0+Nd6lAqktNMxSNbmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770693328, "uuid": "97cfc53d-4a62-4782-8018-6f15830f1a53", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770693328, "uuid": "caba3f51-d7f5-422a-974c-236171ad8395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693328, "uuid": "2eb3ab01-c846-467a-b332-0094c94fdd5a", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd99b40-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770738821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738821, "uuid": "82d2764e-27fe-4237-925f-666ebbf60d8e", "comment": "Malware payload (ConnectWise)", "value": "791c53f23f32859994af82b3447e65df", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738821, "uuid": "8bb9b2ec-6c60-4899-a347-1bf4597fb040", "comment": "Malware payload (ConnectWise)", "value": "9376b9b5cd5504e34f1f5634c3fdbf41e2a7c79f611c37be10716215835e2506", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738821, "uuid": "3277bbb3-6602-45ae-b6cc-2ddd10e60a1d", "comment": "Malware payload (ConnectWise)", "value": "85ee5a84de64c1c1a2c57ccbba59accc039cab87", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738821, "uuid": "bb6ff65f-f7d4-41e1-9ccb-8354321deb48", "comment": "Malware payload (ConnectWise)", "value": "78253a1514cc906d394997f35d1fff92bbd6bd7ab01b89e12cda545b4b800a8e65129eb680346ecacfe5017105dad08d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738821, "uuid": "c0ef927c-f212-4f83-9b19-cdf7bf76a13f", "value": "T1EDA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738821, "uuid": "39e43598-606a-49d9-8cf2-a7e8b4f995e0", "value": "196608:RKaLNkbgei4QBKaLNkbgRKaLNkbg1KaLNkbg:1WgeiHlWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738821, "uuid": "3be6fabe-3eb4-4924-b4c0-5d307d9456b3", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738821, "uuid": "7d30c0ba-0afd-4bea-b3e3-7b052cc391f4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738821, "uuid": "6819234c-b714-42fd-83b9-f26493c38498", "value": "9376b9b5cd5504e34f1f5634c3fdbf41e2a7c79f611c37be10716215835e2506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed6bbd-06bb-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770753743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753743, "uuid": "1bf46944-d5c1-4d47-96ee-ed7a4578b1c2", "comment": "Malware payload (RemcosRAT)", "value": "801bc562c4517b0c19a3d06c290e8799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753743, "uuid": "578846fe-10f5-4d78-b1e3-5c129b9a3cbf", "comment": "Malware payload (RemcosRAT)", "value": "93da39b18e13ac51a63ae33e9dae9e3352b05afcf7e374087221a30c7ab1b0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753743, "uuid": "875c2892-7dd8-4eba-8ff2-cc62685ea5d6", "comment": "Malware payload (RemcosRAT)", "value": "fe0ac4b06fd004c37dd902c29f6c26ead821e2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753743, "uuid": "17cb0437-9414-4c14-a64b-819151003f43", "comment": "Malware payload (RemcosRAT)", "value": "dd45a247fe7addbad94349a895043f09ad3c6695dce95980ed8508f62593e4f0e0151b5d2bc173daf671877697baa6bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753743, "uuid": "17de2bdc-fc07-4c3e-86c0-46eacab25a24", "value": "T1AFB49E01BAD1C072D97514300D3AF776EAB8BD201835497B73EA1D5BFE31190A72AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753743, "uuid": "d5038822-713a-48f9-a75a-f2efd0b5327f", "value": "1389569a3a39186f3eb453b501cfe688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753743, "uuid": "4ffd5e7c-a551-4c73-b490-aa5bccde2f97", "value": "6144:BTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crAT4:BTlrYw1RUh3NFn+N5WfIQIjbs/Zm7T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753743, "uuid": "d579ee06-c73d-41f9-9159-c061ca5bd7b5", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753743, "uuid": "20740bca-dc76-41c6-b003-9d5fab4b6589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753743, "uuid": "e58ade73-af27-4a10-8e18-aab390b454ec", "value": "93da39b18e13ac51a63ae33e9dae9e3352b05afcf7e374087221a30c7ab1b0eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6fedb3-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712411, "uuid": "457f9adb-31b2-4328-9961-70b862e9593c", "comment": "Malware payload", "value": "978f04cc8e7092bfb96f816290e2d9af", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712411, "uuid": "43d611c1-a293-428a-8dfb-da2f34ca6457", "comment": "Malware payload", "value": "94d9ec284b17969f43a158cc0bb412ec6cd234e1a17c3066964a88c061fa8ddf", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712411, "uuid": "d252d2dc-2f7b-4188-aa4c-050ba4fd85a9", "comment": "Malware payload", "value": "d0a49ad40c461568aae4b4e0b3dffd07a328a1ea", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712411, "uuid": "4a6b3ff5-a7aa-4448-aab1-227deac053b2", "comment": "Malware payload", "value": "05b1770cc1e012f71b0903e50a9f4c9fdd5204ba1e6090562ed7a4bc51369908eec7af6003c0b93d51c9c74c8bf35bcb", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712411, "uuid": "b9e7fde0-f224-4465-9187-89e5258dc362", "value": "T197C45B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712411, "uuid": "2f66c489-e503-4251-974e-3bab7420c1e8", "value": "12288:oBBC+ktPksN4QBBC+ktPksN4SBBC+ktPksN4VBBC+ktPksN4dBBC+ktPksN4Z:oEZSQEZSSEZSVEZSdEZSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712411, "uuid": "5ba3cba3-8c6d-4d0b-ab99-616a682e9ed4", "value": 590470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712411, "uuid": "e3d2ca17-cc55-47bd-bd19-2502d60874c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712411, "uuid": "456955cb-eac2-4348-add2-6c12b5267e2c", "value": "94d9ec284b17969f43a158cc0bb412ec6cd234e1a17c3066964a88c061fa8ddf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41180fe-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708018, "uuid": "c72b3728-e7be-4b0c-898a-894a755701e9", "comment": "Malware payload (Mirai)", "value": "30d01010ae6b4565ca7617d7d6d6e82e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708018, "uuid": "fd537cd8-7d05-4a20-bcae-0a80df962c8f", "comment": "Malware payload (Mirai)", "value": "9644d2b43be6aeacbe588b5e467df91b6a44e303708be7fd0e0f0d6614cbc1c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708018, "uuid": "837858a0-ca55-4049-a012-2ae3c6268bcd", "comment": "Malware payload (Mirai)", "value": "020fac2c641e7c6accae9c39ce0ec78bbaa35758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708018, "uuid": "e7857554-8484-49de-b2c9-ddfb7b03fe95", "comment": "Malware payload (Mirai)", "value": "ec1b08262c2b8f7313b2f92288d5550b79726a13d604d2ff4e66d52908786db0b32d55eae258445efd42f6eb232de60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708018, "uuid": "4f58afdd-8cfd-4ec0-93e1-62774eb630ae", "value": "T1BAA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF5063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708018, "uuid": "617ceaa0-0567-4950-a6f1-7918cc8cdb1d", "value": "1536:7JufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAe:8bU2RC4kPCtSzWu3/3L1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708018, "uuid": "3b6fb229-b42a-49cb-ae00-b817ffa3ccba", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708018, "uuid": "94e0f9aa-8a54-431b-8ef4-29b41e1fb5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708018, "uuid": "281b78d5-f6aa-4975-aed4-493ca69bd5a8", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8a09f3-06b4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770750739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750739, "uuid": "7aaa49a0-6373-493f-a1c7-fed5ec4ee7fc", "comment": "Malware payload", "value": "24af59fbf7e8895487506b0cc2f372fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750739, "uuid": "6a1f20d6-23fd-415e-8332-b0b73a0339c2", "comment": "Malware payload", "value": "97f41e72b74193f65db058637d1c2bdec03f152d24a94405de0027485c49cf09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750739, "uuid": "f4cf142c-dcb3-45e9-85df-e3e4b417ae2d", "comment": "Malware payload", "value": "4939adec0da6bf854cd6463bb192a7fe5bfef4d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750739, "uuid": "13ff3a6b-7f98-4d49-92fd-4357242fc167", "comment": "Malware payload", "value": "96b58cca40552255955c45081e98fb604b29d673b62aa3fcca529c04747ecbf3d9ae4b89ec1bd34e98bc31e11d5b44cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750739, "uuid": "176a246c-da2e-4dab-88a9-8fa6f0ce38c7", "value": "T1B2E068BB23C07428C28317D0FB4A0CAB1CAB27763CCC81A1803841607E103FC4139CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750739, "uuid": "fd14cbcd-1abb-4698-9fda-d41a6d47de56", "value": "6:uk2IqXffzCtjg1mttVlOA/CL6xZLL4rRXYX29HLCeOkTNbEwwzP8KMCUYlwy:ufVXf2K1mtXK6/slYsHXgwWbDzmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770750739, "uuid": "47921317-5f8c-44f9-af55-3e0f9544f0fe", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770750739, "uuid": "b6d16052-0296-41c8-a670-c0c232097b1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750739, "uuid": "70085573-2a60-4898-85bd-b006057af7da", "value": "Google Launcher.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1997ff0-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743152, "uuid": "613617fc-f090-4a04-aac4-40474f96bfb9", "comment": "Malware payload (Mirai)", "value": "4909891c1f3696d1cd1e553718d64f4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743152, "uuid": "239b1234-d438-4cb9-aff5-24637b6a2d05", "comment": "Malware payload (Mirai)", "value": "9818a7bf2070622ada5c7152041f60193f1541e0d22096399d826ec47a514dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743152, "uuid": "730c7cb5-a108-4909-a243-be832bf8faee", "comment": "Malware payload (Mirai)", "value": "cc0a98bcc4ef426f2e7ddd419d5d58648465bb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743152, "uuid": "34cce152-2b0b-4a88-9ecd-397cc704bd5a", "comment": "Malware payload (Mirai)", "value": "ae3ba74a218f6bc536552d8e9710930b8933398b8a491f22a89214d67b56670b6791fee36d5a7e577dc53ca0ba64184f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743152, "uuid": "b3b2bc0f-4de8-49dd-a079-cdd3b8032bd3", "value": "T12DD2D1BDE4B481C5ED4E0C7E809C3FA14D59A5C1231BDB9673228C495B32C5BF1AB8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743152, "uuid": "57fb4a52-6e7b-4e7c-bd15-9d1e0be1cdc3", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjIJoHVJVuFRWGVCz0w:jMYHb62x4ahQ3CfdwLjjJW9gW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743152, "uuid": "5249448f-ac29-408a-a110-b4efb750f07d", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743152, "uuid": "d63f4ad7-ac41-4e35-9bff-f0d533a0dda6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743152, "uuid": "9d089b84-4e41-4dc4-a608-7e2482d5f16a", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b004e884-06bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770755578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755578, "uuid": "a72db205-4971-4bcf-8ff6-279ad78d4e41", "comment": "Malware payload (Mirai)", "value": "0c92a75492886ad68889287b69152c62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755578, "uuid": "beef4147-7d83-44cb-8d7c-877b9393e56b", "comment": "Malware payload (Mirai)", "value": "99d0053e597343130f9664fe36e1be35f5a700b3de19d79a9f7e8410901d9665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755578, "uuid": "b5ae76b9-3efc-4e43-b269-540ed863dc10", "comment": "Malware payload (Mirai)", "value": "9a9180fd85af9893ffb2e42b30e44ef523e56cdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755578, "uuid": "32cc8ced-963d-4c1d-88d1-e62bf567c124", "comment": "Malware payload (Mirai)", "value": "6872e55fb3cce97133a518965c89a1400494dec13c759ce6c3716ffd4f411673267678cc917264e963290e709e1f7129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755578, "uuid": "f960bb28-ac4a-41eb-965d-f0ba91f26ede", "value": "T1CDE30941FC414E27C6D622BBFB5E428D3B2A17A9D2DE71039D215F6037C685B0E7BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755578, "uuid": "3599a6a7-48ee-4be0-9466-d9f7a829eb19", "value": "1536:54FePae4jWwYbZR0INdnLF9QlBaT2ugPKOdsBOHkz524RCzj4VDiGFTl3ZGbI5oq:54y4KZknEz5Y4kM9ZGEqrcr77uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770755578, "uuid": "3590ad85-3590-4a07-9146-1d4b54684370", "value": 152256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770755578, "uuid": "774d74e6-e8c2-41a9-ba59-23a72594d4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755578, "uuid": "640c1419-29f6-4719-984d-72387908e508", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1bea57-06b0-11f1-a129-42010a9c0007", "comment": "Malware payload (PythonStealer)", "timestamp": 1770749101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749101, "uuid": "f2b5d96d-3e1d-48cb-b6e6-bf7201c6f224", "comment": "Malware payload (PythonStealer)", "value": "6e0f92a468f7c2d9fb596785cd2aa826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749101, "uuid": "f83364f2-e6d0-4d1f-88cf-5ac263cca893", "comment": "Malware payload (PythonStealer)", "value": "9a010d471fd0e69d5806214911d32802a81750df6efbcab1ee6700e0159bfe03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749101, "uuid": "5d81084e-d130-4414-bb26-c4cc54c18b68", "comment": "Malware payload (PythonStealer)", "value": "2a25625f99420f6270e13d5a6b2e499e2c10cadc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770749101, "uuid": "5fb3583a-2832-4d13-8b32-6249ddf6af40", "comment": "Malware payload (PythonStealer)", "value": "74dbc3107a99778c30b754e39b8ec1ce67ca87e139e149157c7a1182f48731d5027e9334c7650276b6fd37bb9eeb722f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749101, "uuid": "844ba5b0-8c36-43d3-9c47-7ca33c35ba4b", "value": "T1E28633B829325649C3A9E97814E50AD2D3A3FE3E23C217DB83D151F09A753F25B34B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749101, "uuid": "117c050b-1934-4e20-bb3c-6da2c17026d0", "value": "31725385009a1b77aed0a625d620125b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749101, "uuid": "8ec985f2-dc7b-4e43-83f7-dcbb71b4a5a1", "value": "196608:37HYWMvVR/xlqfLqdq2nleSOdX/QnW37oUzf2:3Lu9rkqd9leSWS4BzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770749101, "uuid": "35f89dc9-b21f-4f46-9604-43fcc08b5d9c", "value": 7849472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770749101, "uuid": "9a27c3a4-9765-4b5b-933c-fe068895fd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770749101, "uuid": "3295f8a3-b789-4fe4-9223-6830ecf4945b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc4175c-062e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770693323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693323, "uuid": "2e8df579-15c9-469e-930a-85ab61888356", "comment": "Malware payload (Mirai)", "value": "86b1ca5695f9bccd093bfd16d577df1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693323, "uuid": "d0ef5d48-0df4-4f64-98f2-9f3afbd0efb9", "comment": "Malware payload (Mirai)", "value": "9a47dd711686f8b6c97e62d3d4ad6e9ef89444a3a79ff861a3eccacb23d552f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693323, "uuid": "6ab24470-f1e7-4d5c-889c-58804fe0c31d", "comment": "Malware payload (Mirai)", "value": "cc09bfb6a5866ae2b48d1f88126b08f7ce9744e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693323, "uuid": "495ba8f3-2971-40f3-a580-c28950ed92f8", "comment": "Malware payload (Mirai)", "value": "58ae2ef424149e00b0f4b867a67853369c7a06114559cf92af818c91331e1916c0d2ca29c5fee35dcce67d9f32cee941", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693323, "uuid": "78cfe062-0f81-4df2-a65c-f0b97d453c9e", "value": "T19D23F2D24AFCD2FBD9A7A0B737AEC94DC22954713342426D654F34FA20C9A602F21B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693323, "uuid": "db7c14cc-273d-456a-92eb-b1dabe3c58ec", "value": "768:ICBnGw85YarbAV65w5JbmkhF4v9EEo2liWiTpuyb+u7UYJCv6srOgJxA4/:bsKanJ4Zt4VRJitum7UYkysagHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770693323, "uuid": "9d16b06e-7fa2-4248-b5a5-3caaf42fa331", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770693323, "uuid": "634d686c-a951-4a5a-bdec-3bbb48eb2694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693323, "uuid": "61c21ba4-4860-4a7d-b82b-6a9c0cd57aa2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1aade87-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770738857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738857, "uuid": "f6f901e2-113d-4823-8ed0-30b72a6e33e7", "comment": "Malware payload (AsyncRAT)", "value": "68c4292bbf1b1bf4a6810f2266f987c1", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738857, "uuid": "8cea206b-2a5d-4ea1-bed0-24d0f22f8384", "comment": "Malware payload (AsyncRAT)", "value": "9a5d6eb14a49a2b8e1ec7e7a2f51c20c279e18eea83a92c9b3cbe7dcaff3358a", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738857, "uuid": "3857e5ce-ba21-4dee-9323-62e18d39e715", "comment": "Malware payload (AsyncRAT)", "value": "215cc69d0a5a58ef717d9497fd3536397c632fd9", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738857, "uuid": "190a0cc0-9bdd-45d6-9117-5d1e30257f77", "comment": "Malware payload (AsyncRAT)", "value": "1fc2311733f1c4cccecb199aa51efa805755caa9b09d9d99285d2c9036c1b03a584bcd10491941fbc7f46866efc37e68", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738857, "uuid": "8edfce64-800b-4386-bd71-6eeba049d05b", "value": "T1542329003BF8812BF2BE5F7498F26145867AB6633613D94D1CC4519B5623FC2DA42BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738857, "uuid": "7dadfa96-e208-4f63-8a1f-cf3da093db84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738857, "uuid": "4d3be655-fd30-4efb-af71-d94d8d3c4e8a", "value": "768:0uh9JTP0FU0WU2j2Cmo2qVhfDyrFx11PISzjb8gX3iM0umMmHbM0NllXxBDZRk:0uh9JTPOY2sGRSS3bTXS1SP0NllXPdRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738857, "uuid": "2010ea94-c66a-4d83-90c6-ca757828a804", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738857, "uuid": "fd9b56ec-3f4d-44c9-96c2-964bc1b1729f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738857, "uuid": "568d7841-b7a1-4cff-b9a3-e2dc50b67dda", "value": "9a5d6eb14a49a2b8e1ec7e7a2f51c20c279e18eea83a92c9b3cbe7dcaff3358a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e94254-06c7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770759081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770759081, "uuid": "70ce08d7-0cd2-4a12-971a-62fba0c68be5", "comment": "Malware payload", "value": "b5a000d9b49893f98b0862cb4085b7ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770759081, "uuid": "4e126861-2479-49fe-90ea-c598329e4200", "comment": "Malware payload", "value": "9a7fa21ec168b2d1b629dec7bb4ab764d5abf4f4ae969e76cf6ccc8c36aa3175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770759081, "uuid": "aaec626c-40a8-44e9-9fc1-a085828f8ccf", "comment": "Malware payload", "value": "9210ae21a3a8195de2dcda7871ba2ae35df4b127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770759081, "uuid": "908e70c2-f1ab-4b47-9920-07d489d4553c", "comment": "Malware payload", "value": "113573608f6d6c6264c43ad13b3865da53e970ca007c94edab940c5ccac63d3d8f1048f362fda04bec7710c419569cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770759081, "uuid": "34e8d3c1-5f36-4ccf-8f31-ee0152399b41", "value": "T1D7F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770759081, "uuid": "6ef2b8df-2b3e-43ae-ad06-83c7fb803103", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770759081, "uuid": "6865222d-0864-4ecd-9210-5980792e004b", "value": "393216:fQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGy:f+3LQxhnLUYg3muRovxOOxUj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770759081, "uuid": "f0a5b81c-b5e7-46bd-84e2-8dc8985c0c23", "value": 71505408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770759081, "uuid": "9c5c2579-62ff-4702-b02b-a5acb0bc455b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770759081, "uuid": "eab96a71-f92a-4ef2-b72b-4fe3b97ea689", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a322e9-06b3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770750492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750492, "uuid": "62fdbe41-3a81-408d-8881-0e488aa7ef1a", "comment": "Malware payload", "value": "1bdb928b0786b54a417c5ade73b9f457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750492, "uuid": "50c97cc0-db4f-41db-80eb-709a7b14d3f5", "comment": "Malware payload", "value": "9b15b37d8442f3e1db5bcae60d87425419f1e817322cdd2d0ab5e8fbac772bd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750492, "uuid": "e93e307f-c2e9-4482-b4c1-741cae263465", "comment": "Malware payload", "value": "ce66a397cb727f7a090ca01fd74566d7abe2dee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770750492, "uuid": "098e8031-c17d-4695-bb1b-ff1316da54b4", "comment": "Malware payload", "value": "fd7d871a59a3f2978e9e351712218e0ff781b679957d39bb9b9ff8c1061ef4458275e37ce5f83cec8da47edc8ee03245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750492, "uuid": "99fe9089-cd32-4679-a67c-a00805172666", "value": "T132A533FECCF461A1AAC850BACB9C0AA98055E416FDE5CD35580D3B810AFA1B47B5724F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750492, "uuid": "19782086-5f07-4b63-836c-d1ef0fc55447", "value": "49152:RHmFD3CuCwqORg4NNnkAF3wEtI4u4kTN6Eh:RgDAfCNkAF3ta4kTsEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770750492, "uuid": "7a6e106d-c17f-457b-a28e-720d5420e0c5", "value": 2063757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770750492, "uuid": "c2368135-f64c-43db-83ba-d9505766df7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770750492, "uuid": "698fa08c-53d2-42d5-a950-8afc71d95f15", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117fb756-06be-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770754883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754883, "uuid": "84f1b3a7-a943-4617-829c-7dbc227ad009", "comment": "Malware payload (RemcosRAT)", "value": "70ad1dbec5df8c85d79f5db44841f5f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754883, "uuid": "d82ba74d-ad8d-4bc7-95ca-83ecd561e0a5", "comment": "Malware payload (RemcosRAT)", "value": "9ba1f0045b53aee9e6a44dcaf914d639713378f76006db5a0fe8e2de194a6f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754883, "uuid": "ef9e5eae-9f7d-496f-928b-ff6c41bee348", "comment": "Malware payload (RemcosRAT)", "value": "70a8b73262d1c057a919bf171ebadd6e4499eff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770754883, "uuid": "8482b8fb-d03c-4fa6-9b90-30ddc81acd29", "comment": "Malware payload (RemcosRAT)", "value": "2834376891b630d4fc6ce9da724749590065f5ae54c99925df20c7975c09af50d4da724b386065cd7e19c49f39d78656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754883, "uuid": "7447c2ea-6f6c-4f0d-8fe6-d9d74b7267ff", "value": "T137B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754883, "uuid": "1e3e1bcf-445a-49a0-8662-c245ecab8a31", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754883, "uuid": "c6ad85c5-6d11-44e5-b2fa-327cfc3d7c47", "value": "12288:i6pxxGI8gvGOHJpAbDYGxLhZ+sPZtHSmPFN:i6pxxx8U+bDYGxLhZtZLPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770754883, "uuid": "fe1a5bf7-3dbc-4f02-877c-16ba508738b0", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770754883, "uuid": "23f73a7e-8f4c-4fa4-9780-1fae67041bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770754883, "uuid": "00b2b207-2e5f-474b-b959-80b77b2951cf", "value": "9ba1f0045b53aee9e6a44dcaf914d639713378f76006db5a0fe8e2de194a6f21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1a7991-06bb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770753770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753770, "uuid": "b8075942-2558-4777-8b1c-c6b387433df9", "comment": "Malware payload", "value": "50df5f19764138f02f697f4de3dc6b57", "object_relation": "md5", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753770, "uuid": "1f760b29-9f15-4a1b-a590-4903fbf9df9b", "comment": "Malware payload", "value": "9fdd1eccff7280a30b0ff658d73386f7b1bb2445730e9b8907816673ca1ce1bf", "object_relation": "sha256", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753770, "uuid": "3821c389-628d-48e0-b74e-e821d5b175e0", "comment": "Malware payload", "value": "281da8cecbe5285c3eb361e0ec6723808518d522", "object_relation": "sha1", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753770, "uuid": "ee35f667-2f66-4adc-8fb5-2ea4ca226410", "comment": "Malware payload", "value": "a3adab1e6e5637c0af7e9dc38ab7dd74e5bff30f384c03a57150aa0f52722bad8cc085e924dd96f53c39121c0c344ab0", "object_relation": "sha3-384", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753770, "uuid": "a0a90d94-6c3b-49ad-81ab-6f05d231cb57", "value": "T1CD8633962AC6A8FBC027C770845AF03D76173744D2798D273AD9AACD8D03E22497F749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753770, "uuid": "31ae7bd4-8fdf-413d-8be5-fe69882a42c0", "value": "6d3e3ec35f899312dd8a13eebd05c16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753770, "uuid": "e9117056-f36b-41c9-9e6d-472d449eb485", "value": "196608:fFbJv9CpR127aMhzMxHIyqf/DULZYvOqgWVW:NbJVC7k7aMhopavO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753770, "uuid": "02042dee-bb39-47bd-9f02-33b4ecf27c0c", "value": 8087552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753770, "uuid": "28a1fefe-8c18-4a23-a1ec-0d054c026283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753770, "uuid": "056bfad6-51ea-4144-9989-2eb02cd41603", "value": "9fdd1eccff7280a30b0ff658d73386f7b1bb2445730e9b8907816673ca1ce1bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a96b27-0664-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770716311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716311, "uuid": "9315ea75-9def-4c4d-a617-5df0048e7dfe", "comment": "Malware payload", "value": "fe137791952c6291b7fe698ee9e14e18", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716311, "uuid": "e96a1ad4-322a-4fde-8e0d-9509a4f3788b", "comment": "Malware payload", "value": "9fed462515e69f912e6d3150b3bf7269e3a4edb9274559a441a9f55d1b2db23c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716311, "uuid": "04a88487-71dc-45e9-9376-11ff28db4cf2", "comment": "Malware payload", "value": "0fd5b1ae1504fe8fd4b0fae44fd390ac868a7cd9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716311, "uuid": "c6bee302-1280-4fd7-bdc0-810cdb49a330", "comment": "Malware payload", "value": "5fa115d7a85f5014f8ea7e69e4b424bf76edb93ccc919785c380bedda9e937253ef2ace3bf82b43710886644ffb7f354", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716311, "uuid": "a8bac5b3-a58b-4a6a-ae3c-bf398482a56b", "value": "T1BA637D021385B4721F6503C4B166AEE57B03B6B8DDC5B70A79A24A70DFFDBC8891BC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716311, "uuid": "b95e7f60-e6e2-4a3e-ad42-c19adf53ff61", "value": "384:oKp+d4IVv/NhaKm9LCv39QvE6m11JkRI777777777777777777777777iHjJmJmh:G9V3NCM3o41ixfqieieieieieieieiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770716311, "uuid": "f59f9632-d219-49c1-949b-6706ecdccc1b", "value": 67718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770716311, "uuid": "aeebc7c8-03a7-41bc-bbcc-753f59a426dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716311, "uuid": "feff0360-099a-432c-ab93-609c0145e4ec", "value": "2_14_5_1630_09.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5121d68-062e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770693363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693363, "uuid": "d24dd523-73d6-4373-8c0a-6a56317249ad", "comment": "Malware payload (Mirai)", "value": "701856322738ca03009c606b3ebeec94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693363, "uuid": "899e9bf9-6cfb-4de4-8a95-796a9e94a1cf", "comment": "Malware payload (Mirai)", "value": "a04c6342644e38751c46f79335c1fe8d29bba4ab093e05272ccdf08afe47daff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693363, "uuid": "a54f71eb-3f7d-4b33-ac9f-df2cc4d197da", "comment": "Malware payload (Mirai)", "value": "5b331677a9f60825a16932111ec2755b1ef1eb5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770693363, "uuid": "57e25e1d-84a6-4a35-ac52-3109fb301d0c", "comment": "Malware payload (Mirai)", "value": "8c7390a4031bb313436fadf32fbf80ef92ba33d45c93f03ad5d390574f735f4fb2c2626cb0d4706d3f7e9cf093ba3a1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693363, "uuid": "280bc4c4-e7ce-48ea-8c78-31679d64dcdc", "value": "T1CAE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693363, "uuid": "433c7a1c-adc7-47d8-8479-3ca6c7e26bb2", "value": "1536:p+DTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxMdbK:pklybKpzEOfGQ+vEubTt4ouftL4AdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770693363, "uuid": "931d71a8-c760-4668-ad61-cca134f6e9c4", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770693363, "uuid": "93ddc0d7-77a1-43a8-92b8-ae31a7f92154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770693363, "uuid": "ab25c7ed-1a6c-47a2-af28-d19a377a0b85", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3073344-0662-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770715667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715667, "uuid": "0b845a89-09a7-4b03-b0bb-ec7ffe0c373f", "comment": "Malware payload (RustyStealer)", "value": "cca9a39d34dc5bc584117bb9d3f2aa89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715667, "uuid": "bec49847-98c6-4efd-8b08-9b88d362cd8d", "comment": "Malware payload (RustyStealer)", "value": "a08293e23e09d53692aca4b20974f270e48c58c53532c6cc715993d24e928e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715667, "uuid": "a6248ba8-0138-4521-b9f3-4e450c5cd3aa", "comment": "Malware payload (RustyStealer)", "value": "19726f45d3b5618d8ef1367e3c0cde627f3f985b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715667, "uuid": "000943f6-a452-481d-a33b-b6a0e6cb9ce0", "comment": "Malware payload (RustyStealer)", "value": "5ef32a5c63144ea3d1fc08bc8cce63fcae299302e7f1400e1c994825873bdcf47bf439ed1c4da8b2dc5599302798ac44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715667, "uuid": "ed075c7c-24b0-49f9-8f61-12a0a2438043", "value": "T136D61243F6A294ECC568C138935B6A33BB32BC89472076EB47E057253E26FD05A3DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715667, "uuid": "21670a04-6461-465a-ab63-460cfdee2034", "value": "f7d5ba12b38af6792d7728e334ac2190", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715667, "uuid": "5289faf7-516b-4b96-9bef-491bf97b2fba", "value": "49152:wB6Vy9Efh//yfsEZ6n3GaeC0BSyU3lgkBmbO3cZhCHtlIH7NCYD9odUQ080QNZ6S:MiMEpUswH+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770715667, "uuid": "0be00052-e4d1-47de-9c98-ef3cf816e988", "value": 12641200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770715667, "uuid": "a88cf541-c48c-4025-9ede-48a2f922ceab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715667, "uuid": "5b393b9a-d833-4837-b577-53037ce83aa7", "value": "CSFalconSensor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc2a139-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770742770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742770, "uuid": "235a0f27-9e7a-4d58-a504-5ebb204f445a", "comment": "Malware payload (Formbook)", "value": "bf08834987e68921869b8eeeb017d03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742770, "uuid": "6342e691-8294-4d08-ad23-1038ffc102b3", "comment": "Malware payload (Formbook)", "value": "a15bc7c686a5392d474006c52c2d1711a4aafeaef5f57c31d72d7709c14ac933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742770, "uuid": "b10bef01-eb80-44c7-92bb-3fbefeeaabd1", "comment": "Malware payload (Formbook)", "value": "89f07cd27e097fa7855727d3ae573529d85c64d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742770, "uuid": "f4cc0ec9-8916-4497-a4a7-f95436406fa4", "comment": "Malware payload (Formbook)", "value": "11e9b5ad089507a7f4a35822dc2c8c02bbb90fbecb43742cbff174ec5f19b3e7f8e4862203154df9f2342761303703c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742770, "uuid": "15645a88-b1ba-4e01-84c7-92fc07af9a5b", "value": "T12635222033A8CF15CD7727FA1630E23167B4AC2E6022D35ACDDA6DDF75A5B411964B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742770, "uuid": "e390cb3d-2eb5-4419-ad9c-970253d91d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742770, "uuid": "c5a49db2-4ab0-470a-92cf-d986a1ef76c7", "value": "24576:kguQ8NoFGesrEEbK6Owz+2uFFwct5ZLVVict:5u9Nc+EEbKU+2u0cjfQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742770, "uuid": "6be7f9c3-a8d3-428e-b5ff-267915ad58b9", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742770, "uuid": "853bd758-2812-4a5e-9746-6960ec9a9179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742770, "uuid": "dd3ff339-e67c-4dbf-be1e-0d4808052ada", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140c7ecf-067c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726540, "uuid": "b31be6ee-8b1a-46b8-9424-acb7da39ea8e", "comment": "Malware payload (Mirai)", "value": "6c0a31028800ce716bb2a19c6d3313ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726540, "uuid": "1a44defb-b429-42db-8065-183e5cea6287", "comment": "Malware payload (Mirai)", "value": "a1c10d1b9d5f284c218aa697e0abb510231add2b3730e50182a853ca0267b293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726540, "uuid": "4f39a85f-3718-4b45-9a65-4d7c7c39cfd5", "comment": "Malware payload (Mirai)", "value": "cf66b9454c186c58db33c96704eb1dcc73d5c7d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726540, "uuid": "16f641c8-6b03-49e6-8e96-6a31345c775d", "comment": "Malware payload (Mirai)", "value": "c6708865790d430b060aac40f0dbe8bd3aaaaf8a8c6336e214e8c340cf4c1fcf729a3cc7f49b4713add441839a48c560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726540, "uuid": "e0ddfa5d-5ae3-4604-abec-fb33d1241191", "value": "T1AF5302D01B75278C5271D8763DDE305F8524192E72963D142DEB818EF81B22399B2EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726540, "uuid": "06b11165-9883-45ea-b161-a29bdd23f9bb", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvc4:8D+CAXFYQChaAUk5ljnQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726540, "uuid": "38074d77-a5fa-4483-b315-9ddf33e5228f", "value": 61248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726540, "uuid": "cf843d82-58fd-4bcc-b8a3-51d35cedf950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726540, "uuid": "6c1eeab4-599f-4cdc-84e9-fe5df9f62454", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc3070e-06a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770743277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743277, "uuid": "4caa2f7a-a7ea-4774-b3fd-48a9637aea4f", "comment": "Malware payload", "value": "819689c3c923cac3d0e1d2f6ab58effa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743277, "uuid": "f604c338-e922-47c5-9938-b057fce3e97b", "comment": "Malware payload", "value": "a44b59e65c8a0152c006874781ef78415b147483287899cde4de6c07de55952f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743277, "uuid": "16ea8dc7-0bbf-49ca-b02f-3684e8ac8e4e", "comment": "Malware payload", "value": "a225decc05610188e73f808a537c2163a215a812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743277, "uuid": "33e6b24c-e282-4c07-a79c-1d038855d803", "comment": "Malware payload", "value": "ef1c78bc9f4aad6d5fc7aa35ffee3c5455748a9a4fabd3c858e0f88812fbb9efb6166ee815cbe8ae24597dd177f2f560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743277, "uuid": "f900b3f8-24b5-400c-8fea-a0040ae97d91", "value": "T1FF451262CA46CEA105AC815424694DC396504EB7AC8837B83F9F4B8D1F6F60F94787FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743277, "uuid": "b70b3304-a23b-4be0-88bb-5f15b7d7674d", "value": "24576:7a0xk43b9w6ulWtUVjtF93tlwYFgaGUxw91woASUnkJQ5:7rxkmuAUJ6YhTa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743277, "uuid": "8859479c-708c-4d69-812d-a06f591b9c1a", "value": 1164669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743277, "uuid": "b1a4f529-3ab4-4ff0-afb7-206e22fa68f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743277, "uuid": "a9f4f83b-6d15-4a8d-8385-95efbe5756ca", "value": "ENCRYPTEDS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b586dc-06a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770745998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745998, "uuid": "0c8edc01-8eba-4489-9a26-a4a0bc9a90ee", "comment": "Malware payload (Formbook)", "value": "5c0f7979dbfcf26f6db6d565b93bc855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745998, "uuid": "c89c4c65-5ae2-441e-9f29-063bd41b900e", "comment": "Malware payload (Formbook)", "value": "a4ee12f9674be93285bebae1860592dbc2d4e9f0a1eb5f9d142a833c235f9af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745998, "uuid": "5852a3cc-fc66-41d7-ae42-f39b8f936f6c", "comment": "Malware payload (Formbook)", "value": "1e85fe4ef50ec46f8b5ef710a9e64aa7a697fbb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770745998, "uuid": "97cdf09a-9f2c-4055-89f7-1958dca1c2bb", "comment": "Malware payload (Formbook)", "value": "47b738072c4f801d49872a6340d8851adf5e5432729451c0d2ed4b43437f21b655f9c05436929c6e0ba2ac6214f221c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745998, "uuid": "4703d56a-781c-45b3-8ca4-6bbd85355c62", "value": "T13D552224369CCF61C96D17F51631C37253749E2AF113C342DFEAADEBFA65B022918292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745998, "uuid": "5bff2a76-1166-49da-a4c9-a1146c3a890b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745998, "uuid": "0c4f08cf-2e75-4f78-a0b1-2c03233d9619", "value": "24576:dguQErr2TLER8Xp1P6+u1zeQxk++IbqWOncLiWHW0g2bBsgab+H59ssQJuxUVict:KuZuTXHPuZe47bPGcL3HWN2VRabM59s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770745998, "uuid": "0bcf04e2-af58-41af-afe5-07552cfb1ad4", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770745998, "uuid": "fdda3d9c-6c49-404c-82d6-86353f58cf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770745998, "uuid": "35b5a132-a96a-4301-bc26-cdeae5ea3627", "value": "ORDER INVOICE CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e615a6e-0651-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770708062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708062, "uuid": "c67c26ef-baa3-45db-b32f-a793d7b48b1b", "comment": "Malware payload (Formbook)", "value": "c2b8f260535c1260c5888551e04b4463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708062, "uuid": "77cceba4-3525-4648-a003-72f15ac405d9", "comment": "Malware payload (Formbook)", "value": "a57580c54c2f959acf8f5207dc07a74f03be4d8598e843b0a5b05f93cc95c9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708062, "uuid": "32f92158-6a1a-4937-b4bf-032653b0ba2f", "comment": "Malware payload (Formbook)", "value": "714b10ddb7e541d1744e1d6c30f7faa60964cd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708062, "uuid": "8a043722-fdc2-4823-875a-8cb607407ed1", "comment": "Malware payload (Formbook)", "value": "a093cc3672276dce9957a8fbb9abf4e5299675a235bb897bdf51bcafd04a09d0e5c58dbf20f15e2bdbd58bab27607fd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708062, "uuid": "f12087c2-2cdc-45f6-b6f8-d900f75cbf49", "value": "T1AB3522203358DF65D8B52BFA5135E27453B9AD6EA401D21BCECDACDFB9AAF010460323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708062, "uuid": "dc545b1f-0be4-49b3-9536-945ea8cea3f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708062, "uuid": "3f2d32de-955a-4ca5-b491-54fb4018d764", "value": "24576:053guQmLs/8cnxJrj96zSOabEzS4CR2sXuLEVVictM:xu/L4xh0MKaJXSYQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708062, "uuid": "0b04cecf-e57c-47c8-9c66-f7d9c72ad473", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708062, "uuid": "cebd45f1-1a68-4ecb-982d-5101a67ef492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708062, "uuid": "abc1033f-fbd3-4452-9337-d3780ca315c6", "value": "WJP_ShipDocs_Feb2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06d7e6b-065e-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770714025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714025, "uuid": "bc222b80-53ab-43df-86a8-2e68a6bf4c39", "comment": "Malware payload (AsyncRAT)", "value": "7c1da46fd6add0fdcf359101f77f47e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714025, "uuid": "ab105ea9-9fe8-4fb2-a877-492d0d20e43d", "comment": "Malware payload (AsyncRAT)", "value": "a6e752bb42b49e83d8a7a2edf68cfd5e605185b2508a3ff03eb13aff9130a74a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714025, "uuid": "850bffee-c253-481a-9f0c-dd3ddd202ef9", "comment": "Malware payload (AsyncRAT)", "value": "91b03942a2176a8d90c6a83641edc6b021c68183", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714025, "uuid": "471089c7-dc4d-4a75-91cc-f86ac977133d", "comment": "Malware payload (AsyncRAT)", "value": "cff601862641c319f1d6ace1ebabbbd9637fd3161657f3df3bf4e82f759f39467dbbd1ebfacabce00ff3af2956c7c8a5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714025, "uuid": "aefb1330-9ab5-4afb-9203-798aeebf8873", "value": "T1005612412E26988132E429772A3077810E1EA6EB23BFE719F947DEE9FF4784BC570154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714025, "uuid": "c1809ada-d35e-4948-8a9b-0ce70a4d4411", "value": "768:1wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwo:dt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714025, "uuid": "cfa4c4cf-d313-47c0-a964-26220b7287e2", "value": 6099699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714025, "uuid": "47555f5f-6e3a-4aa9-ae01-a66cdb331034", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714025, "uuid": "57a5f0d8-757f-4120-8d82-6742c805872c", "value": "a6e752bb42b49e83d8a7a2edf68cfd5e605185b2508a3ff03eb13aff9130a74a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc137e6-069c-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770740438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740438, "uuid": "55cb5e86-3597-47d7-af2d-897eabbdbe96", "comment": "Malware payload (Vidar)", "value": "f6ca3931d9b14010eec03904c358b4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740438, "uuid": "aa766200-a8e1-4f16-aef4-6ec948e6a63e", "comment": "Malware payload (Vidar)", "value": "a7469b98efceb423c35bb888792aa94041f046b64fce2203e32a1afc03797bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740438, "uuid": "fd618155-5289-44c0-94bc-a4b21fdec418", "comment": "Malware payload (Vidar)", "value": "95315bb8fb32f5051d540340299a3a68130845c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740438, "uuid": "e6328cfe-82d4-4190-be64-67d45144fdaa", "comment": "Malware payload (Vidar)", "value": "05443d5d8d915a7a6fb404311b9b215fe6354f7a43f2630005defbcc7fd7e4555cbad84b16f2646e0277fff4ace839ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740438, "uuid": "bd76a789-d282-4f05-ae28-026014d20a78", "value": "T1A614120852F52786DA5E07F4E0D0D8402683B97B7F9EF0043FD94968BE65BCA714E93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740438, "uuid": "5053fd5a-6812-4769-ae0a-fcb46320fd14", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740438, "uuid": "1c9a6d8e-81bb-4461-a68b-f3471c9908c6", "value": "6144:9AIcld2RUS9t2cFBtBOtOcRjpCpnFfH3IzateemAU:9ncaztTlO/RjpUFfHYuk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770740438, "uuid": "17db0077-a5e6-4f11-87c1-26288fd2d7ab", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770740438, "uuid": "65834205-8bb3-43cd-8308-5af0741f09c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740438, "uuid": "32295245-5408-4e8a-9f39-200f94cbbebc", "value": "a7469b98efceb423c35bb888792aa94041f046b64fce2203e32a1afc03797bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5a7198-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743194, "uuid": "b5c64bdb-83a3-48b6-af4d-2a0862c537c5", "comment": "Malware payload (Mirai)", "value": "b5c58a5161b0e1ccb38cff4c37096f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743194, "uuid": "92dbf63e-4363-44ca-86aa-1e4091ab89c7", "comment": "Malware payload (Mirai)", "value": "a7a708a6c40a1ec25da84ae4f0029f7567ebcfc894e5fa63f398495e32c4dc83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743194, "uuid": "4729c926-93d7-430b-b517-65493f37ca5f", "comment": "Malware payload (Mirai)", "value": "5cc27313bc3c727d27caf0142a469656f0f48789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743194, "uuid": "e5c3376a-cf74-448c-8610-0e6906e3f5f9", "comment": "Malware payload (Mirai)", "value": "5d0957bd485948a2eb23dfce66770f91398c75337f213f4d7bca5935a5a49414c0f58aeecec8fdcc8646dd1f4bedd248", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743194, "uuid": "dfd8d193-338b-4885-b5ea-f85f9a0c0dd5", "value": "T1C8630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743194, "uuid": "9a9ccc78-808e-4718-9dcc-a14675e84c1d", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743194, "uuid": "e714df43-2828-4c0d-bff7-47ed9d9d429a", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743194, "uuid": "3f2f226d-8cce-4222-82ec-3828804607bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743194, "uuid": "83aa90b9-a446-4778-8d29-4184908f7fda", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b6157e-06da-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770767107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770767107, "uuid": "db9bbadc-fd04-4341-84ee-cebdf73fcb31", "comment": "Malware payload (ValleyRAT)", "value": "afb3304ab412b096c88651939544784e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770767107, "uuid": "31720081-627e-4af4-8f9e-0c189e806afa", "comment": "Malware payload (ValleyRAT)", "value": "a7d8de5b3e14189c71a2d04c46ef81ab6055918b3af728c41b6bb26724c6eb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770767107, "uuid": "5f5bca75-01ce-4a1d-b640-99a4dd40dcf7", "comment": "Malware payload (ValleyRAT)", "value": "989672ff9a49f3f0a6b04c84a90863d3d07aa55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770767107, "uuid": "19fc0477-6210-42a0-8826-81bcbbf61967", "comment": "Malware payload (ValleyRAT)", "value": "286585c04f61bafd0e9f1317772ed1d462560717016c6d4d928e96c62b631e6ad0ea1af6236de8dd6155bab49b97ae55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770767107, "uuid": "6cae25c9-7f97-4cf6-9422-a02cef09b9ad", "value": "T1C9D5338B4ECB49F1DC822834895335DF67E8A08A0879DC7DAD83ED94B463DD3448D66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770767107, "uuid": "820d9ed3-af60-4cbd-9b6f-27c050e0afea", "value": "c12366bc928423da75a87d5e3461c7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770767107, "uuid": "7c8f324d-61bb-4b59-970d-931072dba6ad", "value": "49152:B0C80tMWP7jgNxKHD6UMNkcgS3lqkvLGmTolT3jyrkmdFc4oJtYi:BvEzNkcgMTzG/BjgkmIj/Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770767107, "uuid": "97f5fdd5-0aea-44fb-ab61-61e0be2b3163", "value": 2934784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770767107, "uuid": "229a3274-db85-43f2-a76e-2340c7f19bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770767107, "uuid": "8b87daf3-ddd2-4cb9-9d81-d17ed949a1c2", "value": "AFB3304AB412B096C88651939544784E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b15b49-06b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770751323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751323, "uuid": "ba2824b4-d4d4-4424-ada2-3353a9e682e2", "comment": "Malware payload (Mirai)", "value": "13d737ec438207124d8698352ac0aa29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751323, "uuid": "3d25f30e-2b1f-4c4e-bc62-2acbdf2c7ca3", "comment": "Malware payload (Mirai)", "value": "a80ab37963b1f62b8d3a009e5faeeefd0787a800fe938f46779826a390e2098d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751323, "uuid": "6f3441b7-61b9-4360-9142-cf0ded355ea7", "comment": "Malware payload (Mirai)", "value": "da9930b7f99bc2a1e25e2b8cd827831b886f30c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770751323, "uuid": "7c83999d-80f0-4f63-ba82-0286ca9afcf7", "comment": "Malware payload (Mirai)", "value": "5d480358509a36c84de0a9269287f5941f7ee226097afd71a3228697cf2f155a92f069998ca0f244e02576a2f195e6db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751323, "uuid": "7a4e3752-228b-45dc-9dec-22cc9c09214f", "value": "T1B42301622794BCF27A3D5077DB3D40236145C174E7A4BD2729398710B2BA0DF2AE1FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751323, "uuid": "96579457-7005-4ead-a2f5-7c84cddef2cf", "value": "768:rQ11DiqbsEjMB09eKvRNkWkYHvKI6x4gMJYj53gyMAS1q3U03wf2:ri7bU6vsCHiI6t/XMAWf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770751323, "uuid": "517b1541-5ac1-4efa-84d7-9d77e995c60a", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770751323, "uuid": "88987bfa-ee13-4057-a8d5-3de7ffaa398b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770751323, "uuid": "c62d4736-cd0d-4f1c-973b-11cb1ccd4cc8", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2144ef4-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770738831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738831, "uuid": "c3f70f7c-f8fb-4e17-bfe0-bb455e9dca52", "comment": "Malware payload (ConnectWise)", "value": "30e58e729b6d1830dac810a324cf3e66", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738831, "uuid": "1cba5cb3-173d-4362-90a7-6aac8414e793", "comment": "Malware payload (ConnectWise)", "value": "a82d9c5fdb5912804f18e49db4c12073136c9050a5c74581714f79a08559376a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738831, "uuid": "ae0527d1-daf1-4d40-b08f-3f7435c9dd4c", "comment": "Malware payload (ConnectWise)", "value": "c6b7394a6f8d815627783d1d4475de90b51aa6b4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738831, "uuid": "355d93f4-c685-4d2a-ab0b-0d4f6cb978e6", "comment": "Malware payload (ConnectWise)", "value": "3b1fd2a28935be37df4d4b0e7533c30e30144b79c298ac6d78db31246f30e947dcfb1812a70c12cf124b58473a984cf4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738831, "uuid": "071bf950-3e51-41fb-abd9-cc9704c3b816", "value": "T19751530FFA0B6B248D72637241666C1FE9A5072B4A301894BF9C4855EF3172CFBD52E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738831, "uuid": "d07789bb-2157-4944-ba77-d440ca0b0d08", "value": "48:ckr0Nz3wP+pAu4Pszt4v2KWA9/+1cGo0hJ6XLj:rqAG+F0h4XWq/7GoqJKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738831, "uuid": "cbc26529-05e6-46a2-8abe-eef1cf1f2b13", "value": 2758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738831, "uuid": "ccdda5b3-7f24-4ab7-9ac6-96ddcb238fde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738831, "uuid": "1635d022-44c5-4de2-8cce-98d90ecf8ea1", "value": "a82d9c5fdb5912804f18e49db4c12073136c9050a5c74581714f79a08559376a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfef6130-067d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770727285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727285, "uuid": "525563e9-f6ef-4ab0-9c36-d438d1e27030", "comment": "Malware payload (Mirai)", "value": "32b63bc30f7259ca2b83d83a80a9ee3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727285, "uuid": "9a50be97-4110-4358-b134-88975d5611f0", "comment": "Malware payload (Mirai)", "value": "a84b57074a61fa68aa3cd985d7f5b5a13b0f08556325457915cd3765ff78d8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727285, "uuid": "c721e0e8-ea94-4450-b44e-228707d0f2f5", "comment": "Malware payload (Mirai)", "value": "eff2bf42860d0a9b7179cc58800150b034275f49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727285, "uuid": "617b3d4d-5a6f-4514-a5c5-2afcc814ab45", "comment": "Malware payload (Mirai)", "value": "e354c5005ad7f80215a9d838d5660e84a668e3ddf9b39fedf85d254a06619167cd8348093b9790e892fec906c5ececea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727285, "uuid": "edc27fad-602a-4802-8e37-71b3ee4241d8", "value": "T12D13F1C3E68CA438C3308934F998E58A7FAB5F7492F1F2E01862DC94E513110ADF99B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727285, "uuid": "ac17a9c0-7226-4cb3-9cdc-a29be6c2ac1f", "value": "768:Ch1qZ1e0OdvFJDwZqbIqBEvsPa92hK/AhEoc9omOues3Uozs:e1N0MFuZqbIqB8Sa9lAhEoc9kuDzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727285, "uuid": "35fc3b30-3393-47dc-98a5-7900a753a93d", "value": 41576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727285, "uuid": "a44a1dec-c51a-4628-9431-02a3884e7fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727285, "uuid": "cfcca5be-482a-4100-9abd-ba6948bc6e77", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2252a82-069d-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770741006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741006, "uuid": "305445a2-1f2b-4161-a109-9ba47aab6eaa", "comment": "Malware payload (Formbook)", "value": "48b7e3a1360ad0c115540c30e9e952d1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741006, "uuid": "0f686cdf-2b1a-4396-9fa3-6c9003d48d8f", "comment": "Malware payload (Formbook)", "value": "a89e0895174a8468f7ba5c0912ab2a876509ad512862d6487f5247944719fc91", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741006, "uuid": "ed7fe39b-1895-48b6-a59d-8e5d9e7e275f", "comment": "Malware payload (Formbook)", "value": "540033f886eafe04fb2b892f800368f8b1791f89", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741006, "uuid": "2077abc9-1aea-401c-af8e-4edd23583a7e", "comment": "Malware payload (Formbook)", "value": "db3fd64d798e23cfbbb50d1d8c042449654fba6b8789fd23c4d7aa2ba366d25ec5c4cec0b1aeb8d404b0e79e4b5199df", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741006, "uuid": "1c38299b-876f-4e89-a896-9aa9838599c3", "value": "T13051A5806E62EDBF44B8595E98072D8FDA05001699129D475F6C909C2CA0EBF716FBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741006, "uuid": "05c15bce-74b5-445d-8272-58ddf28902ad", "value": "48:bwsnVsxA4HvwTlPg0hOScQTXHoq1LS7T9kYUy0TapBYonWJj3zc+:bPnVEA44xPs3QTH52SYwTmBYDa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770741006, "uuid": "b3a64f26-0ba5-4597-afb1-573b577a8d0f", "value": 2868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770741006, "uuid": "320d28b2-5066-4177-8c8c-ec5ea71b9de1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741006, "uuid": "67cc6aa9-56d4-404e-863c-3df9807a83f4", "value": "rPO345378_PO345379_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec144555-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770742794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742794, "uuid": "7c3e5688-966d-455a-91f0-84a957d9ee4d", "comment": "Malware payload (AgentTesla)", "value": "155dfdc4eb24f4e4622168fc015a93db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742794, "uuid": "1f42abfe-dc61-4fe0-abe6-f3025fd46b15", "comment": "Malware payload (AgentTesla)", "value": "a9b670ff357cbb942a795c8524999072cd9466486b9c28b5b0d809b01547293b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742794, "uuid": "30c4c6c0-da80-42bd-a86c-e7b81b57c600", "comment": "Malware payload (AgentTesla)", "value": "9ba90e762751aff73ce894bc278e3053d9a31c0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742794, "uuid": "3b70693c-231c-437d-b9db-cce0e36905c3", "comment": "Malware payload (AgentTesla)", "value": "8389102cb74763fc027a653636892ca817226c3191d4d827528fae988a3eae06827aeb7af5010f90c99fdec74df12fa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742794, "uuid": "fb8a5dc1-3ec8-4433-b8f7-8fd036fac358", "value": "T1C645231028DCCE51C1F803F06476E33443B5AE9D9813E29BADF96CEB3A95F9458A8357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742794, "uuid": "17cb3ca3-b1b7-474f-a64c-2dc094f7f297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742794, "uuid": "73084c49-c8e3-4974-86e8-00edd4de494f", "value": "24576:2guQUdN+w0N6UDszMsvqkUibr+2eVtKLZyAeJxFRK3YyiVBdVict:vud+l6w4lCzibrjejAroxSohXdQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742794, "uuid": "4e909b60-b973-433b-8ab5-be8d2f69a65d", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742794, "uuid": "96f189ab-0e58-4f5a-8290-3cfb5fd39a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742794, "uuid": "a5b1f76e-f990-4697-b845-c891d4451035", "value": "new_order3223.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560e4462-0691-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770735670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735670, "uuid": "a30aa1cf-bf6e-4f10-9169-8ccdfeb76cc1", "comment": "Malware payload", "value": "6568733f34295f4e22e6ea46aad1c51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735670, "uuid": "76763e52-d2bf-4742-9257-32e0a866ff8a", "comment": "Malware payload", "value": "aad51aa7e0bca6aff7895fa8f83cc508972024761fdc8b9f7fdb8108b89bbef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735670, "uuid": "de396cdd-5c37-4f26-b015-472b82e40578", "comment": "Malware payload", "value": "79b1c2e146852b0323a92d41980a1679310b633c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735670, "uuid": "28a27951-73d0-47e8-aca4-02cfdab9afad", "comment": "Malware payload", "value": "2ef13738496af966cc67b7bfc6eea1d7d4495db375c0773f5428227ec31fc5de1c986a7635009598c3b66033c314d702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735670, "uuid": "bed9e77d-ae50-41eb-955a-c14b1fd06264", "value": "T18152A32A8A16EFF0196D3250A55FBC1A61520365FA34380C7D4FC4DD3F3AA24CBD54A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735670, "uuid": "403ed908-5e93-4891-ab3b-ec8cecd809e0", "value": "384:KTak2mxjaH6NrCiQt8r86Xbc0nuh68zZRt9Ts9:KTaQr0XHtTs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770735670, "uuid": "77d4e064-803a-4f53-a5c2-84c57539fa50", "value": 13442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770735670, "uuid": "f0f870dd-40d7-4fc8-afeb-1b4dec55eec2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735670, "uuid": "39cd8e02-1f0f-44bf-8bd5-bd193645bbf3", "value": "New Transfer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b54d22-067b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726268, "uuid": "1a225284-df22-424d-bda7-f6c7e81d6428", "comment": "Malware payload (Mirai)", "value": "ecc1dd86cbe7dd2c0875bd3671750579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726268, "uuid": "740e9e37-f0be-4124-8662-e3873cef5c64", "comment": "Malware payload (Mirai)", "value": "abd4498c89da7b41978e30dfb31056c84c67439c4cba3ecd85045c0e643216d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726268, "uuid": "888571b5-41cc-40ed-95db-ae86a4e95f70", "comment": "Malware payload (Mirai)", "value": "d18742eb76f56c804a236e1d5402f3fcac0e5261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726268, "uuid": "3e4cd167-b223-4503-99c5-210b89f3142d", "comment": "Malware payload (Mirai)", "value": "82d0092c74ea891c7f431f99ed9999786a6e559e45f33ee9c536114abb5534dab47c2dd80a7dab9612119aa8db51d459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726268, "uuid": "b75e0979-e7a3-4b6a-b36f-1e4a64892d7e", "value": "T1D8C39CD7F78704A1C4630AF007CB0B9E2E6362D14F5BD8E76C29A63E5A794DB0906BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726268, "uuid": "fda09a37-f5ad-45e1-b619-ac11f6efdabf", "value": "1536:94OKdPg9dZXWIYrHFKWIgm9mohlD8yVL2xarP3gI8h+/LWji:S/PmdR/YrldLmm2TVL73gI4+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726268, "uuid": "a39a3476-c295-4d0f-baba-e875b23b8783", "value": 124720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726268, "uuid": "79186f72-78af-4647-9bc5-7518f625769e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726268, "uuid": "ad9b1ebb-c946-4585-979d-38e99e2e04eb", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cb54c3-0667-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770717663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717663, "uuid": "da77843d-cae1-4d33-94e3-27984cb67213", "comment": "Malware payload (AgentTesla)", "value": "4eb494a7464dd783527581b28cadbebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717663, "uuid": "b1f45593-d898-4076-bf82-ce890c623fe4", "comment": "Malware payload (AgentTesla)", "value": "ac681a29bb85fecd8ba6e0f2977f7a1cc20f159023640a536fee08489bb00a77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717663, "uuid": "d544470d-5d40-4f75-98c1-09cdd873c5d8", "comment": "Malware payload (AgentTesla)", "value": "5560c418fa86f90143db9a83fcadd0ccd4d106c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717663, "uuid": "b8ae451f-e694-4657-9b4a-344a37e3e685", "comment": "Malware payload (AgentTesla)", "value": "6671b1d98f502a9a28f70f3aa12b2075f958af33c42a08e652960c294c6511caf32b261f6b9c81349b6c91a855842232", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717663, "uuid": "1c05ad4b-a8ee-4d41-979b-4f299cc6008f", "value": "T13E65A85DEA718613A9F374DB4B7821B0FC5A40520D02DF097816E8EFEB853B9590DA2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717663, "uuid": "2af28b40-837c-4e90-b33c-0493d64b0ae5", "value": "768:HKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK4:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717663, "uuid": "08b5e70b-95a3-4027-ac05-88a322af51ed", "value": 1486703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717663, "uuid": "3a61d8d2-3dde-4ccf-9d1d-936105750c24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717663, "uuid": "179e1dc3-fb34-43a0-99bf-8ba5c618fc47", "value": "INVGDT735-LAXTYE-FETWS78ST.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67173b66-069c-11f1-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1770740423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740423, "uuid": "785e37ad-35f8-44d5-a769-aa8cea44f736", "comment": "Malware payload (PureHVNC)", "value": "52ed58414c9385c1419d25ce8e7c7470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740423, "uuid": "cd9796ba-3cc7-4721-855f-b22e9edac8de", "comment": "Malware payload (PureHVNC)", "value": "acf2ccdc79812724088faba738e2c5c7e90f1a123a4f5768049598294386cb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740423, "uuid": "a0349a22-7a85-4536-8888-9ff252e7eaa7", "comment": "Malware payload (PureHVNC)", "value": "10347954b28abd70b310394568a9f866c572ce17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770740423, "uuid": "21fef784-a300-4813-b01a-e2690be639ed", "comment": "Malware payload (PureHVNC)", "value": "493ba57437d1dc31d2d16a4f18205d94ca8651bafa398bd2f0848e45d499fd237dff401217fa7039c67a157cc97156fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740423, "uuid": "295db2b8-7051-4686-95a2-dc960943ad9d", "value": "T1F7F4F10227E4CA5EEABE1775F4B11310A7B4E10B9422EB8A78CC15F96F53340A95277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740423, "uuid": "d96af486-1832-4c4f-803b-0b561bff7d9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740423, "uuid": "3de15223-4969-4c74-8598-d4542d0f2325", "value": "12288:kLUI0yJrs7AtQBOCp25oVz6SN6mCQX6ZpYJ/GwqI6H54lV29skR+FuHNK:83rgAtza+YQAqJH54lV29sZFuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770740423, "uuid": "0ed52f21-c06a-4898-92bc-07e4cdcc31be", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770740423, "uuid": "633a6e39-4697-49db-90bd-ad70b18f7bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770740423, "uuid": "33998e9b-9866-4749-ac72-1abcf23bb997", "value": "acf2ccdc79812724088faba738e2c5c7e90f1a123a4f5768049598294386cb6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a50cc64-0691-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770735624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735624, "uuid": "30e49f27-ded9-4e3a-964d-f8fa4975ede0", "comment": "Malware payload", "value": "492d873bf9d6415d3a053b9358a5be9f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735624, "uuid": "7c381953-8c24-480d-bfce-70fa4c989000", "comment": "Malware payload", "value": "af23efd5c37dee71341b906e283c4703aa3baa059678bee5bc055710d53825cf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735624, "uuid": "db02e1d8-a216-4db4-81d3-e8678ab5eadc", "comment": "Malware payload", "value": "4b84c2b6a6584cccafb12521c13bbf9976493627", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735624, "uuid": "71071664-9758-462c-ab37-ff55c33bd5f7", "comment": "Malware payload", "value": "3291b6819bd3a48c8b5a9b98846839951b418cb2a88d356c8fdb93afa0de97193b5c7a91548bf556f812d96d204c5272", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735624, "uuid": "888cc4be-0e92-448d-a2ed-d5ce08687476", "value": "T17C253343ACB2A00D57EABB5E094E54B9B0DE3D09FC76A10D7623745D6C903F3B2B4A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735624, "uuid": "c6c5611b-639c-4a1d-b4a8-69c6343afa11", "value": "24576:i02THd1PISvehKOoTD2KlxUT26O/AVbENtY6U5qEvs:b2j1gH/O/CbE8p5qE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770735624, "uuid": "da409b49-122b-470b-8576-618158520a90", "value": 1001293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770735624, "uuid": "53589f66-daed-4b81-a0bf-bdac87e6aa99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735624, "uuid": "325753a1-f54a-46b6-8c11-b2c242c39bf0", "value": "RFQ BS-00151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2360b46a-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770738592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738592, "uuid": "ce3c3855-0d93-47b5-af14-323f00ad6125", "comment": "Malware payload (NetSupport)", "value": "95c6515d88e9ea48a9b949a81c1dac4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738592, "uuid": "a8b8ede5-fe8f-4ec7-a837-88f543b24112", "comment": "Malware payload (NetSupport)", "value": "b17c3e4058aacdcc36b18858d128d6b3058e0ea607a4dc59eb95b18b7c6acc7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738592, "uuid": "d04b6012-71b5-4c24-b696-a5a9363eeed9", "comment": "Malware payload (NetSupport)", "value": "c93eeb4241f69fea44c4d8ccdde03f3b40a6be3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738592, "uuid": "6673c69c-55b2-4a38-9f5b-95cc409c66be", "comment": "Malware payload (NetSupport)", "value": "78b02f0e0b7b3d4437bef76d708605aebbadfbd845ef23abc4a55ced5ae146e878d9bd036a16c44c823e1e421ff94542", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mysrvcs-com", "colour": "#2728B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738592, "uuid": "39947742-bab0-4065-85da-cced73d7778f", "value": "T164357D15F7F1C074CA8E45308A2CABF550F9E71ACA20A8C76780FF6E6F318D5D229959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738592, "uuid": "aec7bd1d-fbf2-4098-8f67-7174f77f0da1", "value": "622eae4411b119bf4ca7bee4fa1391c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738592, "uuid": "d686646a-f4d6-4bf0-a6ae-2f5ec5cf90ca", "value": "24576:Jx6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtNxn:JxBOp1B07sjsPEtd2znPrnIwuh0Nxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738592, "uuid": "6e209704-3be6-41c9-8790-cc1aa8d47fe4", "value": 1151864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738592, "uuid": "c9cd1d70-f9eb-4895-bd78-7f8de29b6257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738592, "uuid": "281b97c0-993d-48a9-9166-881ffbb90e43", "value": "7z.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84baf5a1-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770742621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742621, "uuid": "f8f218c7-deb6-456b-b524-bf774f2d15a1", "comment": "Malware payload (Mirai)", "value": "d30be702b12789c565516d56180f86df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742621, "uuid": "017f15a0-5d67-4caa-9993-355c5b246304", "comment": "Malware payload (Mirai)", "value": "b2e135b74bb7a4e317938333e5e56c8c71cb4d5ab861a90b784ce0b3817fe12d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742621, "uuid": "56d48f49-34a0-4bb5-b7d4-bc87b678dc68", "comment": "Malware payload (Mirai)", "value": "5894dd0ce714f004dda433a68ace86cc3b44b9f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742621, "uuid": "7d6a1ef1-37b5-4986-95f7-2828b703e1cc", "comment": "Malware payload (Mirai)", "value": "f5b7ef3f74575d7c9bddd6fe4d6ece288c20b222aaff26975c2b345bce249d0ebe4313052249b7d4520675d875b2bde9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742621, "uuid": "6d0a294b-daff-401e-814c-95c19fe7fadb", "value": "T1B1C2E16350FACE03C8B3837B2A3D59A622605435A34EED2D77794BC933464D4697ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742621, "uuid": "a5f5feea-2901-4886-a907-b4fb215f2668", "value": "768:w5+Kcrb9VDJee2KTgdTHOBcK5ZCAyIFgZ:Plrb9veKTg9QB5VnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742621, "uuid": "366fd7c6-695f-471a-ae3f-2d55637312f8", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742621, "uuid": "b5fef8d6-c370-4821-abff-27955c94f5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742621, "uuid": "16631c5b-e93c-4508-954a-519def8eed54", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287640b3-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712401, "uuid": "b47106ea-4cfc-4f79-b6a1-4e83fbab58cc", "comment": "Malware payload", "value": "2f2c0eed27cf3821e09cdf1d9cac8360", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712401, "uuid": "ff00dc8f-f726-4cf9-aad2-157ce2d5acf6", "comment": "Malware payload", "value": "b55797af372f51d0a6d925785341bf25a06c9ecc1afafd8955d8105deabc3acb", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712401, "uuid": "3bdc5cd9-3509-40da-b0bf-f16c04598d61", "comment": "Malware payload", "value": "7d8e14699b7b25d66c9a51a3e6047e83d0c34ccc", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712401, "uuid": "0ddfcaab-b1ac-49c9-98fe-4d59600d3994", "comment": "Malware payload", "value": "64e53a89791268f38ca31cce632f78cf59da32343a2ce71aaa44f93666d1f074b0b6b241566a2c5b1d7f10fb5fd6c2d2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712401, "uuid": "f8da9331-cf31-496a-be74-4161a46dabe3", "value": "T1A7C46B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712401, "uuid": "a052e3c2-95bb-4269-a7a2-7fc71a2a7d9c", "value": "12288:hBBC+ktPksN4pBBC+ktPksN4HBBC+ktPksN4aBBC+ktPksN4VBBC+ktPksN4A:hEZSpEZSHEZSaEZSVEZSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712401, "uuid": "ff9aa7a7-a75c-4913-b287-8471b2b89547", "value": 592036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712401, "uuid": "102e7c15-2c00-4f32-b89b-371125625821", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712401, "uuid": "668fe68f-ee01-4584-9578-005214ea83c8", "value": "b55797af372f51d0a6d925785341bf25a06c9ecc1afafd8955d8105deabc3acb.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59217ce2-06bb-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770753714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753714, "uuid": "638dc97e-16fd-4535-bf35-f827c81108d5", "comment": "Malware payload (RemcosRAT)", "value": "30320bf867884527fe2d08d60044bb40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753714, "uuid": "903f57eb-811f-4603-8a8e-90097bba8b3e", "comment": "Malware payload (RemcosRAT)", "value": "b55ed683d48639ae08887b60950e2e06606e6df3f5bc0873698a52ccfff067ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753714, "uuid": "57f1886d-044b-4838-80b4-d7430ef16327", "comment": "Malware payload (RemcosRAT)", "value": "95d3a7f3a31fb417778a255a7ab6874ab5d98d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753714, "uuid": "d7918731-720f-47ed-a31d-99d6e7cc5be4", "comment": "Malware payload (RemcosRAT)", "value": "c5187b5eefc7b94af7c1c341b5b5d11f9c2e1cb53e964c6c6f453f8b1c1c9110d863ff696cfce1a8d02250b4291cffde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753714, "uuid": "6122ba90-6201-4846-9630-b2d0a8961a8e", "value": "T15EB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753714, "uuid": "f87d0e5a-fede-4119-829c-6dd13d5fc960", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753714, "uuid": "f88b1fe4-9eae-416f-86e6-8d9be33021d8", "value": "12288:a6pxxGI8gvGOHJpAbDYGxLhZ+sPZt7mPFNZ:a6pxxx8U+bDYGxLhZtZkPF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753714, "uuid": "6fafadd2-bddc-4ea2-b5d8-5c8af5f91574", "value": 504636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753714, "uuid": "103ffab6-aa50-43bc-8612-5ef4b7b6eee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753714, "uuid": "c3603677-2efe-421d-a4f8-74870345268a", "value": "b55ed683d48639ae08887b60950e2e06606e6df3f5bc0873698a52ccfff067ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5b30c0-0618-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770683658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683658, "uuid": "8b4c1ab0-17ae-4d70-969f-f1e919912bfb", "comment": "Malware payload", "value": "5c9cb47508eddfa15305239f1918a178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683658, "uuid": "43fb8b17-15f9-4637-99f5-b885a4ea6cdf", "comment": "Malware payload", "value": "ba2db6919b4e9ec94f7abf61b8d5382375f980e1067c05222aee994f3a4cb6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683658, "uuid": "34a48ef9-93bb-4bdc-9de0-c8ec63654665", "comment": "Malware payload", "value": "e47b938d3c5e9a57dddfcdcf043333c2d5841980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770683658, "uuid": "c43f2efb-9726-4d9b-a557-7d086bd7fffa", "comment": "Malware payload", "value": "58e3b67770e5654b9d01d2d2869d7846684d0db11a9e213a2975d512994dab7ad6a01c26617d99b1ef42f51352cb9c9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683658, "uuid": "09b756f7-1573-4e47-9ad9-49b304495b7a", "value": "T190E4232D822AD966BB9C24F536ACD27A3133F78B594EFF4165F0E504BB4303571093AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683658, "uuid": "ef784f62-b611-41b7-a4b0-eb607044b1c2", "value": "12288:oYkiQprdFz4/PzSupPF32i/LYD8mBdILKF90xlEZ0DJ1JglIxqFzi:RzOnel5KDZdILKFKxcKJ1ayxqFzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770683658, "uuid": "4989e580-aa84-4122-b7d0-0d374c8ee49e", "value": 661819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770683658, "uuid": "b0b48fe1-7aaf-4c10-a190-c4dab1b60f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770683658, "uuid": "3f71a56c-4c9b-46e4-bfe1-a973ca41f31c", "value": "bizy.mipss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d19ff4-066d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770720215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720215, "uuid": "3163c801-b76c-48c2-a9ef-d582bff20cf8", "comment": "Malware payload", "value": "bc1795ac55eee5f68ae989f4264bcd2a", "object_relation": "md5", "Tag": [ { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720215, "uuid": "ba0fa5b4-ac47-4386-8a0e-cc253191f434", "comment": "Malware payload", "value": "bdb465b61d15e6596cfabcc1dc5eca4a988b832adefa5fccb275464ff2ef2a44", "object_relation": "sha256", "Tag": [ { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720215, "uuid": "18c15cf8-3485-4e6f-9cb0-8a87f5482d3e", "comment": "Malware payload", "value": "4a27f7cc20f358febfc1288b20886b998c632626", "object_relation": "sha1", "Tag": [ { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770720215, "uuid": "ac6e7c25-5c79-4f57-a6a9-dcd9d0a01eb0", "comment": "Malware payload", "value": "2141c666864b77d14d0f4309c698d0cf145c23c55d57687309ee073f00dda38d494c25eef004da75ed565e5b0edf5114", "object_relation": "sha3-384", "Tag": [ { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720215, "uuid": "c5c9c054-53ac-4ad8-9aed-038637dd236d", "value": "T141063305E9C3E015FB6F42B62DC5E917CE2CF58A329897FD1C1E895C46EBC60DB1A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720215, "uuid": "460fc574-057b-4799-96a4-bc2c1fb58540", "value": "98304:CsIwqJJE5JgriIYCL0cG7ZItuZwha/93ghsLONPVxLeW:Cs4Ju5Jgrz1IPatuUi9Q1zLeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770720215, "uuid": "248f559f-2bd9-4288-ab69-97e8399fb275", "value": 3856968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770720215, "uuid": "ee9a30a5-6992-410b-b0d7-3f2f37af8e9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770720215, "uuid": "a1a6a45d-cd75-4113-bde7-52fe4a332a06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910d31d9-0667-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770717731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717731, "uuid": "1e4995bd-d017-4d2e-94f6-59cb2301829a", "comment": "Malware payload (RemcosRAT)", "value": "7fd1201f346f7ceccbc8c76fe4729d3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717731, "uuid": "94e657dd-cc4f-4d73-95de-e60de5be737f", "comment": "Malware payload (RemcosRAT)", "value": "be16ae0a2656d0e363c9094cf0ed3f2732b7c398c941c5d4a05944db59974d70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717731, "uuid": "6997d01e-cf1e-4078-a61f-30046595de8a", "comment": "Malware payload (RemcosRAT)", "value": "bc316b1bb6974e2ee037c3b337ba2b1c6b55fc32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717731, "uuid": "6d994988-758b-4e17-b92b-cde65ecca204", "comment": "Malware payload (RemcosRAT)", "value": "39d86078c455bcd0fdf94d6ac1493be14dedc11268bcffdb920423be7b8f08feb43d96171a0af068188cc142b1c6a751", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717731, "uuid": "35ddad52-89b0-4cf9-945f-43af7870580f", "value": "T19355063EE45AACC4DE9D8BD70C06ACD4DD39DBAC346A1909A71DE6DEF40305A334982D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717731, "uuid": "1063918e-4920-470c-9420-2353a151e7cd", "value": "384:kaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaM:Pr8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717731, "uuid": "6e55425d-4c67-4e81-a652-bed1e1ef05ad", "value": 1296120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717731, "uuid": "767a0853-2659-45dd-ba79-471793fe9d18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717731, "uuid": "4410bb00-1e77-4cf2-8aa2-edd7ee938929", "value": "POPTASL26-02-0130H 1410141114121413.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45e428a-061b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770685121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685121, "uuid": "aab36356-6dc4-4b00-9f79-d382d41dc0f0", "comment": "Malware payload", "value": "a9e53d1189194c3ff21f6765e7313fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685121, "uuid": "a1533396-9b0d-4b2b-a407-91bb1dc6d6ad", "comment": "Malware payload", "value": "bea34d0c06cfdac15cf00a6caa1d7a445928f61f2093eaa90228f1dd276fc017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685121, "uuid": "a38e98b0-9460-4afd-9bad-7ff3a033cb94", "comment": "Malware payload", "value": "6bf28e063063d7fc70053ebcfe9e83c484252e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770685121, "uuid": "dece86e7-535f-41e9-b42b-7ec194399ea6", "comment": "Malware payload", "value": "b8d2d4020a2dfeef8ec319228e815faf1f00e3451804178789ebfe21225ddff6720af03bcc5b14fa6978a806e497e094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685121, "uuid": "7784f1af-448d-4b6d-bbda-9920cd529c48", "value": "T17D0533854ACA52B7FD8DC53CDF700FCABC2946B0411A94A858F9502CC7FAE5B825B5B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685121, "uuid": "6d076caf-24ec-47b1-93a7-c255058f0de3", "value": "24576:aLmIzLYN9ElKKlKkqJPlhkYrKfTaZECd1uGMp:aDoAKKK2LQd1uGMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770685121, "uuid": "2c66e79b-3a23-4e17-bc92-57395700d519", "value": 822827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770685121, "uuid": "ea178eba-c9ce-4565-a642-dc8a121c45b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770685121, "uuid": "d1ac559d-fc09-4831-b3b8-819c461716d2", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d96b1e-064b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770705850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705850, "uuid": "8bb8b346-c290-4432-a5aa-56ed4594331a", "comment": "Malware payload (AsyncRAT)", "value": "96402070cd36193581b62406061eef95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705850, "uuid": "184e8c31-3bb0-40e0-a95b-a7140e1ddd23", "comment": "Malware payload (AsyncRAT)", "value": "bf5a9eec2378c0fdfeeb0ffecc7d173ff5b363d594421ef714dcb82ac284620a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705850, "uuid": "451d138c-7b5c-496d-bd5f-1f88b3076857", "comment": "Malware payload (AsyncRAT)", "value": "aeec68bbcdde914f8cad502f0a80f67c23824d47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770705850, "uuid": "967e83e5-5a35-4248-94a5-6219fdeaec61", "comment": "Malware payload (AsyncRAT)", "value": "4b435acf28b9625e63f1ec673832ddaf82b8d5f0885b437137ede93ef764a3503554be7bcefc4c13657800cc1dca15a9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705850, "uuid": "0276e752-c8bc-4e02-889a-40c4bdfb92d9", "value": "T1D6D23A08B3D48561E1FD57B94D7292048775EE4BA973DBAE1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705850, "uuid": "3aff29a3-0bed-4da9-867d-f0fac086c528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705850, "uuid": "1a2c1930-9db0-41ac-a931-95779d2eba8b", "value": "768:owwbRXxZb2uSEg/cIRGqo2/Rb7fB/dT9SX/+:obbRXvb2uSV1iIRbN/+X/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770705850, "uuid": "828c75cc-f39b-48f6-9b42-bfc1188fbe4a", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770705850, "uuid": "cacb854b-ec50-495b-838c-cc1f9362fc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770705850, "uuid": "530edf4e-b66f-48b2-b77c-4cbf324dbe65", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4a36a1-0661-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770715097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715097, "uuid": "c68e71b8-70ba-43a2-a76e-2bd11ce3d2c8", "comment": "Malware payload", "value": "5c875e4ecf5d76be225ad9af22682ac5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715097, "uuid": "f644de5f-b912-4c42-ba57-d79216074dc1", "comment": "Malware payload", "value": "c02a43eeda0f83df11f4610ecb75f8f10a10652d67151356fbba3891859849a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715097, "uuid": "88afe12d-60a0-4a94-81f5-7a167a8af832", "comment": "Malware payload", "value": "72bcc176bfeb25ed34baecd9eac73e9f57b2db6c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715097, "uuid": "02006dbd-0c80-447d-9e67-5da42071f8ee", "comment": "Malware payload", "value": "502113e0a3a182849d44a85a26d8699842c42290ebe212047ba31afa11071304ccd8edb04071e0abb1c0348123aab290", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715097, "uuid": "8bbae2f0-88be-47a5-a332-231982a5bcae", "value": "T1B931EA195F121079F4BF1BBDC0B5238611ED2D6E9ABF2094492E201D0D1B689F98FC18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715097, "uuid": "10ec679e-9878-4168-8a87-7ddf1803155d", "value": "48:9IqTTNp1iGlD5+Pz+Ds8fVDFLBerttLg2meNA4BFDQ:tTBpIGlMaw8NDT6ttM+7bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770715097, "uuid": "561a6022-d716-438b-a604-18ab6fdb67c9", "value": 1667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770715097, "uuid": "4915c9f5-b566-4ef3-a4d2-2b488ac5657e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715097, "uuid": "3b6cfc09-ad30-434f-9909-1960900bba4e", "value": "eStatement_PNC_02_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08678373-0632-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770694738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694738, "uuid": "76fb4100-8fa1-4c62-89c7-c106a94e1bbf", "comment": "Malware payload", "value": "fee111bdad1672494e36ae401a0f7e61", "object_relation": "md5", "Tag": [ { "name": "110-92-64-177", "colour": "#F15C82", "exportable": true, "hide_tag": false }, { "name": "ChinaNexus", "colour": "#1E1CEA", "exportable": true, "hide_tag": false }, { "name": "DKnife", "colour": "#7C1A4E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694738, "uuid": "6c36e8c8-7b75-4a36-acc0-01451741d787", "comment": "Malware payload", "value": "c0fbbdec744b46df7ea9ad638b016e1d6ef6554046eabfd75cbd17a9cbe4424b", "object_relation": "sha256", "Tag": [ { "name": "110-92-64-177", "colour": "#F15C82", "exportable": true, "hide_tag": false }, { "name": "ChinaNexus", "colour": "#1E1CEA", "exportable": true, "hide_tag": false }, { "name": "DKnife", "colour": "#7C1A4E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694738, "uuid": "a2532f65-398a-40a7-aa88-8779d34084f5", "comment": "Malware payload", "value": "88eabaacf247fbb7495139bd93eedcbf15885768", "object_relation": "sha1", "Tag": [ { "name": "110-92-64-177", "colour": "#F15C82", "exportable": true, "hide_tag": false }, { "name": "ChinaNexus", "colour": "#1E1CEA", "exportable": true, "hide_tag": false }, { "name": "DKnife", "colour": "#7C1A4E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770694738, "uuid": "dc190cf9-344b-4802-a530-64649836d059", "comment": "Malware payload", "value": "700d9fa0540c04d331d8ae44d30abff3d4da720edebaef00ebf797f0e6f80ab846e8530aa69802b984a785ccb77b9cb8", "object_relation": "sha3-384", "Tag": [ { "name": "110-92-64-177", "colour": "#F15C82", "exportable": true, "hide_tag": false }, { "name": "ChinaNexus", "colour": "#1E1CEA", "exportable": true, "hide_tag": false }, { "name": "DKnife", "colour": "#7C1A4E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694738, "uuid": "0e379b6c-1dfc-4591-9026-eeb922126474", "value": "T16A96333DF4BECD242B77E3711B246005A5B1E0A48038FABCAC975EE75129DB289D8753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694738, "uuid": "3ac7b557-6e15-4180-84d1-e22dd07f575f", "value": "196608:uq9iUSF0PW602H9u3xTjGOlmwWm7eItkk:6eW6/92RGOE7Grtkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770694738, "uuid": "be413109-9be3-493b-ba38-6527a5afbdc9", "value": 8725525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770694738, "uuid": "9d5c0202-08f7-4cfd-a125-939e5ba55b9d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770694738, "uuid": "8c10001a-816e-4af8-b992-9925e1e88440", "value": "bin.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7c17dd-06a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770742713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742713, "uuid": "e1bd9ab7-5b6f-4469-ac7a-d9cd0c345294", "comment": "Malware payload", "value": "1ee68d5ffb3c57d3c4ef3a4e40a0e581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742713, "uuid": "c64fef58-d8cd-452f-8243-00e83cbaa606", "comment": "Malware payload", "value": "c20aff27123c081640839c0e1e3663f4e2cb25c3d5a697aae68f416e6e7e350c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742713, "uuid": "0e37b7df-7d93-4e25-9477-723368ac987b", "comment": "Malware payload", "value": "54f762bc45be546ad90509829cb5e13fb5cc06c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742713, "uuid": "cc2cf7fb-9fcb-4e34-b39e-43a0e1eca906", "comment": "Malware payload", "value": "e778922bd1cf480fd1b6d4fe031723d9fcf8884fcca6913f5f81ccb59e5b1d881a5091399a315e07534d0728d2c2376e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742713, "uuid": "721f890d-4aa1-469e-8394-b591c684e208", "value": "T12853B8D8FFC2B2240682B5732CAF50A6E96F5DC4390CA005C39F7E59BA6471CD83965E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742713, "uuid": "6f230c33-7265-40d3-9bad-97082fbb0ae1", "value": "1536:wEtusq9AlUfwI1x0TXzdGv5XAXcQo+TBj//TrxE:WsBUw0xYJGVA1Bj//nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742713, "uuid": "614ea68e-e5bf-46c4-9ee4-04662222b5c6", "value": 62200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742713, "uuid": "8f705769-7fab-463f-b013-bbbac91535c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742713, "uuid": "d04bf245-ff98-43a3-8fb3-f067d4346c2f", "value": "RFQ 126-28-1 Bfly vlvs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5999ff-061a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770684460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684460, "uuid": "ae4f7ef1-c32e-4baa-8f86-5c867fff5298", "comment": "Malware payload", "value": "c52f75b73a7dcb2a3e9d131a1d6b6f2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684460, "uuid": "f3cb46f8-92ca-45ea-9d68-d99c24bd48a3", "comment": "Malware payload", "value": "c2a3aa031e3f9cf7950c20754192f9b8a698f6ddb451868a60a774ef8e11f0e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684460, "uuid": "da67d2cf-551c-423a-a5b8-dd76ace143f5", "comment": "Malware payload", "value": "460684b2a18119fa38dc1d5b03bf69307cc63508", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770684460, "uuid": "876e48d0-bcde-4a86-b027-bce0b7fa7e3f", "comment": "Malware payload", "value": "e25e2d0c0c8805f1afc75b9ced19982634b7f049773c98e83b3f94ac039b9890e91dc63b88911f6c5ea170e6225a1deb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684460, "uuid": "ca5a157c-f4e4-427c-8352-96033e5b3894", "value": "T16F15CF2BF9A160ACE06BC07447DE86B3EB33F86916217B5B27D08B312E38D51971D752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684460, "uuid": "55e82c5b-4466-4243-b7eb-a84ed50aaad0", "value": "12288:fWED0nUUCwlBBi0dAqWpNzTrUiGkUwoCZEooWLvnssihfflGRlyTW:fWED0nUUfDrdAqgTYWLtxnmfRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770684460, "uuid": "52e5fb7f-301a-4716-9b49-3c791613b316", "value": 939237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770684460, "uuid": "721c8681-e477-4564-8f33-4ca5d383d459", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770684460, "uuid": "087de464-ec6d-4f70-90ce-be79308cf983", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5ebed9-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770707926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707926, "uuid": "2f75c821-b252-49cc-a8d1-ce38115b38b9", "comment": "Malware payload (Formbook)", "value": "1af1be9aec8d0d1b65cf509bfa30161b", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707926, "uuid": "fa03a1c5-4a07-4a8d-adf8-0ff2a1900a32", "comment": "Malware payload (Formbook)", "value": "c2de23f426bd4624fb32804f61f8d943d2f0849e8dbf8385ebbe47db378f2a1f", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707926, "uuid": "c8f32094-9f37-4015-9e37-8d39a013e8a9", "comment": "Malware payload (Formbook)", "value": "ea5c9ce85bff4a3c263161a9e199339f29d29abb", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707926, "uuid": "1af12768-d09d-4a48-8c5c-5cfad66f8b61", "comment": "Malware payload (Formbook)", "value": "c6df726f62eaac3f7dd9dcc9c102c908ca22f5aa07beadc4a474f54c4d4fe617831dd3977ef1468e7c11891bdee14b7b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707926, "uuid": "437c0211-c4b8-4cd9-be25-f8e3ba1548e3", "value": "T1B056AFB14B7229C29E8BBA56F732CC4623A432F21551EA4B5FB5BD24BD0849E47C0D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707926, "uuid": "5d854c92-1192-408a-80eb-63831a1a5f6f", "value": "49152:+x38Eer9mNiqq2DPgv50FAXmFFM3MA/oe/PILwenB+BSxzWAbzpISNK0yIlxQ:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770707926, "uuid": "96146dd1-1ffb-4ab3-9fe1-ba0cc30e1f30", "value": 6167055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770707926, "uuid": "edacf3fc-6a55-4dd8-86c9-fe785988d5e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707926, "uuid": "e517741d-842f-40c9-931a-3eef2e740d44", "value": "Specification sheet.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77739b06-0686-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770731002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731002, "uuid": "aeedb85d-3d03-4376-befc-7a80dab95f71", "comment": "Malware payload (Gh0stRAT)", "value": "1561136d0f3bfcad251f1baf2ca42718", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731002, "uuid": "d7d4d9d2-c6bc-4aa1-96aa-98d48d635612", "comment": "Malware payload (Gh0stRAT)", "value": "c3232c7f77a8d126c696e362d943f07b714950e1012b38b3eb77982c5e2a06b5", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731002, "uuid": "27d82378-4e75-401c-9adb-af521e679e51", "comment": "Malware payload (Gh0stRAT)", "value": "c1c4b90b93aa6c8c3f0c840250f2e2f9023ac453", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770731002, "uuid": "86a877e4-4068-4cd9-ab0f-b2c6fd6af723", "comment": "Malware payload (Gh0stRAT)", "value": "ef1115ad020508789d275dea0d55a764ff038fb6feeaecb7472150558f7b3a62a235d9094d9ee5c33762c73ae859c663", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731002, "uuid": "e0041d73-5fb5-4a0d-9e1a-c210e657547a", "value": "T1AF273313A28B253FF47D4E3A89B3E216583B7B6239028C67A7F4485CDE121D52D3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731002, "uuid": "29e6c249-e039-470a-861d-37060eeef66c", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731002, "uuid": "cfb06c5f-bd72-4390-abdd-b2d312fac787", "value": "393216:3ZvqLv+Ie71+adtYJ5gngtdZ7obVYhEhYsEsSjG8oCi4ErIkcaSmDKxEA0CUB:J0v+IOrQngMdZaVYhKws8oCi4qpK8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770731002, "uuid": "55a931cc-4a05-4d22-9e78-b580747a3218", "value": 21770420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770731002, "uuid": "a33e23e8-27ee-4d00-8fe9-c0afb3450a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770731002, "uuid": "3ee8304d-9bb2-4a85-a01c-ef6c04761d84", "value": "cloudflared_installer2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122326d8-06b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770748871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748871, "uuid": "763df633-e218-42a4-a14a-fbff8fde2ee1", "comment": "Malware payload", "value": "6a76e8102e57620cde0012001e3f47cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748871, "uuid": "ca012d1d-250b-4601-bf31-d190b4664de7", "comment": "Malware payload", "value": "c4d2a5075cbbfbe594ef5ef4fb5536098decf690c21e74b8d43b3faabeb9fa25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748871, "uuid": "0193b0e7-d485-47f4-ae02-dc197db41a16", "comment": "Malware payload", "value": "260eff118b3bc73def5017a01ea2c91dd1864580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770748871, "uuid": "e470193c-74e0-4c2b-9cf4-c4f3597ef814", "comment": "Malware payload", "value": "ef2ec1a6a459077229ee9d4acefbc8ef36025fbca0b0d6ae353c5d7218fc079f71bf7c8d292439701df578d046ef4472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748871, "uuid": "23e0c5f0-ab02-4c42-bb0e-2d3d0e2b0087", "value": "T1987533DD9B385A3E8757107ACABA0F4C8911E208A7A2FF0AE0474BD7E4151366F345ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748871, "uuid": "9fad71d6-eafa-4637-b548-d10384d0baa4", "value": "24576:f+MDrrwfvTZxcPnHe8DV2NPPpH7IifRJS38Us6wTrCGRK0CdHJvavq7LctXFKyId:2Btx8nH1WpH7bcIFE8wAXFKyIpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770748871, "uuid": "6e1df3b3-4046-4c43-b23f-87d6e538e216", "value": 1560177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770748871, "uuid": "59ef822f-ab5d-4a95-a7be-82f0cadd3e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770748871, "uuid": "14085905-67ad-47a3-b6ce-ebb194fc160c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e6e349-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712392, "uuid": "644d1e07-fa03-4329-b8e6-0b8315451766", "comment": "Malware payload", "value": "50817c087f9f83ce3f766bde17511154", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712392, "uuid": "e767a31c-c451-4a61-9c07-42981b6e3a58", "comment": "Malware payload", "value": "c832d4745c248d82d36ab6e41fee14002e69982aecc9b259783fb9df68e6e76d", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712392, "uuid": "0f1e0720-57ff-4c74-9630-71b1345cc0fc", "comment": "Malware payload", "value": "899df7008400f1816dd8d5a290a9b05d0526dd5b", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712392, "uuid": "446b17c6-f518-4cbb-921d-f39393e4d713", "comment": "Malware payload", "value": "51e0d201b7888b9e40b8649af7d4df9d89f25d81ad49b6bf46989dd182e635d1a91017e22c3fe02d5c1a37baa01bb5fd", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712392, "uuid": "c74c25ed-d91f-45e7-a6cf-5effb3869765", "value": "T123C46B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712392, "uuid": "f2d37720-17ec-49bf-94af-9afa4ec83d54", "value": "12288:zBBC+ktPksN4FBBC+ktPksN4fBBC+ktPksN46BBC+ktPksN42BBC+ktPksN4M:zEZSFEZSfEZS6EZS2EZSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712392, "uuid": "b268b9cf-21dc-4606-be73-01958145ee5b", "value": 590426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712392, "uuid": "97150b58-85ed-4e0d-9226-8a46330ff14d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712392, "uuid": "28a92a73-ddf3-4371-83ff-d7d5132a3697", "value": "c832d4745c248d82d36ab6e41fee14002e69982aecc9b259783fb9df68e6e76d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b509b3-0651-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708103, "uuid": "f1ee9378-49b0-4ae7-a10e-46dca95ee6a7", "comment": "Malware payload (Mirai)", "value": "b0efc3ff4c38fbbab5ef375d5844fc98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708103, "uuid": "b95a764b-486e-44a1-954f-d3252d6fd68d", "comment": "Malware payload (Mirai)", "value": "c99c1639ae7a9ac3df623430759e25a8673f9e999b79f98709f00c5725383d15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708103, "uuid": "a3b37a2e-3dfb-4ba9-95ad-857628636cd0", "comment": "Malware payload (Mirai)", "value": "7bf21491a46fae749340928c5e2ddb64fbaf256a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708103, "uuid": "caac64f9-f779-4be1-93fc-ab9963b6245c", "comment": "Malware payload (Mirai)", "value": "baf6081a85f351785cbdbb70b677499da6209803ee428e0e87b9b00dbfa3479e6b95b3da95483f8ff233d5225ab1dae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708103, "uuid": "af02bac8-c28a-40ec-b866-ca9f44dbcd63", "value": "T1DCC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708103, "uuid": "13938f33-8aa6-41e1-b379-dd9a340950c0", "value": "1536:6oB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dsJ:6KB4exMF7oZKJnCNYaKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708103, "uuid": "664a06fb-a0ee-4156-a804-9c3e830865f3", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708103, "uuid": "19ff5474-6487-44e3-a455-eed6d75d15d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708103, "uuid": "5c2863d4-09d4-46ae-b9ef-e5f031c769f5", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178698d2-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712373, "uuid": "8c532ff8-1552-425c-b1bf-62e17307d3a2", "comment": "Malware payload", "value": "3407622614d26b14924d46428129679f", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712373, "uuid": "d3215104-c358-4442-9709-4f990052817f", "comment": "Malware payload", "value": "cb1193f14e7ad9f2686b099d11d71184aa7a904a8d81e1913cacc56843c700d9", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712373, "uuid": "55a887c2-e941-4905-8bb8-6d2c1445ea0e", "comment": "Malware payload", "value": "10d82134edd9221086164ea693f929597c878f63", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712373, "uuid": "29a23578-5e52-49b9-b79f-356ae457c734", "comment": "Malware payload", "value": "037d7fbe5833ade00e987b1c06706909d808e74b836553209e33a1804821c5790f537415f91e44fff48456f3a9923252", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712373, "uuid": "9fdffc76-e156-481a-807e-8fc8911efc65", "value": "T142B35A4763A500BBE1378678C9634E45E776B8110764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712373, "uuid": "f9e2880c-500a-40fd-bf58-e110d7a7f7da", "value": "3072:lSBxswjBC+kOsZpb42Qriks17Y4Rr80OkprzyX:og+BC+kjZlqiksNYEdzyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712373, "uuid": "484d5fe4-d2d8-4517-b502-bd9d3530582e", "value": 112370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712373, "uuid": "c5be65e1-1d85-40ed-8554-632df24c9cdb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712373, "uuid": "919be1bb-d3d4-4a1c-842d-e81525c23964", "value": "cb1193f14e7ad9f2686b099d11d71184aa7a904a8d81e1913cacc56843c700d9.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77f6762-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743189, "uuid": "d49133bc-2ad3-4dff-8d69-f70a629c2608", "comment": "Malware payload (Mirai)", "value": "24cc1573945a49aae4d452d20b99e174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743189, "uuid": "fc1347a5-6220-40f4-bc81-20e52255a05d", "comment": "Malware payload (Mirai)", "value": "cb5e5df2123ab0696f1fd9da637e118425573d70f0ebc5f114611fa18be8d5aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743189, "uuid": "7eba0fa7-7cd0-42ea-9238-7a7f18ebd958", "comment": "Malware payload (Mirai)", "value": "8a9e3e1015089dc5b2e232ca9f9dc2d4f408fb36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743189, "uuid": "bdbaf387-032b-459f-93c2-f630e0a3c466", "comment": "Malware payload (Mirai)", "value": "9e83865ba616fa2658b3e0c1832f5dc5dcb156970e0e06f0192af5d983604e3e96dd10844a57588da2a4a638516d9f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743189, "uuid": "ef21066d-33b7-4e91-bd8f-2447deeac6f5", "value": "T1AE534C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743189, "uuid": "366096ea-2e81-4a0b-a242-e69e16e65118", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6igs:BET6Rq1gSmQ+LzDIiEbW/ogI9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743189, "uuid": "90907a5a-dc9f-4bf1-944b-38c58bfdedf4", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743189, "uuid": "349dd623-4871-4516-84a3-5a606c8b6841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743189, "uuid": "8384d280-6162-4f92-aa97-faab53d57a14", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb38f8c-0691-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770735739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735739, "uuid": "b599bc52-9d3f-4c06-951a-0579112cf147", "comment": "Malware payload (Formbook)", "value": "4b839744f3da36cf3b8c629df940038e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735739, "uuid": "40b3e2b5-f4e4-468b-8f16-a618c77bc3ce", "comment": "Malware payload (Formbook)", "value": "cb6107c4531b230c31244db28ca307058384a7ae968e0f0e41991f35a77b2e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735739, "uuid": "79074ef0-e5e5-410c-a8e9-ee7e9db49ea0", "comment": "Malware payload (Formbook)", "value": "00a602284372a484294dd60c1f635f9f83cbb814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770735739, "uuid": "db7b9fae-a396-4407-8d9c-693e0670586e", "comment": "Malware payload (Formbook)", "value": "13aa30976f1424246ac60fbc1560b439eb34f0e3bddab3451cca8cd9252d30295bf162cb000e79b6098d4b38bf0e42f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735739, "uuid": "2d1787c2-a8c4-4ccb-83af-b5a96a28fdf3", "value": "T18F3512303799CF65C8B527FA6930E27927B56C6F6512C30ACEE65CEF74AAB015420723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735739, "uuid": "ea38c2cb-882c-4a3a-b3c8-5f50edd9c876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735739, "uuid": "d2ce2f39-45c0-42e2-a69c-4a11a3a5843b", "value": "24576:tj/guQO5Wo5jMbJs7vbPaa2THij4viL3ZvTtT6PjZidtVict:aul1MbJsrs2j4virFTIPqtQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770735739, "uuid": "4f7de610-cd64-47ef-a1fc-1a1c197dbbdf", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770735739, "uuid": "9f9b5703-26b9-4913-b58c-7b5cd2a92dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770735739, "uuid": "53f23c6e-f1a3-4a22-addd-d14f41fbdc39", "value": "YAxzE128nxjJBmq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0abe695-065e-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770713918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713918, "uuid": "59e59190-a943-47ab-b65d-89452b665982", "comment": "Malware payload (AsyncRAT)", "value": "911c4f875b67eb248eb32b3eb4546343", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713918, "uuid": "deecd000-9bea-44c1-b562-7c7fd65b090a", "comment": "Malware payload (AsyncRAT)", "value": "cc8201c2bd34108853bf7528346b13333bb60050c63fac6e1f696e372262814f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713918, "uuid": "5bfb851e-a15e-4af6-8cb0-6df081a9cb61", "comment": "Malware payload (AsyncRAT)", "value": "8b0d6dda5a30c2709f87b07bc22fcb20d4555a19", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713918, "uuid": "b9eb2a2d-a85b-4218-b704-65f6be09ce80", "comment": "Malware payload (AsyncRAT)", "value": "773e47e43d055487c1a29873bc5d1ef702dc75bda44b892e665745e444a7a549fc9f860000d352614f932415f56ce700", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "startmenuexperiencehost-ydns-eu", "colour": "#806E99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713918, "uuid": "2d7bab67-322d-4773-8557-6e3956ef0c50", "value": "T1EE36B051B3DB41A1F0B712B069799321DAB6BEF50B3381CF5284B91EEB32AC19635713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713918, "uuid": "f732aa08-53ca-4652-ade4-a7aa95dc0136", "value": "958ee154f9bb2dbe0e236f725578a8d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713918, "uuid": "10f34194-3f39-4ea4-a406-4b9ae2d3e672", "value": "49152:nRlCpOt7a71srd/sLc1uR/cQ0Q4r/1N2svMHufKr3JvONglGfZoG6AF7EIW3J9uO:nHmOt7aRsrd/sLDmxLIFrZPlGfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770713918, "uuid": "c0733910-5658-431f-83f9-b76a702fb148", "value": 5090816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770713918, "uuid": "5442727c-ca86-4d7a-bb05-3a9e7926d2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713918, "uuid": "1830ef18-bbd9-4cc3-9563-5f936b443a86", "value": "cc8201c2bd34108853bf7528346b13333bb60050c63fac6e1f696e372262814f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f0074d-06d5-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770764933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764933, "uuid": "efd9153d-43fc-482a-99e3-6def95f99b3b", "comment": "Malware payload (Smoke Loader)", "value": "1fec5f183f1139592f617331386cac0e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764933, "uuid": "8f53bcda-a8dd-4ce5-82fa-dc04b6b01da7", "comment": "Malware payload (Smoke Loader)", "value": "cd1c4a472f2b3d626cf59755ca4a86808f913f0da15a6b4c7632e9b68e0ab361", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764933, "uuid": "24bd77d1-5517-4bef-8c20-639ad32078de", "comment": "Malware payload (Smoke Loader)", "value": "882f478a0ee58e27cca75fe1ffb997860886e1e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764933, "uuid": "06992c36-fa54-44f9-b708-fc90f35f36e7", "comment": "Malware payload (Smoke Loader)", "value": "87ef357a886f75f0c81dad005e305e6525edb6e92d7e007fc33581cc90ec2ecf931ba58fcf0a9850cb087d155291bc9e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764933, "uuid": "f9d37100-6a03-4e8c-85d9-96a6a2de98c0", "value": "T1CB858C25352FE3D3D04442758044AB0E2E64AF69CA55045EFFBC3E6A3DBD9D12E2B263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764933, "uuid": "6041cfe8-0688-4858-b3e3-45a77e01f249", "value": "330617927bc7f077fd037b805d00d19f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764933, "uuid": "fd2711cc-cde4-4ade-8722-d345aaf546a4", "value": "49152:FjggROE3gnNlJpC0nAm+10j6Bh9Fn+5EvH:J1EHNjw0g1x7Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770764933, "uuid": "9f06d748-3d34-47b5-8555-f08b4b5b8fa0", "value": 1848832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770764933, "uuid": "d798698d-31b9-4c44-b7ce-769116c36efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764933, "uuid": "5ec8db66-a554-4390-bed9-7964bb914f12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1627309-067e-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770727690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727690, "uuid": "18dea063-af42-43fa-992a-a0a9e180ea8e", "comment": "Malware payload (GuLoader)", "value": "86d9794f74da74624d69fd94840abe51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727690, "uuid": "14c008f1-3046-4af6-918b-6039a0e7e367", "comment": "Malware payload (GuLoader)", "value": "ce9f7f995a6dc24581ba0af01696c4dbcec1a941c2111ff6f7cbc8fb51368961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727690, "uuid": "529e9f97-5aa0-4524-9cc7-276a13aa2c13", "comment": "Malware payload (GuLoader)", "value": "535c3a7301c0a80f4437f729e6ce6f6192e96c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727690, "uuid": "e557a838-4bc9-4dad-bcaa-8bee30f5b039", "comment": "Malware payload (GuLoader)", "value": "8a3e5a071900aa736f1a33f5c766c843395bd8ebbf66d72ac439e85d6852f2d964786511354f1cdcea95b20997093fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727690, "uuid": "ebcaf7c7-f813-481a-b156-07f2a15a19b3", "value": "T1681512501B55A49EE0634874A8F17376F7D8AE65376DC3C27B90B5887E3B2068F283C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727690, "uuid": "a795578a-f0b1-437c-b4a0-d319fadb8bba", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727690, "uuid": "56d81add-e4b9-4d51-a6bd-26338070af48", "value": "24576:mHO/MdQKvo8Iua+9eoAWdBz6kqd43jbz1HVkMIwSqLbBYNGQ:mHO/uaxqTAWdBGzKb0wSqp9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727690, "uuid": "82ae6614-7eba-4b82-9a0b-0c5c9039c8d7", "value": 883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727690, "uuid": "7a0b224d-0193-48d8-a89e-d9b85d349661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727690, "uuid": "452ff2f5-c0e9-44e9-b2c7-97f5dc77260f", "value": "PO#221000004931.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c486f2b1-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743157, "uuid": "9a9fece8-3d2e-4faf-9d0f-8ff0e9b96f61", "comment": "Malware payload (Mirai)", "value": "4e2d70600d5e05b29bcd1aae406b6768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743157, "uuid": "94790085-70b8-4f64-84cd-949212d7ec30", "comment": "Malware payload (Mirai)", "value": "cff46cdbe1c975d505fe7904865969b983102ed1e3a81070b57582a774560cf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743157, "uuid": "c40aeb87-ebb3-48bd-abdb-28848bedc4b1", "comment": "Malware payload (Mirai)", "value": "8dc2a7292b5513692915076d5060d4d1942c91fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743157, "uuid": "d46af514-fb2d-438e-ad34-1c9459171c78", "comment": "Malware payload (Mirai)", "value": "22875b658edbd2db15cbd587db5bb0856a6efcfe099cc8a975be7d26c3dd35e7edc7ca9f97ccebb0e1e2aaed4c5e1afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743157, "uuid": "08306237-e4a1-42b8-9f8a-b452dd6c9a97", "value": "T176538D75D11DAEA8C0414AB4A9198E704F13E4C046733EF7EA9487A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743157, "uuid": "13ee7f23-f24b-416c-af8a-d07431790bf7", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743157, "uuid": "47aafebf-89d8-40bf-b483-38a6cbeb7139", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743157, "uuid": "0b163848-5c32-4d29-99b3-2f3164d4fe12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743157, "uuid": "3da59e80-22f3-4bc1-b62c-d31e4942c4b0", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfae2a2-0614-11f1-a129-42010a9c0007", "comment": "Malware payload (Pony)", "timestamp": 1770682208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682208, "uuid": "fb7177f3-28e5-4f78-87d6-2aee94de5644", "comment": "Malware payload (Pony)", "value": "7f6516b0f811b64dd7b538829e8c5d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682208, "uuid": "e224b89b-80f9-445f-8981-ac6b61a0fdcf", "comment": "Malware payload (Pony)", "value": "d0ba595dc1afd4ea3c1aad23d2bb5e3652853b56f8358a853f41e164d4bb1f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682208, "uuid": "d84007de-8346-44ca-b44d-8306871a8dc3", "comment": "Malware payload (Pony)", "value": "7b8c005e1ded0bcab4abbf2417f5a1a0d5ae8b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770682208, "uuid": "cc51397f-4f97-4065-adfc-616893b129ef", "comment": "Malware payload (Pony)", "value": "306d748947fc3a3ccb6deb37f5216b4038fdc78a2b3c691b20ecffe53c0ca42e70bca857d4ab842f436aab056bbcd23c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682208, "uuid": "35ace33d-9717-4847-b66a-3ef21ede6136", "value": "T17A930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682208, "uuid": "bf099d12-369d-4007-b9ee-942bec1dbacc", "value": "09070e021d4505e6183701ac6e022a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682208, "uuid": "c5cc7157-fdb2-43a7-af37-7ed87b156baa", "value": "1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEI0kzmt2l:2SnMuGc/CfZDap6COU45EIYtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770682208, "uuid": "fa38840d-2005-4920-b22d-b1a1fd2a1e2c", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770682208, "uuid": "56ed291a-eb9f-439a-9a1b-b08cc1a90004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770682208, "uuid": "e3217f18-9d89-4ebf-9640-d36315596225", "value": "7f6516b0f811b64dd7b538829e8c5d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884035ee-0680-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770728453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728453, "uuid": "3f7d2246-9737-4145-994d-0d4ca39c90f8", "comment": "Malware payload", "value": "510a87871053e239479f28101f013d0f", "object_relation": "md5", "Tag": [ { "name": "0APT", "colour": "#EA07F8", "exportable": true, "hide_tag": false }, { "name": "0APT-Locker", "colour": "#F1B64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728453, "uuid": "0fcffd19-e884-4e23-a940-a7fcf4fc0165", "comment": "Malware payload", "value": "d5c62661b484b43c704275ea1d3d70bfbebe5b0c80334e5c942e7113423f6678", "object_relation": "sha256", "Tag": [ { "name": "0APT", "colour": "#EA07F8", "exportable": true, "hide_tag": false }, { "name": "0APT-Locker", "colour": "#F1B64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728453, "uuid": "3478be5b-3e23-4c7b-829b-56bd82d71ce3", "comment": "Malware payload", "value": "d2ad884a1bd04a448a4abcd7d57a528e7f368ef2", "object_relation": "sha1", "Tag": [ { "name": "0APT", "colour": "#EA07F8", "exportable": true, "hide_tag": false }, { "name": "0APT-Locker", "colour": "#F1B64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770728453, "uuid": "1649db0d-6220-4bf6-96a9-0d4fc928ee32", "comment": "Malware payload", "value": "d5ba4d9935ede013947b3140cb252e876023d9fffe494a990075b8fa69bb246d45500743cee686f6d22a9e068dd7704a", "object_relation": "sha3-384", "Tag": [ { "name": "0APT", "colour": "#EA07F8", "exportable": true, "hide_tag": false }, { "name": "0APT-Locker", "colour": "#F1B64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728453, "uuid": "06bc3bbe-7f62-4093-b055-5a5f6e3e10f6", "value": "T10B463A01B674151DC9D5FA728F6EA339BAB939844623FABF0D6281703C73A43971EB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728453, "uuid": "f24f1f50-a2ee-4d98-8941-ea8029106b6b", "value": "16c38af2e826b7a2128a820a3bb2be3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728453, "uuid": "99584b46-f511-4d7c-a026-14aae8c008ed", "value": "49152:hvvrirx8AcMeCxSGGTDyO3IiXbBVWVUzFBryTfCTzrKC7JiZ+xTG54UBLwy7lAkb:IrxXcZ6fQp70gQ7EhGBzsBmBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770728453, "uuid": "c242084c-4642-43d0-8fef-929eb00e014c", "value": 5820174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770728453, "uuid": "c73ff999-b407-4ab5-8573-255af1ebfc8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770728453, "uuid": "f9c86951-cadd-4a3e-a69d-f472edec46d9", "value": "d5c62661b484b43c704275ea1d3d70bfbebe5b0c80334e5c942e7113423f6678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db82ce6b-0660-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770714849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714849, "uuid": "15f50e9b-33de-4bfa-8069-62df1d45687d", "comment": "Malware payload (RemcosRAT)", "value": "7c49b97157ded99194130320e884c697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotemburgoxm-duckdns-org", "colour": "#C34404", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714849, "uuid": "aafa3064-bfc9-4ce1-9490-c56b6fd52d52", "comment": "Malware payload (RemcosRAT)", "value": "d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotemburgoxm-duckdns-org", "colour": "#C34404", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714849, "uuid": "f52f1bf1-690c-4b09-910d-a39d3547eeae", "comment": "Malware payload (RemcosRAT)", "value": "0012bb17a84a2ef674f69c1373e2868f6e3d6811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotemburgoxm-duckdns-org", "colour": "#C34404", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714849, "uuid": "dee805f2-6184-47fc-9eb1-26cc968479cf", "comment": "Malware payload (RemcosRAT)", "value": "2cf9b6fac25505103a9d6fa64c9fca2479bb5f26e682b0ea8ae923fe3be8665ef148cb21a02a88517b31094c13e08d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotemburgoxm-duckdns-org", "colour": "#C34404", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714849, "uuid": "25be4546-fbfe-4864-beed-9f97fa46cb45", "value": "T11CB4BF01B6E2C1B2D57654300C26E776DEBCFD202835997B73D60D57FE30190AA3AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714849, "uuid": "1592dfdf-0c88-4821-8053-49334e5d8809", "value": "1dac0fb7dad849409daf9e23353df461", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714849, "uuid": "e4acf43c-4cde-44d9-834f-ee3c45538c77", "value": "12288:2vSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3dL:2qPONnNZ33/VY42hnOmZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714849, "uuid": "07aea3f9-cb5d-4de0-b497-31a4656abfdd", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714849, "uuid": "46093c73-6f2d-4d15-ab38-0505d228b139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714849, "uuid": "8b450c58-b50b-493d-81e2-f2909ab2ecf3", "value": "d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79373356-0661-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770715114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715114, "uuid": "7ce6b417-6936-4956-b3e1-d0cdc25476e0", "comment": "Malware payload (QuasarRAT)", "value": "1a65ed3ed5c6431b6c94d1a671f8e48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715114, "uuid": "a9a7c9db-e034-4dec-a32a-7eb25aff0ece", "comment": "Malware payload (QuasarRAT)", "value": "d8a4f7be62e25c84652a3dd085f09be2e8af716d0c4cd207a36b465f79d6baaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715114, "uuid": "c6eae415-cba7-49e2-83af-64a43db16ff7", "comment": "Malware payload (QuasarRAT)", "value": "fecedae31091280b948103776d1c4c5c58476370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770715114, "uuid": "56ce0275-7608-425f-8c17-a8387822cf30", "comment": "Malware payload (QuasarRAT)", "value": "296cfda298025a3e0e5f4e80cc2b4d627e8266dfca69d592dd335136968ed038fcde991c5d7d51bd0108bd6bc9648a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715114, "uuid": "ef6f736a-3272-4272-a9a9-3ba0c6c05e36", "value": "T1DBF56C1477F85F27E2BF8372A5B0005297F1E82AB367EB0B658166BA1C53B015D427B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715114, "uuid": "b2f1717e-9d71-4819-b4b4-68ee4849b59c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715114, "uuid": "2e16ba39-a33a-4a47-b4a5-c99fa6c75dda", "value": "49152:hm0X4VcpfAdACVKQg6+CWGY+orn2FtRD1MHHn72eh2NT:hmCrlCVKQg6+C9U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770715114, "uuid": "59560817-09c0-4db6-8c27-8e8632f4631d", "value": 3389440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770715114, "uuid": "f0cb989a-1db5-440c-b3e1-c6946d6867d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770715114, "uuid": "3bff0ce1-3584-4ea7-8ed4-a33636d63f3f", "value": "d8a4f7be62e25c84652a3dd085f09be2e8af716d0c4cd207a36b465f79d6baaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ba2ecc-064e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770707001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707001, "uuid": "b6e6616c-b8c8-47f1-a704-6884f7cc87e6", "comment": "Malware payload", "value": "1fa9d90184ddf12e367dfa1cbab49e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707001, "uuid": "cbf9cbcb-dcf0-4755-bd4a-e1c843daf474", "comment": "Malware payload", "value": "dcb068d5b3223eb363015fca7afa2a84a1716163ea7291b025459abea4ca8754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707001, "uuid": "2354bae3-2e87-47a7-b16e-17b0c7e2b5bb", "comment": "Malware payload", "value": "6ff51ebfac72c137ead6cb5c2cdd7c2301390248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770707001, "uuid": "864ed6bf-59ad-49f3-baa1-1e00799e331c", "comment": "Malware payload", "value": "8dc7586b115b0fa9e519a2d57b5c92f4ad983a73f1721d78d08d62609566b5afe39ca85d67f6a7565f1c0d3eb890bbaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707001, "uuid": "c25d341e-38a2-4b2b-90a1-e857d711e500", "value": "T1CFC249C69852E5BADC6102B84467D7A0ED77E073793168D3FBEA2B72F460EA0D64131C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707001, "uuid": "e326fdf6-990f-41f4-8156-a55b87db54f1", "value": "384:fcmFW0sfvJtNj/Hez0tKAKRmV4qjibC4ui0kEXtYlp9ShyJn2Hm85/x12iX:XWlv7Nj+AtKAKRmV4K8HoO952HmuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770707001, "uuid": "0bf107be-6dbc-47ff-bf6c-a894b97ee69c", "value": 25735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770707001, "uuid": "e2f8fdda-0472-432c-a5bf-2520f47b0d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770707001, "uuid": "fa54c5a5-b163-42df-b541-7b2b3bae5f4c", "value": "Hilix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb752e4-065d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770713240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713240, "uuid": "36d2efdb-5be8-4988-aaaa-67c510996fbc", "comment": "Malware payload", "value": "05c96ef35144def03742678c52582bf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713240, "uuid": "12b36c89-b5c9-46e9-b5d3-a8a73eca754b", "comment": "Malware payload", "value": "dd17d04059def943a5a414a78e548882790331ebcd71fab2b3a76fbbac5290eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713240, "uuid": "964b1d3d-3d3b-46d0-9376-f86ba48261d5", "comment": "Malware payload", "value": "3e8b015444824cb78f6bb523f51ff8d4051a1d8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770713240, "uuid": "d34f289d-f0c0-4f3f-82be-b64e6f364898", "comment": "Malware payload", "value": "1873467812803612dd18e05038eae12ec85ddbbf28c47c8cfac463705b0a8028254989fc6b7becba09fa2e0a88599fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713240, "uuid": "df2e448a-e162-4a05-9138-49f58a2ea4ec", "value": "T1C6344A4DAEA58F60C7A407FF8BF8268851717A03B1CF9714C2369374E908EE4ED499D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713240, "uuid": "90425b8c-8714-4c55-9dd5-3eff27a2d768", "value": "6144:1aegIXrT/rkNNnjytONNpqGVc3w7VwE8z1vPQEP:Iepz6j/H8Uy5v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770713240, "uuid": "70bf660e-fca8-447c-b63d-d933815d769f", "value": 245331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770713240, "uuid": "3c217bfe-3f68-48d7-82bb-b71ec7efcec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770713240, "uuid": "42cf208d-8c89-42e2-aed4-39bd8a15fe2d", "value": "bizy.riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7025e80-0665-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770716908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716908, "uuid": "026171e3-796d-43a9-8848-4f35e8da0279", "comment": "Malware payload", "value": "02cc29edf95a81c391b854f4da7513db", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716908, "uuid": "fdfd17e8-5172-4059-90ae-a36a92d3a7c9", "comment": "Malware payload", "value": "ddf5711ccc42a9016b93798b94acac08babbcb09c4e8782f85f4a430983bc7ec", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716908, "uuid": "faaae977-c91d-43cb-9cf5-b4e3edc4ba16", "comment": "Malware payload", "value": "a6bcdf4227647d52edc89eef581b55d2673a07fe", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716908, "uuid": "044be6d1-3f9a-45e3-8a58-45cd22b544d8", "comment": "Malware payload", "value": "dd3991a8c58cf7db518ef4c1ec515ad5087710cf60cb112b310a0ec6e5b31eb84cbdff2b5319ea6e21d0e3a94b21c8a4", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716908, "uuid": "9ef4d58b-64b9-4db1-a919-76c06b5b6e30", "value": "T15247339345844DABEA244F3FD553214D5935BA373901713FBA858A81BC2321EF37AEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716908, "uuid": "700b55d2-5c68-4e94-943a-3ec35fcbdc48", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716908, "uuid": "a721c3d1-d291-4038-b3a4-ad78f7128bcd", "value": "786432:5bHTyYuOAW8viZ/vhRIJpu+Q9VVvYJhjaN0b5AQ:tuYug9Z/vgALYJvbCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770716908, "uuid": "9acb058d-43f6-4637-9600-f2e4d2a6b618", "value": 26209147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770716908, "uuid": "4f8df15f-c7aa-4fff-b30d-79f96da91edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716908, "uuid": "30d715bf-5ebb-417e-90bf-f8290218bcff", "value": "Chrome_Setup_144.0.7547.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd80e975-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770738877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738877, "uuid": "19b14104-42c3-437b-b044-502e88e039a7", "comment": "Malware payload (ConnectWise)", "value": "25a08f577a9ed5bee28ca08a6b71adca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738877, "uuid": "aee08ceb-8b0b-49c2-aae8-67040349e9d9", "comment": "Malware payload (ConnectWise)", "value": "e0cc56f2c093c039df585a1dc356adc9e5c863257cd5e04405ffa82b68b330aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738877, "uuid": "2b2f3a6c-7406-4602-9ce8-98eeb68045c4", "comment": "Malware payload (ConnectWise)", "value": "196cb7e38dab0b190580300931f3871081e6eac3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738877, "uuid": "dd8ed809-b671-45b6-bda8-6266383c0a11", "comment": "Malware payload (ConnectWise)", "value": "54bd0491a11200320248b3089f4d1241e7d8a1d936412a6d6328f2b68f73b43162324138dfeed8189dc8e81814abe2dd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738877, "uuid": "1f479a1e-4c81-444c-8d6f-6a608b12b976", "value": "T188A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738877, "uuid": "fe5cf61b-ca8b-491b-b056-2c26471d6cf4", "value": "196608:bKaLNkbg1i4Q2KaLNkbgRKaLNkbgXKaLNkbg:TWg1iHYWg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738877, "uuid": "3bdcc641-b19d-4466-919c-77d642e9bf1b", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738877, "uuid": "851fa85f-75ab-4358-98ab-1d6e4e55505b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738877, "uuid": "b338cff2-0cab-4d03-99d7-26855064f3eb", "value": "e0cc56f2c093c039df585a1dc356adc9e5c863257cd5e04405ffa82b68b330aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff2faa-06c4-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770757816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770757816, "uuid": "934c7e02-2740-4260-b1fc-ee8f713a6a2f", "comment": "Malware payload (CoinMiner)", "value": "f16142725661cf13a11e30c4e127e4c9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770757816, "uuid": "537e5b8f-8a91-4658-aa23-ea2ad6147b84", "comment": "Malware payload (CoinMiner)", "value": "e2cc856a84dd0a5da86e44cca6c207d76180f21e71e6669ac3dab19fc49b11ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770757816, "uuid": "da9910ae-c3c8-4e9a-9631-2d6f11378291", "comment": "Malware payload (CoinMiner)", "value": "2b4cb2ea0af82ea38aed866b310966733a500936", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770757816, "uuid": "75970a26-4b68-4034-baf5-12ef21050c9a", "comment": "Malware payload (CoinMiner)", "value": "906144f8a8ef7dadd2b16bf45dcf43704aba93cb417e0d3e93592f40944a77c32c837726e13e1c006899bfe690261968", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770757816, "uuid": "883d0928-28d6-4b47-8105-24b418c7c594", "value": "T108E523388C9BFCC7F9784DB15DBFA99042BC5D91A0DA618824D83F7E7BD14768600EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770757816, "uuid": "b8cfff2b-25b9-4355-8ff1-f88be31aee17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770757816, "uuid": "309924c0-757e-403f-945c-cfcb9a728302", "value": "49152:YiFRjGrPRm200vkSc8Aq5dy7WTSQWhMB3MZQcyMzTyZJXQmu02vIerJY0j1oABxu:Y9r0zoKq2STTZRt32weC61oAzyFDCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770757816, "uuid": "0f7f5f49-fd70-4c8b-b47e-5f63df5f109b", "value": 3088384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770757816, "uuid": "5b8f6adb-b0ef-43a5-babc-78ffc7bb3476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770757816, "uuid": "ac50403d-6cdd-41cb-bfe5-4bd72e3a5b35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e809ab9-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770738798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738798, "uuid": "cac54277-40a1-4aa4-a4ae-b0ecc7fdf295", "comment": "Malware payload (SheetRAT)", "value": "cf6e3f7228464fc253620ab5e6ecdb23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738798, "uuid": "b951e839-e1ae-4f79-9206-ad6064a66af1", "comment": "Malware payload (SheetRAT)", "value": "e3a5d7cbfbddf1f92a47572f9c1d6472ab7c9c3d727f636fc9abe43ed23d3973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738798, "uuid": "38660aa9-8240-429f-90f0-b5e68bfad678", "comment": "Malware payload (SheetRAT)", "value": "2d3e4d03b3e6fe93da9a84b8dbf6cdea3de05ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738798, "uuid": "592f5a31-119e-4271-b0e3-080a5696fd5e", "comment": "Malware payload (SheetRAT)", "value": "b072066059db5d9b2d9cf4c64898f6082eb8e2cefe72a49b784811fa100e7b8a6ecd995912c0294a2e4e3fb04aec3b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738798, "uuid": "33d5c816-039d-4dcc-86d3-90e41d29ffb9", "value": "T125B429257F998E10D584197ECABE3609CB12E0F125026343370AF7A64E459EEDE2D3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738798, "uuid": "e7d6b638-827a-492b-8b98-655858a4bea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738798, "uuid": "f65aee14-8556-4c57-836a-d66433fc6b79", "value": "12288:OsZBKPeGE7DAnIP5/TuRYk2wPIL0GlDDFm0:IeGE7D0/zwrDDFm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738798, "uuid": "10c658d3-ec93-43ca-8e7f-6693eab8a39b", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738798, "uuid": "2af56bd3-b5d5-46a4-b87a-0cb85447d418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738798, "uuid": "308e0ae4-ec58-4da5-8152-3d0a76935e53", "value": "e3a5d7cbfbddf1f92a47572f9c1d6472ab7c9c3d727f636fc9abe43ed23d3973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63507c9-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743160, "uuid": "2ea3b227-8897-47bd-b5c7-ac909f9567ed", "comment": "Malware payload (Mirai)", "value": "1000433bef3072e8720428cb7727ad0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743160, "uuid": "62682705-8337-4fbb-b178-72fa8e4b68b2", "comment": "Malware payload (Mirai)", "value": "e4e33a71f715e2d2517536c7f32e14bcac2bf2d636e13298e0d044906249c253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743160, "uuid": "83452678-8f67-4bcf-bc59-8f13c711062f", "comment": "Malware payload (Mirai)", "value": "7f053ede67d4e972348960473a7933c7f6ad621c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743160, "uuid": "6d6f9300-f51f-484f-8f62-01b6e3ccb23e", "comment": "Malware payload (Mirai)", "value": "63fbffdf66e3db8e6e09948778f73f0a090d66f7fb12074947121f18e8bc8a8abc52aefc44fd95e6ca4dbec79ca8dcc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743160, "uuid": "489ac6db-f893-4bb9-874f-055fcad75d66", "value": "T130732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743160, "uuid": "8038b604-3085-4727-b1fb-e379bab0e7df", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WF:927jqCt8v3GI/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743160, "uuid": "1b8f1cc4-c690-4054-a797-28b88ec660d9", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743160, "uuid": "bf7f8c89-cab2-455a-b617-1d88fe554454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743160, "uuid": "3658c14f-4581-4a91-91a1-19fc7e245b9a", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afa43ae-06be-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770755060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755060, "uuid": "64817e5e-fe53-4251-bc11-1921720e245e", "comment": "Malware payload (ConnectWise)", "value": "a3fa2f86fd8658bedabf86dfc7866847", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755060, "uuid": "6d6cbc1f-5230-4c52-8e48-ee715e2f98c5", "comment": "Malware payload (ConnectWise)", "value": "e51e478e8d7da8fdf385377826907a7af82163490d1ccc9ed98a71be75b401b8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755060, "uuid": "8b022846-0089-41b9-9947-51fda45b2436", "comment": "Malware payload (ConnectWise)", "value": "d7b39542f6168f998b142135096deca2380e5a20", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770755060, "uuid": "9e15b9e8-38ce-4b9e-ac9c-fbafa68f542b", "comment": "Malware payload (ConnectWise)", "value": "4b2251f78fa1b44dbd46d8fcbb41b6571bef86cbaa9e439980b5feb7e4558004775745a0475f2edc061855700cb275a5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755060, "uuid": "555e2acc-fd01-48ee-b1f1-9fe3dd035f95", "value": "T133A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755060, "uuid": "1e4809fb-af7c-4d4f-b021-83a170206c5a", "value": "196608:rKaLNkbgzi4QyKaLNkbgRKaLNkbg7KaLNkbg:jWgziHEWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770755060, "uuid": "793e8eb0-6d39-4144-9d47-222bc2770cfb", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770755060, "uuid": "18383bdf-0fa1-4b2d-80b0-3405043a6501", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770755060, "uuid": "89efa939-064c-415a-8542-0c07b01580f6", "value": "e51e478e8d7da8fdf385377826907a7af82163490d1ccc9ed98a71be75b401b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ce75de-067c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770726541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726541, "uuid": "0c751fcd-07d6-4046-94d2-9df9ce9b20e1", "comment": "Malware payload (Mirai)", "value": "9855ee8e40846eefb4db46678329b3db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726541, "uuid": "100865bb-728c-46d5-855b-74edb71674e1", "comment": "Malware payload (Mirai)", "value": "e574dbdce8f380d63e7755cba71a9c13aeb0640874fef16a01ba2007de629314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726541, "uuid": "f6d8980c-1f01-49e2-af1d-133f73ad858e", "comment": "Malware payload (Mirai)", "value": "08fb01c595186e6275fc2af2dad27434adbd21b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726541, "uuid": "fe4184d8-5ef6-4f67-96cd-1383dd81f843", "comment": "Malware payload (Mirai)", "value": "1b5622b27c855428cdc437c45c580ed98881474cbb3db2c8ea72d46c6e3881876b0d27da1ed78083b6d0fdb90efe6da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726541, "uuid": "11773e05-213e-4a67-9035-1268b96c48a9", "value": "T12775339315460FB4AFD3FE3840186D8AE661DEB44B7EB3B8B274967015537E6B230836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726541, "uuid": "651730b2-86cf-410f-915d-d5a49ddf40b7", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKAmx/D:EpCKabVQ+9qlNlpjN8H8JZGtucD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726541, "uuid": "d7929d6f-a7a9-4cf7-bf4c-a615bd5ec92e", "value": 1605372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726541, "uuid": "9c5698ca-8f5b-4742-9142-c221dbce8aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726541, "uuid": "9599bd9c-a448-4443-ade2-d6afd168c327", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e5c2b5-06a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770743295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743295, "uuid": "1c704800-e1b5-427c-aa43-e76b039b70ed", "comment": "Malware payload (Mirai)", "value": "68f89e721098ef1dd330d974dba5db10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743295, "uuid": "6b2b9a2c-1c24-423a-82bf-8863f091687d", "comment": "Malware payload (Mirai)", "value": "e5fed9ef798dac5e02579d8ae4e54cc8b1358e51814bba5ac15301bc1089db09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743295, "uuid": "d59fb4b0-8e80-42f1-9f55-e381d32e3371", "comment": "Malware payload (Mirai)", "value": "ee1dba51e7e2b12708dfc67e0c0b3bdfdff23a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770743295, "uuid": "809abbf0-d934-48f3-81b5-6a04796a2b78", "comment": "Malware payload (Mirai)", "value": "3a5d8a9d3a4e31f72a6f4c9bafd41a63e74372957b781181d0f6bc7f824c8d87dbdfcbac670116347bd5c9fe69e711d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743295, "uuid": "b9af0c8c-8721-464a-ae40-6a9a803e8713", "value": "T18DD2D1786B1149D7C66FE1744DE50B222E60CF72E1436C0B76A4D9D7BB0986C2CA6EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743295, "uuid": "367f6c84-1fb4-4346-858f-a725a2bf3c6f", "value": "768:U4ylAtv6pqLJM0RXaxGyUbXtheU/ShgqCIJgGlzDpbuR1J6:HMBqTRXa+Zhr/WCIVJuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770743295, "uuid": "da363e8b-9a93-4498-84f9-50f4c522adac", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770743295, "uuid": "c938f85b-1fa7-433f-a19c-9c36c0f58b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770743295, "uuid": "f768df83-687f-46db-860a-e24c0a4b4c8f", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48e6c0a-0660-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770714891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714891, "uuid": "00ddd109-c0e0-41ea-958f-41d72db63d52", "comment": "Malware payload", "value": "4e447a3cbfc7e1a2fcfd09856993c4d8", "object_relation": "md5", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714891, "uuid": "18681519-c254-402b-8656-350861a83e7f", "comment": "Malware payload", "value": "e78d8c6ae7df28a50f2eaae4c6cd1a85a0b831befb430c5e774fddbfa86c8add", "object_relation": "sha256", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714891, "uuid": "6e53be31-a295-4473-a813-f6c9d6ccdf8d", "comment": "Malware payload", "value": "74cc65c37f212c819a0b173ec3571b3d3ad2a3f3", "object_relation": "sha1", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714891, "uuid": "5f864bcd-d164-4420-8413-2d962dcdb004", "comment": "Malware payload", "value": "347b3981b2453e5509bae21ca15eb173489d0845bab9b6762f511ce0ae705d4fc24a9932220816fb15553002f47cf2fc", "object_relation": "sha3-384", "Tag": [ { "name": "2seguro2025-duckdns-org", "colour": "#6B4E4D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714891, "uuid": "2635ef68-8ca3-4fe8-b429-8c6a8ab7df84", "value": "T1C3E02B169E7DD55F9D8AD043AC32C31A8FC2EE10106E5F7727A4EC0859006D637C3816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714891, "uuid": "462890b0-7e3e-48ad-bfd9-3f4fdaa1dd3f", "value": "6:j+q9Nqhnsny1R3KulLh8JJwQ4bWoy/H5IAuaHyHWLu1MFC3EISTFlRjAuaHyHWo:KqahsngkUG3wQCWoIH59Uku1M43hWFlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714891, "uuid": "00ad74e2-c980-478d-9070-974015cecb4d", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714891, "uuid": "a11d2a5a-85cc-4494-8655-09d5ffedb3cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714891, "uuid": "059844b3-7cfa-4aa9-a8a4-10833d0c9909", "value": "e78d8c6ae7df28a50f2eaae4c6cd1a85a0b831befb430c5e774fddbfa86c8add.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180a7555-0678-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1770724829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770724829, "uuid": "6c056d6f-9975-4fbc-9a7b-570c8440bd52", "comment": "Malware payload (Amadey)", "value": "9d30f59ad441da9c8d1c40dcd2db8e14", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770724829, "uuid": "56f36385-841c-44dd-9a73-d2539cc4fd3f", "comment": "Malware payload (Amadey)", "value": "e7a0969ac29166f0b6102ada5717b3cbebb61886152412d0b2bfc2ec3b29c316", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770724829, "uuid": "daf69513-7320-4a1e-8ad3-53fbe9d1846f", "comment": "Malware payload (Amadey)", "value": "89f869a2f6089f9fdbeb7ae0ea2901846c4ae5a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770724829, "uuid": "0a597ff7-e7ed-44ba-8b9b-1d789cb53689", "comment": "Malware payload (Amadey)", "value": "c5d0385e6390ff8588b54ce82d4def93019ddd2c0da4e7a3f5b3e599f492ec82300df83dc8a1ecb964a29cbc946a24b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d429b4", "colour": "#BABE96", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770724829, "uuid": "a7bb511a-fc5b-44e7-a8fa-d190f557e5b7", "value": "T15E358E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770724829, "uuid": "02dc275a-5c0c-462b-bb2f-97e6d0e6ae2e", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770724829, "uuid": "b6d5a3c6-0d94-4db9-a5d4-aa5ffc9081f4", "value": "24576:ff5xDRatdGr+rL4x8/cnGGwDM+H2pkegn+3NtF05wsPn3zhnZVAgZ:ff5xVak24uGg5lPzt0gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770724829, "uuid": "cc0d1f6e-d01a-4165-bb57-621ffabaea18", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770724829, "uuid": "c26324a8-3381-4ae2-98b6-264915c70a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770724829, "uuid": "decc1b14-089c-4e22-a0d6-192b86308158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57105c9-0665-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770717040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717040, "uuid": "1d9cc5a7-2f29-4135-a298-68af8aee73b4", "comment": "Malware payload (Formbook)", "value": "0dfa35043dfbe61ec2dd0858b5db7fe0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717040, "uuid": "7a91dd69-0c45-40c5-ab5b-795455afa463", "comment": "Malware payload (Formbook)", "value": "e7ec1c9d57116c4f97af9b23b8904455745e1913138cdfb9a591832a41e06433", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717040, "uuid": "10909449-e5b9-48a6-9491-fb16a49d985f", "comment": "Malware payload (Formbook)", "value": "53576f8888838acb48faf9ac275de7cc9b9d2122", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717040, "uuid": "69e2fd55-2f6f-4f18-9f9f-d3d50dee2706", "comment": "Malware payload (Formbook)", "value": "c810370176ace6d92f42fef6c2242311f5de818a9ed9c858804ffd08c194fddaa388252434dfdb3155b26b7f79cf36e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717040, "uuid": "47c0d51a-c852-4b5b-9002-78a7413c73f1", "value": "T1F955035C536386DF4BC9A2478C38FD86DCAA49D02B254F58F169D0CF8A06DEA507F26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717040, "uuid": "af91cf2b-e345-48e9-881d-c31120450ef7", "value": "768:AeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeC:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717040, "uuid": "907176c6-dc5d-47e2-a325-d433b2eafc9e", "value": 1335134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717040, "uuid": "5503ca9f-a231-4467-8d65-a549fff2a93d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717040, "uuid": "99a07709-f587-4d73-8028-0bc73be72718", "value": "DHL express Delivery PDF 10-02-2026_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e221a177-06b9-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1770753085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753085, "uuid": "861f7f21-c9de-4f71-b2d1-5168dc4a73cd", "comment": "Malware payload (DarkSideRAT)", "value": "3ad10613eb75fa2f116889a29a0d8c7a", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753085, "uuid": "1512b3a9-a39d-40b9-af6d-2ba934683b00", "comment": "Malware payload (DarkSideRAT)", "value": "e82c1f7fb8c68a66f0b0f983314ad2746aaf8f8023c7f6d6c87fb766239251ff", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753085, "uuid": "3c46fa76-efee-4bcc-a505-29508f9447fe", "comment": "Malware payload (DarkSideRAT)", "value": "8004ca4210c6d9233c62bffb5fa551306c2cd30f", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770753085, "uuid": "153b6cd4-439a-4159-9167-7cb6f7c3acb9", "comment": "Malware payload (DarkSideRAT)", "value": "a44e2aa25a0f48fdbe2b49eb25ee925f4d6b5b36f527f830022fd366e866919d32244d924abc69342f3b51b65b4996eb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753085, "uuid": "3e5c01e6-5e47-486b-9bfb-c71145ca60c6", "value": "T101830735D6A9B07FC3299978DE120C54CF62BC8E0394BF87A3E21DE60F96A505F4D681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753085, "uuid": "711d7eb2-6fc5-464d-9d47-d9bdd61f8196", "value": "13202ae6e20dc0e6f8ae3713ee808076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753085, "uuid": "78e479af-3531-417f-9e89-4fabd4a28963", "value": "768:GIsJsfFNCcJ7bLKFzFhYrqEdjPPy1CLYleF11+F8/P1ubnZ4nPVBz0FzvS+vgH85:hijHPoj3YleRERWnDAFz68UJz3VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770753085, "uuid": "99cf829f-c703-43c7-97a9-1f3b6b7362ba", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770753085, "uuid": "9cac9228-4acf-485c-b043-ed61f28d0ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770753085, "uuid": "7e120b75-46b2-4705-8b2f-01e39f5cf434", "value": "e82c1f7fb8c68a66f0b0f983314ad2746aaf8f8023c7f6d6c87fb766239251ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969767ca-0698-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770738785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738785, "uuid": "f09a1261-0041-4cf2-b368-1ee0cfa840d1", "comment": "Malware payload (SheetRAT)", "value": "0c969552f6be114dde3fe0bbb9beb2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738785, "uuid": "b401c67e-2c57-4c85-9331-f28694db0017", "comment": "Malware payload (SheetRAT)", "value": "ed36fed3de0bb0bfa5e9760b4ac8c0c06daa3e69043bf0c871d246cb6619934d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738785, "uuid": "3e1600f3-5fe0-4744-a149-6a8b2a2867de", "comment": "Malware payload (SheetRAT)", "value": "670d4e7040b3e6178c1e3e2ac2a7ff2b89017683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770738785, "uuid": "cc608b5b-001a-4778-a8ab-a47e406e546d", "comment": "Malware payload (SheetRAT)", "value": "1aa838fc131759eb6a1740d0a698d1b4ca29458dd1bfdd700641dc76bb94c8059a3c5c614ba294b37c7cdbe2a0852187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738785, "uuid": "2cdf1831-bbb0-41d7-9481-caaa72313781", "value": "T1302328067788A962CA9F03BED36353454A31C2330A42E74F7CDA5DF0A6877D65B05DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738785, "uuid": "701cdd78-e6a9-4d3d-83b9-8f9ab65cd945", "value": "768:zVxTQFOHIX21xEHUpii5UN+foX/fOmkRvObyCMwpjJyCt911wZYBxkD:zVzVEHsK+foX/fOXhOblvxt9bwaxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770738785, "uuid": "206313d5-7e9e-4bcb-9b00-648e2865d541", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770738785, "uuid": "0f4debc0-4113-4a8d-9fe7-7e0e32f79670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770738785, "uuid": "82075b63-d3d1-4d14-a5dc-f43434152002", "value": "ed36fed3de0bb0bfa5e9760b4ac8c0c06daa3e69043bf0c871d246cb6619934d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154bac4a-069e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770741145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741145, "uuid": "ecac90e2-2a84-42ea-988b-a0d474716426", "comment": "Malware payload (ConnectWise)", "value": "9ca407f03c66f00fb677051377e4ebdb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741145, "uuid": "f158327e-1a54-4b25-b6ad-a1ea268d1ec6", "comment": "Malware payload (ConnectWise)", "value": "edbb4d8d6b549ea5ec04e8a43e51d5fffad9276a52dacad8bba4ea09d9b41063", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741145, "uuid": "bd6708c8-5667-4702-adb0-552f63cee08d", "comment": "Malware payload (ConnectWise)", "value": "4988dfe8b9af7e4ff8255dd84c5c9fc752384a8e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770741145, "uuid": "c06c7589-efec-458e-b3b4-63ad538fa74c", "comment": "Malware payload (ConnectWise)", "value": "86bec1fb4a38a6522da5fcf0e69b78abf70c091ce9dad128620501b0d3e051853bb0c4eaf0eba69d179512653dbbcc48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741145, "uuid": "365f391e-b88e-4c5d-9521-518e1ae8a98f", "value": "T12C96232063E98A28E1B61B75EE7A55F14D39BC45EF23C11E4778795E2A30E8055B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741145, "uuid": "eeee00e3-6adb-494e-8c3f-51cfc2b1930d", "value": "196608:SQyiixtMjTZ1jhlrwUHQyiixtMjoQyiixtMjXQyiixtMjzQyiixtMj:LPnjTrrwPnj5PnjgPnjcPnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770741145, "uuid": "d031b02b-fb72-47d7-91fe-6dc3d943414b", "value": 9113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770741145, "uuid": "c2765907-050f-4525-9d8d-7b17c7133bbc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770741145, "uuid": "858b2fd9-7edb-43dd-9d01-9284b1b9702c", "value": "document_725299d2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fea992-0685-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770730625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730625, "uuid": "634f2c6c-60f4-45bf-876f-92c1ce020502", "comment": "Malware payload", "value": "77e068e1a172217a8ceeb02837d4627a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730625, "uuid": "859fe1c6-274b-4a45-bda7-b33b0698a1a1", "comment": "Malware payload", "value": "ee90b01b16099e0bb23d4653607a3a559590fc8d0c43120b8456fb1860d2e630", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730625, "uuid": "1faf0081-b0ba-48b5-a5fe-79b92e5dc87d", "comment": "Malware payload", "value": "45204fb72243d1d8626e861f14981590b0055d9b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770730625, "uuid": "83c06e8a-a959-4de1-a2cb-f384a476faa7", "comment": "Malware payload", "value": "af58d37fc7f66a93a2506ed9af0b251ad43024b86c25e4b92d07051a73d0be9cc3223c9853aea7dad9b74f1c6be62913", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730625, "uuid": "a5dae6c9-8f0e-496f-acbb-0581f6b92f5a", "value": "T16951CF516BF50264E3F38D7B68B5E6078637B502AD39CFAE0591509D2838714EC36F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730625, "uuid": "442795f9-78e8-446e-9b5b-dbacc896b883", "value": "48:8WxbZ7qvYre4yeC4/CyjMztdlPvXQGW44MI/X:8kbZ7qvU9C0MzflPIGWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770730625, "uuid": "c7b3d4da-67f6-4aa6-b077-96833e4da303", "value": 2719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770730625, "uuid": "138b3044-ddc3-4988-b2e4-7ea28abe2700", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770730625, "uuid": "a895a1ae-d8d9-42ef-99f6-36484181b4d3", "value": "photo_10_02_2026_09_51_26.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d55f11-067c-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770726921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726921, "uuid": "b40d228c-7226-4ac0-8385-95acd395431c", "comment": "Malware payload (ConnectWise)", "value": "4ec10bda8eb3bf9dbb78e5b996557bb7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726921, "uuid": "10fd8160-f771-4bd5-9c88-05a9b1e9db64", "comment": "Malware payload (ConnectWise)", "value": "eea3b8373c14d077bdb80349f83767b2a4bc9a214e68cd8d085d195b9cf82dc5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726921, "uuid": "c7d26d95-5f87-443c-8fa0-c59ef1fbce58", "comment": "Malware payload (ConnectWise)", "value": "16d9b13fec788b195628b14a347eb683fbedd891", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770726921, "uuid": "b545ad6a-da45-40f4-ab43-026472e19241", "comment": "Malware payload (ConnectWise)", "value": "966422bee9dcba9f1ce88bb7f64d1fb6dee4665b162cbd330248e4895ce28c62d4c7e672f18be1dd727a4ba9aaa6f795", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726921, "uuid": "18edb516-9707-4b18-94ca-c2b95d2a3ce5", "value": "T140A623227BE4842AF6F30A39F93991B1597A7D55CE27C10F1374790D1AB2E809A72337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726921, "uuid": "8b55ee25-036e-4857-9e70-efd2d2b3a2ff", "value": "196608:MT0cEhi5owS/WFFV2eOhJgyHT0cEhi5owS/uT0cEhi5owS//T0cEhi5owS/:MT0URTFFVogyHT0URLT0URoT0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770726921, "uuid": "7c5ab6e8-6d4e-4f27-ba6a-47756078bfdf", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770726921, "uuid": "ed67ba2c-98db-451a-9bb4-2488a0fd074b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770726921, "uuid": "b3cdf7a6-89b7-456e-b6fd-e7dfd852b454", "value": "statement.PDF'.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400b5dc0-06d5-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770764839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764839, "uuid": "f4b54233-b46f-4bee-8a8f-1e1471390d2a", "comment": "Malware payload (Smoke Loader)", "value": "cd68bfc6475f0ac4f5d0994350b210cb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764839, "uuid": "7e0f110e-7b6e-4f6c-8675-2c0e9a8f818d", "comment": "Malware payload (Smoke Loader)", "value": "efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764839, "uuid": "cf612e58-4a3a-446e-9988-914e37cc1408", "comment": "Malware payload (Smoke Loader)", "value": "765c8a222f3fb3ba60646e096bae91b76df248b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770764839, "uuid": "3e52982e-1cac-4fac-b8f7-c30b86f79722", "comment": "Malware payload (Smoke Loader)", "value": "49b33fa22b4e0a2e386221f1fd96bfd2976929448ae1f8579c8f03c65437fc4bf99e9266c6f158c6ee5a5c8ee69a02d0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764839, "uuid": "b73be21c-0a78-40c2-b1df-363d91be91fb", "value": "T108A5E026397D72D2E4C942B180D0B6033FB8FDB54B890C5A67C8B6B61C39B963F9E055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764839, "uuid": "116da865-c432-4545-bfbb-8090b8b4857a", "value": "e440c7009792917cfecbaeda0053d5b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764839, "uuid": "e4e36a7f-04e7-4303-937f-1001b15ebb1c", "value": "24576:yatO7gM/5KlRUjKJoYV/g82Qf9OveL6IHhUBwYOey5YXhQKkJFVOf/THmU2Pro5s:vOkM/SRUKJoY+8r8OhUzdyosO37H2PsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770764839, "uuid": "cba1775e-4424-4154-a681-74d956cc6a54", "value": 2075624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770764839, "uuid": "96207303-93f9-4445-b06e-d23940fcbdf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770764839, "uuid": "3f22cb0b-b2ff-4a0e-b4c6-c276459acf36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7f1ef-0664-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770716430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716430, "uuid": "21e0eb48-1352-41ef-a780-932f3bcde7c7", "comment": "Malware payload", "value": "677f2537d06f03f93c9eb193228e161e", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716430, "uuid": "a4eab100-4b01-4eee-9b3e-22384c3cadc2", "comment": "Malware payload", "value": "f1a25c6bdaa3b3f95f83415f87fa232de2c4b7a9211549b4e4b0785b27ce2fd2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716430, "uuid": "1bf49e73-72e7-4f6a-ac41-db8e1575b333", "comment": "Malware payload", "value": "e491be98a31e07db2ffdb961df591da1289d347b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770716430, "uuid": "f7f54951-4bd9-4d03-bd13-7d9c0e02333d", "comment": "Malware payload", "value": "d7bd543bf21605071d82ae7c10b55c571e26d2258723b4fc1fef03228389b7cc7e63f84bf3d17d1a9b4ad0ea6c2702f9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716430, "uuid": "28686a8c-e69a-420e-a7bd-7099ee2b63ae", "value": "T1CA43B07A2009E820168DA8F77180B13174B4F1CFC5DE170206E1FA526BED5DB9769B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716430, "uuid": "1e63cf03-8457-495f-b5fa-b96883791d0b", "value": "1536:dgqF26fKkO9g4ukBBBBASrSSSSSSIRRlrsoAtttV/kflVYkMMMMMM7lPOOOOOOo:2qF26A9gnP+SSSSSSIRRWqlPOOOOOOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770716430, "uuid": "d1e025f7-82b1-48c2-817b-b1ee2bf6fb58", "value": 59352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770716430, "uuid": "e7ed56ab-b390-4856-ad90-cfeb0f82afc6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770716430, "uuid": "38038da6-15d0-4d86-8e10-ce1505135c65", "value": "5_17_7_1377_04.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cd19e6-067d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770727050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727050, "uuid": "49f816de-e962-49c0-8137-36936b8cccfa", "comment": "Malware payload (Mirai)", "value": "b14a09fc139cf29ac988e101d597796a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727050, "uuid": "8a82f5f0-cf05-4c4f-a805-cdd281e119fc", "comment": "Malware payload (Mirai)", "value": "f3b1c028ecc837d34786892e9be642a35629cfcdb3d8ad15e804c6bbb6911574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727050, "uuid": "2076c527-d143-4078-8459-94686cc04f3d", "comment": "Malware payload (Mirai)", "value": "42f94918dcab12c72fd4ce65e4c40ce374fe4af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770727050, "uuid": "b6824497-1ccb-4d62-be4a-b4592d4111ca", "comment": "Malware payload (Mirai)", "value": "b82eedeede0a1cd3038e0055e069bc24f6cf20af60581e7bba3a838fa2d5b1743cb945b52a9863139ca9a433f41864b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727050, "uuid": "473b801f-f94f-4859-b362-9fca67cd2f88", "value": "T1F703F1BFC1E6DB84FC5C273C4CCDBA991990AA0F50BEC216E700363ADD62F1D252516A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727050, "uuid": "1a14b29e-bd72-4be3-a7d7-558d716360be", "value": "768:Mhw1KVRJEWAqya2bTGbid4af5vsUTt2OUofiXenbcuyD7UHQRjj:kCsRJEWsaGZRvsUTjjqXenouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770727050, "uuid": "3e260389-bb05-43f7-a931-69f830c4f877", "value": 40988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770727050, "uuid": "7c280381-4072-4929-aeed-e620c7e59058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770727050, "uuid": "5ee04c14-a802-47cb-b962-635beb9c19f5", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c671f6-0667-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770717760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717760, "uuid": "bdd30795-726f-4c30-a935-a983587de6aa", "comment": "Malware payload (VIPKeylogger)", "value": "825dcf67e3cd4a0dfe8f7d60ff30b835", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717760, "uuid": "fa68ebd3-62b9-4164-afb5-f02fb980bef4", "comment": "Malware payload (VIPKeylogger)", "value": "f562a9423e9fdefdbb61e01e4919340011233d3e9b00f1fda07fdd81263658d4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717760, "uuid": "a7715503-b3f7-4d3a-a91d-7edcd1dad448", "comment": "Malware payload (VIPKeylogger)", "value": "b4ce52951e040a8cbbc7080923f5b41aa1c264db", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717760, "uuid": "5c6a7c51-a3a1-49cd-93fb-48f58e33c302", "comment": "Malware payload (VIPKeylogger)", "value": "1cc5249a93faf00387efc6e4a0c523849e5ffb10b907698d758531391eeb1b322dea19505d3cb4977a6f27bdf2888e72", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717760, "uuid": "291db133-d140-4ba8-b699-d76980e42b43", "value": "T15A51A4C06B027ACE80EA0F76784DD9A79E14A034183959CDE2301ABD7F8839C5222FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717760, "uuid": "9dc84ff9-6704-43bd-b3f5-6e3e46a112c5", "value": "48:bQNUsWwQg/xE/DfgeKBWdJVhpNAAdNwNLa1jtxi5iRjmt+qD1nvFpQDw3FpFfTmT:bmUsdQN7zVhUAdeNevxi5iRm1JnvsQZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717760, "uuid": "f0e513e2-1520-4463-a190-8569e58d39f2", "value": 2953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717760, "uuid": "a9065083-ba16-4663-aa30-e3c3b22303f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717760, "uuid": "0abbebb7-ed60-442e-b2da-2d5f1a9e0f5c", "value": "Urgent - Request for Quotation- RC-26-6799.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339e3785-0661-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770714997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714997, "uuid": "a496494d-e290-4e51-b4c6-bff4c53de9ee", "comment": "Malware payload (PureLogsStealer)", "value": "e10e3ce1a6e7a3ac61a81e8d9fefe99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714997, "uuid": "5b9ad9e6-ff0a-47ec-aa2f-3566d549d80a", "comment": "Malware payload (PureLogsStealer)", "value": "f5bd11a320b37bb5f168cfa868c8d02de0f697ff0c4010e6f7b21f7e847529c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714997, "uuid": "96e17cca-12e0-4f1b-8248-827502af3e8b", "comment": "Malware payload (PureLogsStealer)", "value": "2aac348628f0f71456bf2f611d6824eba8d39bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770714997, "uuid": "96b586ca-17fc-4190-8d72-f2b6d9c82f49", "comment": "Malware payload (PureLogsStealer)", "value": "1f5d3196d0f3b497d1089257f1288e6017117bf14cd6b8738dc6af86cfd8aca95c512d1ee8537c7633f84bd4fde1f8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714997, "uuid": "1a995150-c755-44a2-9ffe-85eb41e34d91", "value": "T1E7651260B684AD42D57A2BF509B7D57017B42CADA023D30DA8D7FFEF38A67801069717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714997, "uuid": "f99e3f5e-20f4-43ee-ad04-5529d91362ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714997, "uuid": "b9161f81-ecb2-43ed-abfa-ae6cb3581b05", "value": "24576:LrMguQOzmlMYlOS91cA2mwFYxBrlIcdxzWE1szEQP3CJzNbFTq3+GNZqj4RL3rHL:Zu+miaA2mwFYx/FWUsEX5NE3hN+Y3rHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770714997, "uuid": "0c59b2f4-3e66-4a5d-afec-1a93d72a80ce", "value": 1508872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770714997, "uuid": "02d4cee5-c229-4a95-8c98-7ec8a90637a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770714997, "uuid": "56de59da-a2b1-4a5a-b267-ab210506d845", "value": "arajanlatkeres_Photo_EKR.2026K.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf00b0b-065b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770712382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712382, "uuid": "f6f9960a-e462-498e-83e6-a792d71b32c8", "comment": "Malware payload", "value": "78125afde1836a9b43d408975f86007f", "object_relation": "md5", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712382, "uuid": "4295e590-97e5-42fe-adcd-0b5e6bfbf763", "comment": "Malware payload", "value": "f6cfa64deed6cdef815006822d47e3f2e3b12a8416b4ccfb5aa1f45eb83ba66e", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712382, "uuid": "a52342a3-3562-4175-be33-e18a7b366927", "comment": "Malware payload", "value": "1f64bbc2cf34cfb24b7ea956073f981c9cb0891c", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770712382, "uuid": "601f3ad8-6f66-41c2-a26c-b9501cb16a72", "comment": "Malware payload", "value": "baaf1aa550c7671cb2f22f4646c468efc1db4132a899290c9f86173a5de67d108b2fc1217b622b35aecd7bf66afc1464", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-238", "colour": "#7E0C1E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712382, "uuid": "484d9af9-deba-4236-9977-12d535e74dff", "value": "T142C45B4763A500BBE1378678C8634E45E776B8114764EFAF03A4839A1F63BD18D3AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712382, "uuid": "57b49ce0-ada9-4af6-a906-95a34f111c48", "value": "12288:7BBC+ktPksN4+BBC+ktPksN4TBBC+ktPksN4kBBC+ktPksN4qBBC+ktPksN4Z:7EZS+EZSTEZSkEZSqEZSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770712382, "uuid": "52201756-86bc-4564-ab1c-a9f08eeba374", "value": 589292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770712382, "uuid": "fbd77e8e-2c9d-43c9-b0f8-e76675994289", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770712382, "uuid": "051630ba-9ede-4544-97ad-eb2d672b3126", "value": "f6cfa64deed6cdef815006822d47e3f2e3b12a8416b4ccfb5aa1f45eb83ba66e.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540e831b-06a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770742968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742968, "uuid": "f180f85b-484d-4658-95c5-65393755e686", "comment": "Malware payload", "value": "c7aa53fe83e869b2f39e9a81997a5029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742968, "uuid": "ecac2d65-9aba-45ca-9f05-55a732b80ce0", "comment": "Malware payload", "value": "f87cf5da1645e2d92c14ebf0a0bde2d8bb094748fd15a3f09d6fa20fa5869800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742968, "uuid": "3171f426-ec38-46f2-862d-c11f9f63031b", "comment": "Malware payload", "value": "262f0905844c27abb44cf20ae673f302c8356ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770742968, "uuid": "ee1f403e-6c25-44e2-b202-e93dc6db492c", "comment": "Malware payload", "value": "d0e28fcd1359d85d63261beb9683757d32ea49a273739856f61b33cc2c618eed7647b7dd8d9573620597930ad5d52bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742968, "uuid": "f9495ae5-874b-4052-9d37-6c5b5e69fd2c", "value": "T126251220D819DEA9195C426460599E8315500E73AC247B7A3F8F5F8E4F0FA8FD5B22FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742968, "uuid": "5d9cc4a8-c7f7-4886-9515-a544aec4a39b", "value": "24576:d5EL/cskPXiCWqbMXNe5hEWJPg7kBO0xIAP2tK:vs/kSCWqEETpgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770742968, "uuid": "a9477f68-5cdf-4fb0-a954-a5f4f6e7eaaa", "value": 1025445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770742968, "uuid": "25ac38f3-3c3c-4e20-b888-27fb9700ef1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770742968, "uuid": "373b1c74-f9b2-494f-90d4-a42ba735797a", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176487b9-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770717956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717956, "uuid": "4457235b-2495-42dc-8c9b-a583ee61cd11", "comment": "Malware payload (SnakeKeylogger)", "value": "42b4f2257c669ccf3ea5e8be2583a034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717956, "uuid": "2bf8cdc1-dd72-4f47-b0e8-7a8ff80486bc", "comment": "Malware payload (SnakeKeylogger)", "value": "fbc2c57b9586b454e3990fe96fbf982dd49a90786a4ea9dbd29b7f2269655f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717956, "uuid": "926471ae-d788-4adc-ae0b-1c009d71f5b1", "comment": "Malware payload (SnakeKeylogger)", "value": "73a3facee74907d38e38796f490ec16667d65596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770717956, "uuid": "6518c09d-3612-4176-8fa0-11d4b014d7fe", "comment": "Malware payload (SnakeKeylogger)", "value": "40bb6a1b682284364012001748ab622a0549e2370a1806041722c89574049e96006954ebb531880b0786a0e3f8fd10db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717956, "uuid": "45052382-b873-46de-a216-71bd2e8aa8e2", "value": "T12C552318325CDE69C9A427F011B2D2324774EE6AB221D317CDEE9CEFB58A782181D357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717956, "uuid": "12fc7167-62d9-4117-b918-38b06602796c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717956, "uuid": "1eb5d6ed-6d33-4d62-b3fb-be2aaa225fd4", "value": "24576:KguQr8TtI8oJwrNuQwL95aJgDUHz0kDw06VzHQnwhjVictE:DuW8mDJwA/aJODP0mwnQQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770717956, "uuid": "202ce0e0-44af-4d30-9edd-519a33741232", "value": 1303048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770717956, "uuid": "9fa67462-09b0-4192-a5c5-388763a0adb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770717956, "uuid": "040be116-bca0-45fc-83c6-e420b84f3b7b", "value": "ZEYNAP BAYAR 0067.ra8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fe8041-0639-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1770697821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770697821, "uuid": "92993c07-c94f-459e-bb7f-d9d174dc9a94", "comment": "Malware payload (RedLineStealer)", "value": "ac52827a330616f6c8e29883d0267386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770697821, "uuid": "b29ae79a-8f39-4ff2-8e63-97cce5e55e87", "comment": "Malware payload (RedLineStealer)", "value": "fd07772252a3ab63c44f6031b35126cd06f8fdc1e1f6efb9bacc0d6b7a89bd2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770697821, "uuid": "ff59fc17-9cfa-493f-9404-bed3c4141240", "comment": "Malware payload (RedLineStealer)", "value": "14409c7251c3c58bde42c0e317f72f7ce1f82646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770697821, "uuid": "bb3d1a2a-628b-4d92-bbda-385f2ff1bfe5", "comment": "Malware payload (RedLineStealer)", "value": "442906fb8344d3472b84210cb5dee1a16c01d725ef5b3f1dd578cb9d0e0ea52278997cca52acd5de9c6ee42bf6257155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770697821, "uuid": "cc428eb2-8b1c-4138-b890-5059f90da15f", "value": "T1C1251265739ECE66C0B517B80071F27043BABE6A7112C217CFD9ADEFB914B91213172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770697821, "uuid": "e73f2aa6-e29d-4e0d-bf4d-78dce7372b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770697821, "uuid": "45c03c42-3446-486a-be46-cc2f5159fe6d", "value": "24576:kguQgx09tTJi3ymUHbSDzCpI+c/dC9HidV:5uhSFg3ym4SDzCp7soid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770697821, "uuid": "02595a37-409b-44b4-bbae-77c269c73def", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770697821, "uuid": "901102d8-10c1-4169-bf58-716a86f027f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770697821, "uuid": "77503ee1-943d-48dc-b815-361bec4a4fef", "value": "AC52827A330616F6C8E29883D0267386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeee4c03-0650-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770708010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708010, "uuid": "b98e318e-ecb4-4372-8981-147bfb6c695b", "comment": "Malware payload (Mirai)", "value": "517bc5f4b72d9191f89e91305ef90c29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708010, "uuid": "1ceb5c39-bba1-45bc-9daf-de2d791f3d48", "comment": "Malware payload (Mirai)", "value": "fe6df6f65e0f85867939b6a95a06e32bfd13e32e4e9dc16e30557fb8125ce20a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708010, "uuid": "fc834df4-b557-4d28-a091-ad3813ad7135", "comment": "Malware payload (Mirai)", "value": "f07c813179846015673f6d564ceefdf2ddacbe8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770708010, "uuid": "017f1590-d223-41cf-b619-65efdeb4d9e4", "comment": "Malware payload (Mirai)", "value": "9614debb385de7b69e9e37649d2381bcaf5a6d8eea41199f748caa6401cd2af0ccfaff060b169ef586bcdb89711d240c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708010, "uuid": "ae198e1b-44cd-4123-a407-1db7114dc90e", "value": "T177E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708010, "uuid": "38e9a021-54dc-4b99-b51c-034aab77ffd1", "value": "3072:WxjJw1Cc/0s6YAPwenUr48pzfR+JonMy:Wxlw1xAop0YfRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770708010, "uuid": "4034c9a6-7467-4bb2-93ed-9c8b6b9334bc", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770708010, "uuid": "7049edb5-854f-4683-9c9e-3350ed853922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770708010, "uuid": "9629a826-8dbb-428e-bf3f-da01cb39a4b7", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f85db01-0668-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770718184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718184, "uuid": "97e9b42b-8f5d-4c62-9ce0-507defa788ca", "comment": "Malware payload (PhantomStealer)", "value": "2d4836d923e9231affbc7bfb4e7494f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718184, "uuid": "2fca6877-1bb8-46a4-a4ea-714c90925232", "comment": "Malware payload (PhantomStealer)", "value": "ff63061183b17b0ab5ddba48be394e5b37d1b41fba6810b3ba186a4c036eb210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718184, "uuid": "5566e829-39c4-43f4-89c3-f246a95dd3f8", "comment": "Malware payload (PhantomStealer)", "value": "2e828222d11118117fe929e79d5c8c5db1ccc124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770718184, "uuid": "c3cf7c76-a136-4b44-933e-42d5124badfd", "comment": "Malware payload (PhantomStealer)", "value": "b084a0f488b47408d175f9912d64e43f9eb08283115dfc44f4b55fd578bf046cb3a24cd240546b899431ea3f080c1add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718184, "uuid": "5ecd9dfd-822b-4160-a3a5-d9df69a337b8", "value": "T15E85012527C44F68F8BF9738A579511047F1B80E9B22DB2EBF9850DA0861F4EC662773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718184, "uuid": "c77fb040-0a45-459b-a429-9d8b06f06cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718184, "uuid": "be2db408-9a50-43e5-a282-7f1876ffcbb0", "value": "24576:V/kfd1HK6/XZfS1qHaqsjU6UsHMIrEMJv3oqMXYg9pGdl0xm3GD:2fd1H7JEaaFxUsHdJv32A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770718184, "uuid": "6f919f0a-40c0-4312-ba0a-abfecf183ec3", "value": 1768960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770718184, "uuid": "2298ba76-0918-4981-84dd-851b6f665b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770718184, "uuid": "840dd0c8-dedf-4b4b-8d9f-8df6adb98816", "value": "IMPORTES 347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }