{ "Event": { "published": true, "date": "2026-04-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-20", "timestamp": 1776729782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "06679caa-7a5c-4d46-a5c0-3f43c8e1b704", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba15b23-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725361, "uuid": "d3e20ef9-3433-433f-bc7a-3da968950aa3", "comment": "Malware payload", "value": "b39c59046edc5d74d806d51d3d02a213", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725361, "uuid": "0a041cce-d799-4a4f-b03c-8bfdd844e381", "comment": "Malware payload", "value": "00d31d04e092ce1f73839aeafaaf695fd1b68e92bf030c92543dd74a979a8a7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725361, "uuid": "85748170-91d6-4603-a3a5-747e2cd7482b", "comment": "Malware payload", "value": "8571f618eabd32d3f60f1133aa4c278feb958423", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725361, "uuid": "f12534d7-a886-40ad-8e2f-e764087c9962", "comment": "Malware payload", "value": "5d06072a0e8826bd5c5d537794f6c58fcc5803fa3fc5472df574fbb112be765489dc301d761675cf15f18568ea59e790", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725361, "uuid": "1582461a-6c24-4c76-9f92-df0f71bc0f31", "value": "T15FA34A5BB2B600BBE1B7863884530A09D7B2B8551761AFEF43A0425E1F273E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725361, "uuid": "eaa7237c-2ebb-485d-b734-11e19b5fea44", "value": "d383ef2bcf5724582bd7d16d7cef32e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725361, "uuid": "7ca27926-026b-489d-b3c8-be183afa6840", "value": "3072:9z14PqjedtveFGdEQbCQWVqdcp/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCR:wCjI1M9MCQWVmbSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725361, "uuid": "8dbe5695-9ccb-4223-975e-29acccc4913b", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725361, "uuid": "956d7f04-b0cf-4f4b-9345-e1b0eb696e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725361, "uuid": "2f16420d-d60d-4036-bd8b-b3bcfa60de4e", "value": "00d31d04e092ce1f73839aeafaaf695fd1b68e92bf030c92543dd74a979a8a7d_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ca741-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776697404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697404, "uuid": "445eb840-9aeb-40d7-ab70-6bb18a51400f", "comment": "Malware payload (PureHVNC)", "value": "101aeb89655291652dde8b890b6628e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697404, "uuid": "2ec2a114-5d3f-44c3-b406-c632930c4a0a", "comment": "Malware payload (PureHVNC)", "value": "0116c7614c4c2c3b60782e525b9eb868d650c3c9cd53efd3634af0b36c9a0868", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697404, "uuid": "69c937fd-9b46-4cc4-958c-4d41b218b8e6", "comment": "Malware payload (PureHVNC)", "value": "9a69996fa1639576713a04e90305690e71c24120", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697404, "uuid": "0b842e0e-e627-4baa-b25d-12cf5e41c109", "comment": "Malware payload (PureHVNC)", "value": "9316210b03de4c0bc98046023e4dce41234295ed37caaa6d55b961dee5717c3ea9d963a0209506a9bd7052b220874c23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697404, "uuid": "bde2e923-c773-4f39-841a-1940fb161cb7", "value": "T14E149E0263F94908F1F34B59AAB754304A7BBE6A1A3DC02D2198544E5EF7A45CCB63F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697404, "uuid": "b1423fb8-533e-42ed-844c-75be94c15148", "value": "6144:69BM+Q+Z9HyjhGJdHTbUpp3l+uKnSYQccyYjuwW:6DlQi4hudzYpp34uKMcXynW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697404, "uuid": "c16c01a7-6e31-46da-bf32-278112542a2e", "value": 207846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697404, "uuid": "9f70f7b0-e558-44f8-bfe3-3229412ff91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697404, "uuid": "d5f52127-f8e0-4b71-919e-5a97faf8c1df", "value": "REF 210654 P.O 2026-037250.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94cd0a-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674361, "uuid": "cbbfc4bb-d917-4bcc-a980-f5df8c402b67", "comment": "Malware payload (ConnectWise)", "value": "7e1561df6f7ff58a6cb85201a319fce7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674361, "uuid": "89d56776-d864-4649-8739-bf9a0bf965cf", "comment": "Malware payload (ConnectWise)", "value": "011e83421d412e2fef249f2d850775cfe9921f66333c52774929b7a06efa4db4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674361, "uuid": "2b0486f7-73ca-441b-bccc-64405d33e776", "comment": "Malware payload (ConnectWise)", "value": "1fde4ce1637699c6fbb11b357ee7bec68571e0a6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674361, "uuid": "cd755e88-7649-47e1-9765-43a1e6fa8c81", "comment": "Malware payload (ConnectWise)", "value": "7d300142ae9d1be03b021e769efe1013828cfb8ca1bfdb64a52b8f61cb3f91c6b38ca29c78e4e28f425378f88ef5b00f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674361, "uuid": "0650aa45-6b14-4022-a9ed-1cd745ae9cae", "value": "T193D6232267FD0918E1F36778FD3A91E291367C658F12C09F2654786E6871E8097A333B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674361, "uuid": "5875ed54-4a39-4a96-9661-650118ddb3bf", "value": "196608:mrnLYG3zDhukORrnLYG3ztrnLYG3zGrnLYG3zLrnLYG3zkrnLYG3zcrnLYG3zV:mbDDDgvRbDDtbDDGbDDLbDDkbDDcbDDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674361, "uuid": "803da2ad-4f10-4773-ab06-9cd422915d48", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674361, "uuid": "f3ac832a-c94f-4b7a-9172-942499937f9e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674361, "uuid": "c9905e73-187b-4717-9968-0e82a88151b0", "value": "011e83421d412e2fef249f2d850775cfe9921f66333c52774929b7a06efa4db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46635200-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673866, "uuid": "6069800d-3376-4aaa-9959-b394eda25df8", "comment": "Malware payload (ConnectWise)", "value": "7b3f4d34b8d3518c092d81506df05103", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673866, "uuid": "36d4daa7-f8a5-43d0-bb3f-e65706c7ae42", "comment": "Malware payload (ConnectWise)", "value": "011fdaa3a7d7f7badc6088eda2a21fa808bcefe2c0cd24b21a89271102c5be60", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673866, "uuid": "c1f37e8b-fce3-44d2-97df-fdc7ad8336f4", "comment": "Malware payload (ConnectWise)", "value": "264e801035f64163ffa7cf05086ce4c7d1396956", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673866, "uuid": "267da762-145c-4660-91e3-f4d7599dde3d", "comment": "Malware payload (ConnectWise)", "value": "f41eb856a09ea9cb8944285c1703908bd5d8e9237eaeb8097fce7b6bbd7de2606f5848284721dafcb6c983e875dc966a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673866, "uuid": "3e337507-9707-4026-8727-f3cb0ef477d4", "value": "T18346E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673866, "uuid": "34e051c4-0ec7-4088-a499-f12e3334fb47", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673866, "uuid": "2ddba5d7-846c-48b6-b2bc-bb0063fd7040", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl9gLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673866, "uuid": "a3f5dc43-5aac-4523-a697-159950468ad9", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673866, "uuid": "87eefab3-9a02-43b0-9a00-e1f43094f59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673866, "uuid": "734b9361-ccf1-464e-ae2e-9b7aaa5a8195", "value": "011fdaa3a7d7f7badc6088eda2a21fa808bcefe2c0cd24b21a89271102c5be60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87023096-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725943, "uuid": "ee377fc5-9b40-4c99-ac90-ef45541bfa27", "comment": "Malware payload (RemcosRAT)", "value": "98066a046273ded1b0cb92b2175f5573", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725943, "uuid": "111ac6f3-0397-46aa-b810-31ce12c9ed6e", "comment": "Malware payload (RemcosRAT)", "value": "01e4174159baf68c3ad3c126e7acc0fe9708dc99387094278ab3b04c6b7d6a09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725943, "uuid": "125f4f84-d4cd-4ffb-9f4b-9c3e0590a8d6", "comment": "Malware payload (RemcosRAT)", "value": "b73d3ecf0aeb3b5d5681e9c1fa2d20f0b7264ecb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725943, "uuid": "aa682f7a-0e68-4b6b-96f9-febc2d3cbc96", "comment": "Malware payload (RemcosRAT)", "value": "c1c57631e4e44d8ff91fdae14ae70250736362f94772820fab3c06ca130a4bfff89d721abfe9df8c54bbdc3f8f366545", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725943, "uuid": "4e8dbdb8-a414-4de9-8e5b-43a18c30a8c5", "value": "T11DB35A4B62EA00FBE5778278C4670E46E7B6B85107609FEF03A4461A1F277D18D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725943, "uuid": "8a2da478-c9f9-4f10-97d7-7a26b273ad5f", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725943, "uuid": "b84ebeb4-a7b9-4cd6-8f7f-311eaae7b940", "value": "1536:9vzpP5wkTwPMFZYQ46x6Fu3DpGTHASUVjLLJBq/5tEJsWTrdj9dl7G8vQNv:9gXPMsoF3Dp+g9LLrqBtqB7dBvQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725943, "uuid": "05d1ed2b-49d0-45de-a3c5-0b8ecd7b252d", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725943, "uuid": "b6df8079-f529-4b1a-b37a-5db1f4ef43a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725943, "uuid": "0aa91d30-5322-4f3f-913c-1eb8aa5fd2e8", "value": "01e4174159baf68c3ad3c126e7acc0fe9708dc99387094278ab3b04c6b7d6a09_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7180eee-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726024, "uuid": "00584620-c9a7-4aa4-9a8d-c1b85c8c4f81", "comment": "Malware payload", "value": "ab0df05e39bd73f4adade8fdc21a1f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726024, "uuid": "702b01f1-e76e-40e8-b6ab-9c3d3000dd25", "comment": "Malware payload", "value": "020aac79a14717e316a593155ca778dd3e253b888bf62633b174838d35df7f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726024, "uuid": "7ef6e416-ac3d-4178-a324-ccca424ce9f7", "comment": "Malware payload", "value": "b12c2771c040f6175902ec5941ffd09748f87ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726024, "uuid": "89bbe366-7029-47bc-840e-6f327dbd686e", "comment": "Malware payload", "value": "5ab7ca5879174552864d0368cec632f9a3b37e71fdeab1c9862c4958b25c5ba28e4604e5028420c7abf02e14f39b2f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726024, "uuid": "55ff6afd-ebd6-4972-a4e0-5f9a56ee19b3", "value": "T133F53346F7CB0472F9622A73C460D054AD277DA912F0615A7EBCE60C06B73D3E8B6B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726024, "uuid": "bf18d704-76d9-4f65-b65c-9ca6526cacf4", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726024, "uuid": "be35aa42-29c0-4d68-80ff-3d8d35b7d799", "value": "98304:65zMfaTDdMIOZhgAOgp4GMFBgPaJ+nHmf9ViPf:6O0ZMVuAVfMAM+HmFcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726024, "uuid": "0cb6dd6b-87bf-452a-82e3-f81febbc2c04", "value": 3648408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726024, "uuid": "d639b181-b816-4cbd-8950-ecdd5f1b0d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726024, "uuid": "8161ed5e-e398-468b-ab63-da1292b70a52", "value": "020aac79a14717e316a593155ca778dd3e253b888bf62633b174838d35df7f41_c7e02e7d-b3c5-4f3d-a7f5-358b66188ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1e26b6-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673876, "uuid": "6003f13e-0fde-4bc9-814b-02a0af304075", "comment": "Malware payload (ConnectWise)", "value": "9792a47e97a76d9aa39322805aa82931", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673876, "uuid": "af8fe50c-f455-48d9-b711-d59fd476972e", "comment": "Malware payload (ConnectWise)", "value": "0221824ccab033708283521d1d27a2cebc96bfe5db0b5c2d0f649d34603448c5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673876, "uuid": "8103dd26-8262-4bbc-ad51-49001e8f0372", "comment": "Malware payload (ConnectWise)", "value": "3019efbfdace358a563d0756a8a856b63b683caa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673876, "uuid": "a141773d-7c14-4af5-85d2-49fb0a01150c", "comment": "Malware payload (ConnectWise)", "value": "b77e160f188d5cb50987512942b4d48f4a4f0a8f2bb83d6dd948a1153e86403af77839a8170d0b5b23773f32b9291538", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673876, "uuid": "284bbbae-143b-46ba-99de-a48c65028d27", "value": "T1C646E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673876, "uuid": "069d5eef-e1ae-40c5-a5d7-3c0542cecc55", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673876, "uuid": "26c3b67f-d795-415d-ba67-342f52d48a9c", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlCgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673876, "uuid": "1ecc4d0f-40af-40a6-9517-1c81904d1494", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673876, "uuid": "bea7ce81-28be-4311-9bcc-1fabf44611a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673876, "uuid": "5d11fa86-2c00-4286-a81e-be21c5f738a2", "value": "0221824ccab033708283521d1d27a2cebc96bfe5db0b5c2d0f649d34603448c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ca9e15-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776697628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697628, "uuid": "46110296-1c9b-4180-aa9e-0f59b7811b31", "comment": "Malware payload (PhantomStealer)", "value": "4f1251784ba463d9a0047aa2129d8844", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697628, "uuid": "52abfa9f-2ce5-49d6-b3cc-6167a3492623", "comment": "Malware payload (PhantomStealer)", "value": "022d703303d178cbdebd271a2cfdf26b3c746a54c370524f4ad79b2caa62f259", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697628, "uuid": "34d6cf1d-c394-459b-8291-771657e8c141", "comment": "Malware payload (PhantomStealer)", "value": "1015cc81c54111ad3b429a3c98d60f9ec5a5de93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697628, "uuid": "39661e9a-c092-41e2-a39e-3a71d2bfd6b6", "comment": "Malware payload (PhantomStealer)", "value": "282c521cc4e3630bd959e9e6acbac3bf06fef2227250f45a9f7d3937d1ab30f76f14cc60bab7f9c35866eb2fc351fc10", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697628, "uuid": "baab7985-318a-4e21-a7df-129dcec5c0bc", "value": "T11686D558C0E4A11D5CC2DFAAA572D4B489CE39EB6E4FCA73A01F94782D52F93843119F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697628, "uuid": "635bc49b-d620-4c71-bcc8-6faa9ffdea79", "value": "196608:AoLhOq+72Ccxxn943Pa1NM+4zmhYsL3mbc98rNTvKjymF9DZRrKuCLzNR:AoLhOZOxxnCcNl4qhYsL3mbY8I9dvGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697628, "uuid": "956eb180-83ad-4cdb-b1f7-4b7b3a07e7a5", "value": 8043068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697628, "uuid": "afe092ab-6f68-4977-a4d3-4e5493d76ef0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697628, "uuid": "57617b32-228a-48b1-b70f-669582f22421", "value": "Specs_QU200426.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642a1332-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725455, "uuid": "b78cae7b-6bb4-4eba-83cf-9987b6ca1200", "comment": "Malware payload", "value": "756d7ac8307cd3baa55b3e451e956d09", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725455, "uuid": "15251a9f-8593-4e8d-b3ec-218b137da2d5", "comment": "Malware payload", "value": "02510b782a3f47a2cfce0b721a1530c325be15c3f540304681a92032ce22ee26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725455, "uuid": "d6fddcb6-f4b2-44ac-a9d2-339e3eca9e39", "comment": "Malware payload", "value": "50f1cb0a33768f32e43ff39950d65ddfe00b889f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725455, "uuid": "dc87e10e-e56f-4636-a02f-581deaca5145", "comment": "Malware payload", "value": "0db992e43207a8fa0c9b37b687aab6ed47d2b559b9231b73495471836470275571ad9a7daebc32d67012fb70fae51e9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725455, "uuid": "9481a0bf-823e-464b-9522-2fd2240ed7cc", "value": "T14AA3385B62E640BBE2B7863884530A49D7B2B8414721AFFF43A4425E2F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725455, "uuid": "8a0579cf-53c5-48e4-865c-d0ad43191e90", "value": "d923a2810795f79107f2e3c19dbf2fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725455, "uuid": "483d61f6-2edc-4c11-ad26-6c2b64a615ab", "value": "3072:TuVdwd07895RGJLQbLAYH+S6vSrST/2ie4GyufWH+vmC/O/7njPL3cIbHD2GgNJT:qzwO74bOMLAYHph2Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725455, "uuid": "e319a9ea-bae2-4188-a9a4-12734ad62564", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725455, "uuid": "45c40937-cd02-493d-8a3e-69ad23ac59e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725455, "uuid": "a764d944-bfe6-4e5d-ad2b-7d391331aa2f", "value": "02510b782a3f47a2cfce0b721a1530c325be15c3f540304681a92032ce22ee26_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62aab88-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697649, "uuid": "23b32ede-f125-4bc6-ab5d-5e56a1c45bc0", "comment": "Malware payload (AgentTesla)", "value": "33a0a7e350c219e5fa43e49befed1432", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697649, "uuid": "12b1d13d-7178-45ec-a21f-7aeb8737f0a6", "comment": "Malware payload (AgentTesla)", "value": "02e8389d9517e58b5ef9b079525a5f0c15421786ebd46b1f7c98c89cc566cee2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697649, "uuid": "8498482d-e829-4980-a706-0687aa9b6748", "comment": "Malware payload (AgentTesla)", "value": "35b839dceddcf61710ecd4a2ae62d56940d6cbc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697649, "uuid": "fe316d78-cadf-4353-96e4-59492e63e222", "comment": "Malware payload (AgentTesla)", "value": "ec63078a1e4a6626a1efd6aa7d509967192f7ac32b73d8e2d46892d3ba30df8fc4dfa768d5a8771a00993a7351d8af7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697649, "uuid": "b5be59c7-dce7-42e3-ab16-60eab91d7717", "value": "T1E15502118AC87FA9CFAC561D90FE1A0E93F04A8F541A758AE733BD06BFEB540061719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697649, "uuid": "abae92b9-fbc6-4f12-a3ce-a10fdae675bb", "value": "24576:o1SPYXYRgjo/piANBfx3Bbh+LwZTUWSfgVT+W1bhUbC74wgiCr:o1ZXlo/pHBqpBfBSg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697649, "uuid": "2afda585-ebe3-47e9-aab8-9fa811250ae4", "value": 1284737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697649, "uuid": "8796a89a-671e-4652-ac5c-514b7c3522d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697649, "uuid": "26745859-60fd-4fbd-80b8-cabcdcab207b", "value": "Payment Remittance - PAY012141.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd8c885-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725603, "uuid": "5cb03fdd-cafd-4dbd-bebe-698876b2621a", "comment": "Malware payload (AsyncRAT)", "value": "ffb872c4670afb0cce809ea72d2882b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725603, "uuid": "7b6a6853-2376-4b35-a3a6-da302338f3b1", "comment": "Malware payload (AsyncRAT)", "value": "039eb6867f334e0c1fb405a03e8a81bf4d395db84d3ffde3ec249f6a814d5d18", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725603, "uuid": "c72f8f25-bc72-4776-a183-d17112cb8fd4", "comment": "Malware payload (AsyncRAT)", "value": "c78c0924d0079cc87fbf86f077c998fac4052666", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725603, "uuid": "e1609b36-6da7-4bb4-b270-875426645311", "comment": "Malware payload (AsyncRAT)", "value": "59b8be580c782aaaaa55560190376e53ce228847fa618ac3fbbeaa7919ad9e734b1c0d685c12b5b01448910cee261314", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725603, "uuid": "013b8aa2-6404-4743-900c-5a9471f44f82", "value": "T13CE24C4877E08312C9FEAFF02DF2710A1274E11BD923EF5E0CD889962B63AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725603, "uuid": "fdb520ff-8e98-4849-92d9-5d6e594882a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725603, "uuid": "1a15487f-8799-49b5-939c-06abd482fc85", "value": "384:ppaJuqQYbqjpk972V7/AqBZB1FOmLpM4vh0FbOKTCOQKFRApkFTBLTAOZwpGd2vd:+16zY0FPC4vGFbO75KFVFo9jROjhVbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725603, "uuid": "7fdfb500-e80e-458e-a55e-60ab87521f10", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725603, "uuid": "0026decd-f352-4c7f-9892-672107a6f527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725603, "uuid": "1fb16113-734d-4f0b-a798-597c1190fe9b", "value": "039eb6867f334e0c1fb405a03e8a81bf4d395db84d3ffde3ec249f6a814d5d18_08da372f-db8c-4799-9e6f-4299d789bb3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8ea87e-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675247, "uuid": "ed78c6a9-177c-4398-b4d2-299723a30f53", "comment": "Malware payload (SimpleHelp)", "value": "9815f784665a6e735f4f6a0b6e5e2940", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675247, "uuid": "1b444b13-62df-48d3-a3ba-2021f3c1e31b", "comment": "Malware payload (SimpleHelp)", "value": "03c95be86614645d68c66e5a190b6e8cdbb23a40ac1ae478eb36889f4e4b2f51", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675247, "uuid": "bcb4a8f8-add0-406c-a4de-5814c0694a4c", "comment": "Malware payload (SimpleHelp)", "value": "a6060c7c926e843c9b7dc97c4e71bb4ea5736bda", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675247, "uuid": "ca63b63a-e1e0-454d-b4fc-d30e7a88fe56", "comment": "Malware payload (SimpleHelp)", "value": "e6064c35665c6a90dea15bb7679a18b2329a270397d36c4898996eb625e5953c00e95cbf352cd9ccec638a6d8b50b7c8", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675247, "uuid": "4046d95f-80df-420a-a6b1-a9c658e5045f", "value": "T10FD40A34E2A15DBDDF37A9FCD08E44DBA75BB9A203C4012717F086E28B613D4542EE69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675247, "uuid": "43e31631-4e38-4d79-8bb0-63ee5d52a7ba", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675247, "uuid": "bd67ac73-1cbd-4308-8e03-33d4fd75ea07", "value": "6144:kxrmLfiUqSn2mHtPsPekdzZOuapaIYOEoZbsCpRkFNPrOsoZ4f:kNLU92UOpzDapJtJRoNTOsoZ4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675247, "uuid": "b0b69659-b527-4e75-a088-5dd27201da65", "value": 648928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675247, "uuid": "f16a47f6-266e-4564-a1ce-248b6d3de1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675247, "uuid": "4832c49c-bbe3-4f3b-a442-77247835eed1", "value": "03c95be86614645d68c66e5a190b6e8cdbb23a40ac1ae478eb36889f4e4b2f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d664c2e-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697554, "uuid": "651b938f-5c65-41a2-ae3c-99bb77533bd3", "comment": "Malware payload", "value": "fdbea95c3894f25120ab7cc631035107", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697554, "uuid": "b1aa7b2e-02a8-40f4-afcf-da9b292819dd", "comment": "Malware payload", "value": "03d698a546721443f321d3922c35c6d3574ef3f3b8323b018f0862e252c3360c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697554, "uuid": "5f728296-6734-4e74-9504-732f2ba62a5c", "comment": "Malware payload", "value": "2d642dd08446ce092a13f78714dcba8816c02f05", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697554, "uuid": "40aff7dd-2b64-4064-b3e0-2126fb3fe918", "comment": "Malware payload", "value": "2520b35d028f8b10a2a1305665a752af3383efb72051cba061b071908f627e0fa4878f65cbb33d3bf90a58cdf79c6246", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697554, "uuid": "0c2d0e26-6275-4512-bb57-14d494b5514d", "value": "T1C5147B5363E9450DF5F71F989A7340314A7BBEA91C78D81D0A98294E0AF3E04C8B67E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697554, "uuid": "4a36ade9-e63e-48db-aa4a-b27a80fb9de7", "value": "6144:rEenOpmlOPvGe1Q17G4E4f95LyQcp3KW+vaDF:lnOhPuKQ17G4E4fb0355", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697554, "uuid": "00f49aaf-9fd1-4292-90e1-75374cb96380", "value": 204352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697554, "uuid": "22c78855-0d99-4a53-8c4a-b970dd0bb5ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697554, "uuid": "dba1d441-053f-4e9a-8e4e-158f7a9f559c", "value": "PI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49536de5-3c97-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675589, "uuid": "23c9c441-1eee-4e9b-835b-acb116e31ae8", "comment": "Malware payload (SimpleHelp)", "value": "c3a8848d4f617dba13027d17ff436fb7", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675589, "uuid": "924a149e-7c57-4805-9fb8-e1254f17a632", "comment": "Malware payload (SimpleHelp)", "value": "03e930031399ce0b713624ed54f6ccbb09a555df7aeec3ca2edf8adf5e386860", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675589, "uuid": "da49864e-2925-45e1-8b7a-738690d4bd90", "comment": "Malware payload (SimpleHelp)", "value": "aeb0d45b6e54c0313630c8d6abe32365f7cd0a16", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675589, "uuid": "f932a5d3-273c-4b77-a08a-25e6e2a0cb00", "comment": "Malware payload (SimpleHelp)", "value": "427f26f559398f3cd5f702fed51875667134c9d463e7fa4191460e3c4e0cfba6f75321a7f9d1c467ed84ef09f246d962", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675589, "uuid": "45616ca0-d309-4e4e-95a7-bd179cfde548", "value": "T14ED44B34E2E15DB9CF37A5FCD08A4497E79BB9A203C4026717F086E28B613D4542EF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675589, "uuid": "5e3f75d4-89c0-4ccf-82d1-689bd33e3373", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675589, "uuid": "c5c542e4-a889-4e25-b63c-9782cfe430eb", "value": "6144:kxrmLfiUqSn2mHtPsPekdzZOuapaIYOEoZbsCpRkFNPrOGBDo+5rHhZsQ:kNLU92UOpzDapJtJRoNTOGVocrHhZsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675589, "uuid": "0d758529-59e6-43ad-8d49-6658cefbeace", "value": 648928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675589, "uuid": "3918567e-56ea-489b-8dc6-e2afa6f584a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675589, "uuid": "61ae9a5a-64cd-4ca3-95a1-9d69a7e3fdaf", "value": "03e930031399ce0b713624ed54f6ccbb09a555df7aeec3ca2edf8adf5e386860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec531e7c-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776697767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697767, "uuid": "266e1cf9-af3f-4e7c-bdb0-201443d1095f", "comment": "Malware payload (Formbook)", "value": "c4ed0f52ae7b3b0e19696b0dd5282791", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697767, "uuid": "f484c5dd-55bc-4b11-92c9-87e545347534", "comment": "Malware payload (Formbook)", "value": "03e93562a693f28a4393c504215bc08c943cb0aad44687abd393a9885c2958b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697767, "uuid": "2b80804e-0fc1-4d8b-907c-b5cc5942596f", "comment": "Malware payload (Formbook)", "value": "18601dc652fe3e0e02ba5fbca8a31f6c5d2b78c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697767, "uuid": "a08e9c37-1dcf-4d56-8c62-3b70307d8f23", "comment": "Malware payload (Formbook)", "value": "0f9093df81b660daf01c99de8506e872b26b62fe28c3b291a882acb5570627395e51a5bf54d008e1e7181575b8f8d1ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697767, "uuid": "a18c8e42-9498-491f-ba39-79b7e4be4337", "value": "T198B2A635483D7C4E7FC9396E23133F78A63042D09B961EA2E2D15D6FA81E8E576CC069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697767, "uuid": "7af8be94-c2cb-4dda-84c2-69cea20efe51", "value": "384:mk+KDFfTvH/daKrFUWmgWguMW3rFGrCN04p7qp0:mk+2jHlaKZUWmgOMWbFGrCN0M7m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697767, "uuid": "fb05e4dc-23de-426b-abd6-9ef4f5e5341d", "value": 23794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697767, "uuid": "ebd151a9-4b47-4282-99b4-0f3bd55e83f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697767, "uuid": "1e53a50c-0d12-403b-8159-94f9883cb8d4", "value": "Purchase Order #BESBPO250365.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4921815f-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724981, "uuid": "6c3111f0-e6aa-4460-b3a4-9f18dbab051e", "comment": "Malware payload", "value": "a8bedd55e56241c0fc1e173e8c0180c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724981, "uuid": "29a97d66-c2b0-460e-b3c4-9cf6af7566b4", "comment": "Malware payload", "value": "046ea94cd9c350c2e060c48ae917b6ba194f1ad79d111707cc630a5bb1e03096", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724981, "uuid": "a0b1eb90-60eb-4f65-977f-a5790fddf535", "comment": "Malware payload", "value": "36c187e553ab8115593aa25c2088882fe4d354c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724981, "uuid": "a8cc0056-7711-4955-b99c-cf7c807b5e1d", "comment": "Malware payload", "value": "6d865d9bdb37378351ff99d7ed56484b471eaaaef65345bdc4bb463f273d96aa4e7948d4cc323a6a420bf1b21effe5b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724981, "uuid": "bdb8659d-f300-487c-83a2-cb4b8194dda4", "value": "T132B35A8BB3A500BBE1778679C5630A46E7B2B8511760AFEF03A0461A1F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724981, "uuid": "b26dfb11-f6ea-4b6b-99e3-a62a0fdc8c14", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724981, "uuid": "81b97c87-a076-4e66-a3ed-ee8e6977fa6f", "value": "3072:m/azEnyFSpckqn/JqnJxSjjYrckVPxIiTRQrol:muEyY2n0ioKrol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724981, "uuid": "7d985580-347b-4c87-8738-8fbb5850e7d2", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724981, "uuid": "0a486349-bd5c-4b89-b2c1-5f48a6c3490f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724981, "uuid": "465e3d40-6a47-4ef6-b1dc-862bc4649045", "value": "046ea94cd9c350c2e060c48ae917b6ba194f1ad79d111707cc630a5bb1e03096_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d982579-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674791, "uuid": "3695d840-c548-4b1f-9f07-bccdda5770cb", "comment": "Malware payload (SimpleHelp)", "value": "40deaa7a7b4b412023d818645c23a93f", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674791, "uuid": "07157ad3-f68a-4757-b5bd-dd459956235a", "comment": "Malware payload (SimpleHelp)", "value": "047c2b9799364d44cdc12efe7647166c5e840a8d17d0d4f549ac12af98d55a18", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674791, "uuid": "a11f4a23-fd60-4149-8054-baa1e7ce3456", "comment": "Malware payload (SimpleHelp)", "value": "8417923969b13898e18ddff30702f4022e171c0f", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674791, "uuid": "40076503-edf9-4199-93a0-9febc758f23c", "comment": "Malware payload (SimpleHelp)", "value": "e3fafc29f306c7bd972d76121242e02417d3eaef1f0e4835c6f267c320fc711c20acbb199ec562c020ddc80dd6b76dd2", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674791, "uuid": "837e229c-9022-4b3f-b35e-ca1f30897450", "value": "T163773324FAA16DBEDF33D5FCC0464147AA5AA4A70389121727F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674791, "uuid": "c8354f58-b855-4049-9dc8-fea9fdf6109d", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674791, "uuid": "2ce2038f-2e76-4b20-9cc9-bee853351fea", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcI:K/jkCgpPUK8PyL7M8aE1VWhroHFcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674791, "uuid": "00e149a4-3553-4c60-8090-2530d1f5da61", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674791, "uuid": "d53f8fb2-a0d0-4678-8db1-4a9d3b6ee316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674791, "uuid": "fae0bb68-770c-40aa-8a7d-d6ef3941a1ce", "value": "047c2b9799364d44cdc12efe7647166c5e840a8d17d0d4f549ac12af98d55a18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c5a0e2-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776688085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688085, "uuid": "2c6ecafc-7cfc-4b49-b762-7729c65492e4", "comment": "Malware payload (Mirai)", "value": "e4880d1ebe398f07da7b447b5d86de7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688085, "uuid": "0b385930-3359-4b21-afd0-f15e8e14c2d9", "comment": "Malware payload (Mirai)", "value": "048b874409e23bccbbd3a15dc22e7ed7b28611a2c3f16bccec764927de46e8a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688085, "uuid": "c290b953-e3c1-493b-811e-abad1f0b0902", "comment": "Malware payload (Mirai)", "value": "a2f5533b641f79ea9ba974c381e301a8f9f5dff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688085, "uuid": "65d2de5d-2f67-4a69-901e-123c8c00db74", "comment": "Malware payload (Mirai)", "value": "fdb3c286325e39ad17f0a22b583f50fe6b25df80f5d45cb83c1bf2f48dccf503a4a390745bddb13ffc6265b34ee471c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688085, "uuid": "58650e00-1ef9-4911-891a-50fa50f9e95c", "value": "T104331A91B8829A12C5D4537BFA6E41CC331563E8D1EF32079D266F507BCA82F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688085, "uuid": "7688611d-dacb-44e2-91b5-816b31b657fb", "value": "768:w7Mc+v+wcWDEKmxmmEBa4OmdiC8saEbwzRgBCEVeHmYMvYPfjA/hcl3D8NRRZPNl:lcBnWDFx8sHeHbMIfU5tGlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688085, "uuid": "fcda0d4e-a687-4b3b-8354-9bf1ba805534", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688085, "uuid": "0194a5b7-82f7-4dd7-b21c-2f92050b8cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688085, "uuid": "c31ef8ca-d3b2-46dd-9209-51a7f53d2391", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ffd28b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725034, "uuid": "8e0f9334-ba42-4355-9b58-7a737155ee60", "comment": "Malware payload", "value": "2f9246f506d28735902f550c58f8b242", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725034, "uuid": "58b9a984-8749-4327-be2f-8a1d8ecac7fa", "comment": "Malware payload", "value": "056e17a0478ce166200140dbe0165140d8f7c851f0acc0cca6d1f267df1eaeec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725034, "uuid": "c91936e7-ad6a-45d2-9609-841ab73eff99", "comment": "Malware payload", "value": "dfb504a58117127bcafff061a09726657271b0b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725034, "uuid": "a7790a93-e68d-4577-aef6-ad9d09a9578b", "comment": "Malware payload", "value": "af41df778e876761f8dc759875ec53e9254d61895c6559618fe7ea6ee8ea563390fbba71d4ed5becdafeebb6d913df9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725034, "uuid": "6aa74ffa-b032-43db-a63b-5a90b183e581", "value": "T1EEB35A8BB3A500BBE1778679C5630A46D3B2B8511760AFEF07A0461A1F277D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725034, "uuid": "a29844fa-b4f1-4ede-861e-4878f69d2291", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725034, "uuid": "845fda3d-72f8-41b7-8f6e-3dfcfc36fc25", "value": "3072:Pq/azEnyFSpckqn/JquJxSjjKjckVPxIiTRQjol:PquEyY2n0xayjol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725034, "uuid": "a2a83b21-a916-47e4-89c4-7043c92d28f1", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725034, "uuid": "c8385856-7cb3-4200-b8c3-ee73f0e612c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725034, "uuid": "4dc3de8b-f877-4bfd-b1df-eb1b12bff338", "value": "056e17a0478ce166200140dbe0165140d8f7c851f0acc0cca6d1f267df1eaeec_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbe2070-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644938, "uuid": "30879a6f-7a6f-4419-b3f9-37c4e088dffc", "comment": "Malware payload (Mirai)", "value": "edcc5ae2de5de7ab77b14f1750d10bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644938, "uuid": "681f9b49-379a-4b1d-a460-db0b6a15deb3", "comment": "Malware payload (Mirai)", "value": "05d47634e064d5d78d15c1edccdeb5e1439949a716e28750c6679c6a02a127d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644938, "uuid": "eea3fecb-6267-4f66-89b3-6154b8a715fb", "comment": "Malware payload (Mirai)", "value": "e5c744d9312437a679c8cdb8801bb68519e5a25c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644938, "uuid": "467bba30-4e92-43a2-ab1e-b6db4c4ebcd6", "comment": "Malware payload (Mirai)", "value": "fb2c11834571b9ff7f4f5f9747ed0dc82568e742af30e1ad6a3103f76ecb1779f72b12825f3b8106949e9566bce0d391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644938, "uuid": "98fb2e55-9487-465b-801f-b374c417620b", "value": "T101132B42322C0E5BC6A65AB0253F17E093BFE9A020F4F585655F9B868275F761087F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644938, "uuid": "3165fa4a-85fb-4bc9-9e17-85e54bb8da12", "value": "768:s2+mLyDPtK4waS1U54GHGeRwb55aasLp5jpx8RbhooAcd/:dnyrt7waS1U54QZkcFMPAY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644938, "uuid": "0dd2317b-bdfd-4279-8bcf-24a7841bb5b9", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644938, "uuid": "e51fbe2d-560a-4f6a-bf4c-df76b003d9a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644938, "uuid": "f03f2e9d-c87d-47f6-8cb2-6a0be6683667", "value": "00okppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048da65f-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725295, "uuid": "1aa3ace2-bd5e-4d8c-a5da-c0edcd50e1f7", "comment": "Malware payload", "value": "9c7dfb001d92c18ab850f454310d4f1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725295, "uuid": "d5ef3930-a1d5-45cf-8de1-4ed71a3f07d8", "comment": "Malware payload", "value": "0677e7283b4a6cd70dec17243c2eb92e341660735c444b5ae42193094d161abe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725295, "uuid": "80333945-a629-43cd-a031-2b14419f9b74", "comment": "Malware payload", "value": "1ba3f939e8e76f597ccbfc97175003ccce95ec7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725295, "uuid": "d7915e27-1723-4424-93af-0e0913eee826", "comment": "Malware payload", "value": "915e8b72b1561071a821fa658d7f0f385ce33fd8b3eb3b1b64688291b83abc94cac8da847e24e6f0edeca6651ef5f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725295, "uuid": "18a7b52d-49fb-408f-b59e-ed84f14ffe75", "value": "T147340A90B2C1FDB6EC998FB820D2530A93BAF081971DEB2B6620FE7C025EB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725295, "uuid": "f20eb5cf-0ff7-48e7-b058-de2ef91d6c96", "value": "ba2998d810e5f2a1d2e360197b580d04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725295, "uuid": "b0459bd8-5e8b-4104-911b-0b3fc25ca110", "value": "6144:f2W7CagsS+zKnkt2mKVuuHypiZ82jSY9/hY:rC97hkoBeQxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725295, "uuid": "cb264859-0543-4ae9-a670-6e062dac4858", "value": 238535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725295, "uuid": "3ba7fdd0-d0bf-4752-8d87-4b75b6e2abad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725295, "uuid": "35cafe34-576c-41aa-a700-fd32af4287d4", "value": "0677e7283b4a6cd70dec17243c2eb92e341660735c444b5ae42193094d161abe_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b07664-3cea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776711367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711367, "uuid": "5e71bf1b-e6de-43f5-b256-097826cf56a2", "comment": "Malware payload", "value": "8a2931d4fa307ffa8cd82134c7eee754", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711367, "uuid": "4d9a7e21-5aff-4aa7-8479-4406b9a8750f", "comment": "Malware payload", "value": "06b9c49a1e5da3ed09e8b20ac7f94750bad136ec98662495edb4136e099cd596", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711367, "uuid": "095883f5-b0c4-429b-848c-57b7e4673305", "comment": "Malware payload", "value": "6d28bf17be82399799c46c0711fd019180aefda2", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711367, "uuid": "93cf2542-31ef-4c6e-afdd-42e744669798", "comment": "Malware payload", "value": "13ee66fafa7b03e96a44a70fd1b61f8fa3a1fce15530631a4fa50f6b502576b6964910564037748cf95f026deb00cf86", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711367, "uuid": "a6ad794c-8e5d-4f51-b8ba-d188ed280b23", "value": "T1DD05BF39B5E594A1FC4705B4CC11DCE44A69A56697300CBFF31F5B1EEB607E883A8A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711367, "uuid": "b2683f85-cc48-4d69-8986-297601b8c4e4", "value": "12288:lGkKbDPDhpC74zAUPlC1XKfRmZqV1s7rR04bqDY001b7undDG:lG9Nw4po1X8RmZg1s3R04bCI1fui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776711367, "uuid": "1cb39165-53a0-4bc3-b6ac-8dce5f5ac004", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776711367, "uuid": "83568cdd-413c-4b90-a7c7-b9281b0635d4", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711367, "uuid": "a1d8bde9-52fe-4a89-8234-e3caea61e6ea", "value": "qqvbgbe.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a48e02-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776725621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725621, "uuid": "eb973e0c-3c1f-4990-9485-f803039c6f8c", "comment": "Malware payload (QuasarRAT)", "value": "99b33c3972f37468103b89b035480c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725621, "uuid": "d0be1f01-114c-4d8d-abca-68fa1b8d2455", "comment": "Malware payload (QuasarRAT)", "value": "07129fa1858208cbdc18e9905ff5ad6e1e1e818b6c9a2bd8b9ec7e9361fe0b42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725621, "uuid": "f9572b4b-e129-4493-82df-0903e15cad53", "comment": "Malware payload (QuasarRAT)", "value": "cf2b7117e4a1e9453b38696b65e602c5056cb630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725621, "uuid": "739e8acc-e183-4e37-9d2c-d40571ad32b4", "comment": "Malware payload (QuasarRAT)", "value": "82962c07769c81244fdc0bb093a725ae1c6093e2cd912404f0099e100ba7af9001895f74844d9ee32599eca9f375ff03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725621, "uuid": "b8395cac-311f-4f75-bae7-cfdf4b8c8018", "value": "T1F8E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725621, "uuid": "583f0dfc-74b6-4038-88fa-39f0495cd5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725621, "uuid": "3a83fe83-13d7-4af3-bf99-e3319ebf7f34", "value": "49152:rvbI22SsaNYfdPBldt698dBcjHvCxNESEik/i+LoGd1fTHHB72eh2NT:rvk22SsaNYfdPBldt6+dBcjHax1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725621, "uuid": "539ca5ea-dae6-4837-8e2b-8a37a4683606", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725621, "uuid": "ce98fbc8-c440-4218-8a72-d52910fe10f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725621, "uuid": "385bd907-4478-4ddd-874b-22ff012ce6d1", "value": "07129fa1858208cbdc18e9905ff5ad6e1e1e818b6c9a2bd8b9ec7e9361fe0b42_9ed80aed-17b9-4c51-b8ce-0d2fac01c3d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8873e2df-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776666675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666675, "uuid": "d710b783-3961-475a-8741-6add7de4bf5b", "comment": "Malware payload (Vidar)", "value": "3068b4638f941c80b5ac2e4ebc200d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666675, "uuid": "a7dca16d-2650-4823-831a-a035c09ddbb6", "comment": "Malware payload (Vidar)", "value": "0726714ab700cf835daf3a9942cf383a0374c2ddc5d8e59ac20d641068933706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666675, "uuid": "8d8778a7-76d6-4b4e-a269-4e2d424e8199", "comment": "Malware payload (Vidar)", "value": "f36f658ae326d7d930f4e4da1ef8963c65257216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666675, "uuid": "28bfd4c0-5e8b-4170-b9d2-b53dd211ea34", "comment": "Malware payload (Vidar)", "value": "2d82875fe1273c4fc54b96d4720b0c8ca744bac78b9c784c5b954247bea35fbbb431a97e4f0951353ee1709e7be4e96e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666675, "uuid": "0ae6a7cc-18ea-42fe-9602-a1580260c1ae", "value": "T1D5B57B0AACA414F6C46A57368DB762917B70FC0C0B3223D32E917A782FB6BD19DB5744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666675, "uuid": "8e3a63e6-88ab-4a49-aacf-fc6aeac7adae", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666675, "uuid": "97ba9f6a-0bca-4f3e-ab76-c1d30fe16589", "value": "49152:7sDayJmdSsDBzxVgymWHo1Y317vomCTIgq:7srMc++Hy3VgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666675, "uuid": "875bdbda-91fc-4bfe-afdc-b616af040176", "value": 2341040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666675, "uuid": "2c967c4a-18e3-4ccb-9fad-e700220a6a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666675, "uuid": "aac6cb9d-d9a4-4db2-8c45-697ac6bc0305", "value": "Bootsrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c5f665-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776665760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665760, "uuid": "37138208-10ab-4829-9144-5d3fc4193e7e", "comment": "Malware payload (WeedHack)", "value": "b039917918e6e85ca49368059a030f5d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665760, "uuid": "8b2a40c1-b6fb-4333-927d-fb21ffe7d1f4", "comment": "Malware payload (WeedHack)", "value": "073d1aba226079250a01b76098077d56eded8ef8fe857992b03b8073897e646e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665760, "uuid": "77994574-a9c1-4118-89bf-01851ce6416a", "comment": "Malware payload (WeedHack)", "value": "39aba966378f79a279f39b1d0479543216b1e045", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665760, "uuid": "82dea7cc-b326-4982-9574-ff98d4c94b36", "comment": "Malware payload (WeedHack)", "value": "f0e08cc39f01d18014b12f602f2182950cce72b06e1c071c6ffc19a77f0ad4498000342b43e61b6a4c2317add0d9664d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665760, "uuid": "1d065717-ad47-4869-a657-c834b99ad8fd", "value": "T1BE0512638CA903B9BD687B74145195806BFCE508BDE8CE3B7DD20C836A396F93A57700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665760, "uuid": "3dc312e4-ad52-472a-bced-af09f8fa5222", "value": "24576:Zx6k71D4IBnIaJMsjkHItO0ALIPZOBHQRIOaI:Zx6kJ4mnIsMhUYBHQ2ZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665760, "uuid": "76ae083f-1dc1-4ccf-ad15-399aa3183554", "value": 822407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665760, "uuid": "52998b3c-09bc-4877-9478-cd152fba7634", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665760, "uuid": "88b12518-6cc9-46f9-a43b-a4efb9255eb4", "value": "SOA_20260115144743244.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ac2126-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674779, "uuid": "517c8124-1f3e-4429-95bd-5d9bf563009a", "comment": "Malware payload (SimpleHelp)", "value": "dfb3eeaa0d1c0a4fc470d671b5fa2679", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674779, "uuid": "bdd59834-35a8-4b92-87b5-3158a8f91cb2", "comment": "Malware payload (SimpleHelp)", "value": "078d5aab66d5081f759c7bcb3fad6318563b2c2b8c7cde29950c403e2b364af9", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674779, "uuid": "903e8300-1637-4f99-831b-eafe10e3b724", "comment": "Malware payload (SimpleHelp)", "value": "7f77e0addf4c4b6ba20bf9f19e5aa64fed129ab4", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674779, "uuid": "a1bfa2f8-d95c-4b01-b76b-664400999fd6", "comment": "Malware payload (SimpleHelp)", "value": "d17c5854fc196407b6c9fdb865fc78c65f8940a9f136eb5029e5cd8115392e2e5bcdc402f014b9693bc3237c78486f21", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674779, "uuid": "97cb334b-0982-4143-9d43-2912b6ddad12", "value": "T19D773324FAA16DBEDF33D5FCC4464147AA5AA4A70389211327F145E68F207D0862FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674779, "uuid": "c452989e-e42c-4614-a55c-a0b56c0deb67", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674779, "uuid": "89e381df-c3f4-4354-86a1-f6ca779b06ad", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcc:K/jkCgpPUK8PyL7M8aE1VWhroHFcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674779, "uuid": "d8fb827c-ef69-43c5-8367-115632e8d1a2", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674779, "uuid": "43ebef74-5484-4a03-9950-2f819e9990d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674779, "uuid": "fe593b0b-93bb-4b4a-9c0f-986dac7febc3", "value": "078d5aab66d5081f759c7bcb3fad6318563b2c2b8c7cde29950c403e2b364af9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36d674c-3cfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776718690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718690, "uuid": "62bbf64b-fb8c-419d-b8af-8ba500b3a138", "comment": "Malware payload", "value": "547b2aaf0bf80f846e2f0c1ea166ed94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718690, "uuid": "1139146a-b711-4887-8cb9-8b39b54721ab", "comment": "Malware payload", "value": "07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718690, "uuid": "25941bbe-05f3-4d6c-af37-85f77f984c9b", "comment": "Malware payload", "value": "682869d308b976aab3fa687385fe389676a8ff76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718690, "uuid": "aeb1eedd-df5e-4409-b39f-8c3b0504ddd9", "comment": "Malware payload", "value": "8635b2c20919936913c46cf48cf016a41743ca4f2bae18342b3304e1735e2c0f5bb872f68ab7c405bbcd4f2acbecb335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718690, "uuid": "8fa5adf7-f3d0-4f27-836f-e95bdf09f4e4", "value": "T1EF28E01663E112A6D577D138C79BA203EB72B40713309BDF729C03652F63AE45EBA760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718690, "uuid": "10c56cdb-63df-4579-b451-dbf97d864e47", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718690, "uuid": "3bef082c-41c9-4e6a-a500-ca20358903c3", "value": "1572864:lVDG5MiP2aVxUXx2XTnpOuQ6VVJnBgt1F+6DudYaux4:lVDG5NVyx2jnpA6xnBgt1F+dOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776718690, "uuid": "475a9154-3b26-4bc0-81b0-ff1d9205bbc6", "value": 95714544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776718690, "uuid": "b4210114-5269-413e-a875-617fd34bbe4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718690, "uuid": "343c5618-71c9-441a-8bb7-140caac896b5", "value": "OutlastTrials.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6cf804-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687538, "uuid": "9ae22105-1b0b-4b9c-8b12-1251a419ea05", "comment": "Malware payload (Mirai)", "value": "ab512d3f67f305bb3cbe424647f94405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687538, "uuid": "4f34a5b8-a2e3-44e0-8762-6dd548f132ce", "comment": "Malware payload (Mirai)", "value": "0893f17f06348d32d64e599728b8f5ed40cf169e7afd6f71e1c6dd81593d83db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687538, "uuid": "faa69039-0071-4abc-9a01-7f075d141917", "comment": "Malware payload (Mirai)", "value": "c322e09b05cf1ab97f41ecc3b5fca734a9c30e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687538, "uuid": "6b1d19f0-8e0c-4a56-b741-79cdaee87be9", "comment": "Malware payload (Mirai)", "value": "9568e64e90973e75bee2c07525647648604ad39786406369dd30c42cf40adc01fd434daf81d5828bbe138cecde76ff91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687538, "uuid": "2fa13f8e-090b-42a4-8b02-19f665d7f5b8", "value": "T188C32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687538, "uuid": "4008ad9c-7714-4b6a-b525-fbb81c9bbca2", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZGI+oV+M/900i/:eU/44TMKFx5oFxh0nlI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687538, "uuid": "b992f2a4-592d-4adb-8638-338fc9cd0337", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687538, "uuid": "36e21591-5e9c-49bc-b5f1-e3e6306929a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687538, "uuid": "c57cdf4d-b3f6-4099-8c8c-68e217de45e2", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c854a6f-3d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720718, "uuid": "9be39812-11c9-4890-95b0-3837646995f3", "comment": "Malware payload", "value": "32d3c81f216848ea8738c18d6abaa82b", "object_relation": "md5", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720718, "uuid": "09cec697-8370-4094-8fee-c312f954df74", "comment": "Malware payload", "value": "0941292775dbab5f96b5236138b3137313a06d1621a874a6989cc89e35fc307d", "object_relation": "sha256", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720718, "uuid": "e056afd8-f678-4a29-9731-4bc189a4166e", "comment": "Malware payload", "value": "4350700ff5060cdac279f69ef231b7a3cef41f94", "object_relation": "sha1", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720718, "uuid": "0ff72681-1c22-437a-979e-df5841e0d3a3", "comment": "Malware payload", "value": "f967f5a32719c8ea05b3c69aaf511f27978949bf71326e5dd4fbbb124d4c054d96f1d1b0df2a9a6ad7447af6de7659a9", "object_relation": "sha3-384", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720718, "uuid": "48c927e3-480b-4805-9e6e-695bb481404c", "value": "T117856B17B35608F8E556D17881838726E7B2BC451322EBDF13A9C6792F13BD1AB3E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720718, "uuid": "1242d705-175f-4a1e-8664-3b582c305291", "value": "24576:2vh7vh7vhfLJgzzM0cYMmjsCFxU+9H0N/sM7r6bgiD89rxZCQEKZm+jWodEEPQt9:2Z7Z7ZCzzPcYMmjsC8+lS/KbVI9rxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720718, "uuid": "5e30ed48-2d5c-45f9-8baa-7a20416443c9", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720718, "uuid": "947a534e-e667-4af6-a972-10bb10bcbfa6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720718, "uuid": "e3637bc2-45ee-42f5-a5d1-59e5c8c873d6", "value": "\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025f0ae3-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725291, "uuid": "c593a427-c42f-40a3-b9ae-6756f3ee2e2c", "comment": "Malware payload", "value": "90ff7d2c3d53376f705b71dd22b9d999", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725291, "uuid": "8bc45bce-affb-4e8f-8ae1-2b540cab23e4", "comment": "Malware payload", "value": "0948c44b0955957841629c838f8b6830def5ae8a2b6b162cb171485125dda638", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725291, "uuid": "8b3f197c-f94c-436a-8ad0-7560c97d2240", "comment": "Malware payload", "value": "197c7369cc5c2160b1db55e79681d09f2a80643a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725291, "uuid": "903ead21-2660-4ea2-aa2e-e8a7bab3c940", "comment": "Malware payload", "value": "f83f8f998fa98f43fdb53a0aaca386caa3dca4c82138f85004014d67371c20a99f0924dd898188fef350d734f8910aa0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725291, "uuid": "ea306680-6cb4-4828-9c8d-400163fe2158", "value": "T15334FB90B281FDB6EC998FB824D25309A3FAF081971DEB2B6620FE3C025EB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725291, "uuid": "88ab6ce1-1494-414a-b447-f0d81ea513b6", "value": "854b6781579c224e49d0da48d91ede1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725291, "uuid": "f1020fca-4865-43f1-934b-06a7f4af6a5c", "value": "3072:jF/Vl7xAaE90S+MtKnkNsT2D3KVu/HyJOiZPfdU2joQEWbj:B7CaEeS+UKnkG2DKVu/HyoiZS2jREmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725291, "uuid": "1ffb932d-bbc9-4281-b2dc-e75bf183e0a2", "value": 236592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725291, "uuid": "00abbe51-55d4-4ac9-858d-2de8b2ccbe9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725291, "uuid": "d847912c-0ac7-4fbc-ae06-270a66eb933e", "value": "0948c44b0955957841629c838f8b6830def5ae8a2b6b162cb171485125dda638_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef61cb4f-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688323, "uuid": "4e25f600-6bed-450e-b166-b9273002846c", "comment": "Malware payload (ACRStealer)", "value": "c11491fe94e9243577ae9f6932131983", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688323, "uuid": "48fd0496-b6c2-4bde-ac8b-278792bbbf1e", "comment": "Malware payload (ACRStealer)", "value": "095ba6fafbf3d7dab3ab31ac2e2d8917268f925020919214a571bd0cf8588756", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688323, "uuid": "aee02fce-9183-4903-8582-c5619f20f8ee", "comment": "Malware payload (ACRStealer)", "value": "a6f094ad16e4e67959280af88ce920b08c242c05", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688323, "uuid": "0bb71e58-435a-4531-acd3-69481b228253", "comment": "Malware payload (ACRStealer)", "value": "de162c433431db3dccf42baba0c597f65e9bc22ea8fd44eda1858d4f2eba1b885d3e63d0d67df24985ab833062c376bf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688323, "uuid": "079a2852-f6fa-44bd-b7c7-8ffd772323d9", "value": "T14F168D1BFDBD5C69C0DAB27084336601B5A5B8055B2267C71A60F6A42F7B7F08BF9B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688323, "uuid": "e3e65ef9-05a3-4976-a79b-31084d30be64", "value": "eb07c4684347f8dbb1b2268ec3ba6bde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688323, "uuid": "bcd45359-5bab-4d44-9110-3e150da5cbc0", "value": "49152:scuDn+zdS99Vs05GN9RHa//rPv1aonlNzMQaXhDWyKh2nbDvoRjaIpQcTk18:scgRNwQaRDWyKh2nPvnIq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688323, "uuid": "54fd9ea8-acf2-48c6-97e6-72f841dd2442", "value": 4386792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688323, "uuid": "cab032be-f3c0-4068-be3f-bf2839413d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688323, "uuid": "8bc47f17-0c7f-420d-b319-15d32e37b0cb", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090b207-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776724832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724832, "uuid": "7fffa470-bf30-4691-a9ab-ca77369239c4", "comment": "Malware payload (AsyncRAT)", "value": "0df125c0bf80fff484b7aac57a5bb0ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724832, "uuid": "d8f2d219-c101-4e8a-8ae4-d16466d04eba", "comment": "Malware payload (AsyncRAT)", "value": "09d1865e49d95d190175dc9e77dd3fb745216fa3eec1172bee66bef86b9c65fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724832, "uuid": "c88c753e-5962-4609-97a8-c2b2cfd5b679", "comment": "Malware payload (AsyncRAT)", "value": "53cb2eaf53a080c4d3797301cabc777be6de9445", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724832, "uuid": "4af386fc-1495-407a-80ba-ee73d6b1ce57", "comment": "Malware payload (AsyncRAT)", "value": "71e6e0da3b8ca875fcfbd9f04e756b06ea2e0f871a733db8b99d87afe1294d47a42446b17e45c86e1a3c97a297989a30", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724832, "uuid": "33d41ca7-59c7-47d5-87ea-6f77772d3a61", "value": "T16BB34A6B72A900BBE1778638C4A74A45E772B85147A0AFFF03A4425A1F637D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724832, "uuid": "1af48463-dfd6-453c-bcfd-370535e2d6d6", "value": "f5eb1d3bbd238d7f14a80742e651ccaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724832, "uuid": "3f1e6005-b2f2-4f0a-8b31-f0bad4988f15", "value": "3072:Jj9Xf3irLrXJpuYmc0m9zsvE9by3EBKD:VB3OfZAcXFDBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724832, "uuid": "a8e117f9-039a-49a2-b0c3-8d7bd00924b1", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724832, "uuid": "51adb416-335a-40e8-ab73-b4a0d910bd9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724832, "uuid": "1b686b37-c820-47b3-b570-ff59c5fb922d", "value": "09d1865e49d95d190175dc9e77dd3fb745216fa3eec1172bee66bef86b9c65fc_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef88bb5-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725259, "uuid": "714c3ae1-6b63-4dd8-8c8e-290645adfd2d", "comment": "Malware payload", "value": "7461d08e73c953ff86fac4d395fd643e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725259, "uuid": "e8f6d914-16d6-4f9a-961a-9e741d606a96", "comment": "Malware payload", "value": "0a4a7e30e34d9432749e11fb6343deeb4676b919b6568bdb5bb62a8fc3fb3c3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725259, "uuid": "3c0cebb2-8ab1-44a2-90d9-81b485072f9f", "comment": "Malware payload", "value": "006e2bac7d9dd245ec7ff71c0a0f11944a5b2f24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725259, "uuid": "e1ea3922-d45e-4197-a835-9c5ba9721eda", "comment": "Malware payload", "value": "c93fb1dc9a076ca2a2c486b0e2362436cb9728fcb7afef2d8d7a135380ebe009322a807dcf9e6bae978e9b752a31e510", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725259, "uuid": "af1d59e6-992c-4eab-874e-9ac7bce27e2c", "value": "T1BBA36A47A2EA00BBE2B78678C4530A4AE776B85507616FFF43A4424A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725259, "uuid": "96c9d767-a853-44e5-8f4a-cb00fbbebd88", "value": "17d9f6dc5709bc89a29a2a965c42f00b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725259, "uuid": "c5e02090-a092-432d-994a-189b76f65088", "value": "3072:GEHzKjpAqVexNGpAQbUwkhyMI8vmSO/7njPL3cIbHD2GgNJlLJKNryjuFbHV3MGy:GDjpVVevtMUwkhHKl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725259, "uuid": "4261fe59-fa42-43ef-afb7-ff927c6bb95a", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725259, "uuid": "179fbc8e-8deb-42a9-ba80-3d804f389ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725259, "uuid": "e31f7b0c-b511-4c86-81df-ed147faf5ad5", "value": "0a4a7e30e34d9432749e11fb6343deeb4676b919b6568bdb5bb62a8fc3fb3c3f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c09a2d-3ca8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776683065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683065, "uuid": "a15b0213-46f0-4ce4-a117-aefb34253fdd", "comment": "Malware payload (Mirai)", "value": "c048a27a3675460563b586e4d27a107e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683065, "uuid": "ce260357-418f-4f3d-8f52-c83e65fa893f", "comment": "Malware payload (Mirai)", "value": "0a548b4a395f7117b6dced93045b4f8474555db305afed283a88a71635af0471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683065, "uuid": "4c6be274-1f5b-4ec2-ab94-1b8180c5f031", "comment": "Malware payload (Mirai)", "value": "5e5e5f912cc842debaa6540364340dc16009b36c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683065, "uuid": "24e9fc5e-8926-4071-9dd8-bb73663b96e7", "comment": "Malware payload (Mirai)", "value": "c706313164fc4454f8ab0d0142b46c34b8dbf7ebc80e9fff3be96fadb057502d0b1d50d7bb21a1323477ae8fb9b9cc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683065, "uuid": "26363867-03b9-4b5f-a4db-89e4b901d4f8", "value": "T17D145072D54CCAC7D426727D50A98F7B9D3E73EB2645CD017DE1203689E6B9B280BC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683065, "uuid": "9ac08107-ac7b-4ca1-86fa-15774ec54558", "value": "1536:kLyg6D6dN44PtfjH7gEa0FpeT0SdbiQFzZp5JVXUtYxURy5KyDy2qhe2jeMKI9I3:LO/6gj9hpoPFoVd58syBeNT+Ix7DkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776683065, "uuid": "39e284c3-adae-4a09-b727-8967974a07ef", "value": 205148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776683065, "uuid": "265b9882-9dbf-4231-9b23-02d73a360490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683065, "uuid": "1b972882-da4f-4af6-a0e3-80ebbfabb4e3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbced73-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676563, "uuid": "1ad546a7-423f-450a-bc45-ac6822e199e6", "comment": "Malware payload (ConnectWise)", "value": "f4abafa6dbb7aa149e8b1c736d509147", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676563, "uuid": "2b17aa7f-a911-44f1-b1ca-dadaf2f5d2aa", "comment": "Malware payload (ConnectWise)", "value": "0a90b4ff29bb6231693fec656e0eed463b2df9604dc074c61fb75ebfa2e856a0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676563, "uuid": "3c236bae-599a-4961-b664-cdb4aeccd2d5", "comment": "Malware payload (ConnectWise)", "value": "0ca79918146c64f110ded85e9f2bb169a5756a05", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676563, "uuid": "c5e4a57f-2a70-45de-8117-351d765650e6", "comment": "Malware payload (ConnectWise)", "value": "87a312f53080bcbf3a35e4bcc8416cd94520de695402669b8c6349d3a1c539677502934eaeaed28410d1693db6cbdfcd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676563, "uuid": "f5595128-1c03-45e5-953c-5fdca97df59a", "value": "T1E546E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676563, "uuid": "f5877a69-871d-4543-9332-ceb03c56a21c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676563, "uuid": "1bbd973a-6f4e-4b76-85fa-9e9d8edd596f", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676563, "uuid": "db14f5f7-c54c-4d2c-9b5a-b0091d83af50", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676563, "uuid": "73de5ea0-74c7-4bae-a94f-9ac3f1796230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676563, "uuid": "3d3e20dd-cd16-4191-a10f-0d89ca85fd33", "value": "0a90b4ff29bb6231693fec656e0eed463b2df9604dc074c61fb75ebfa2e856a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5adb1f3-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725565, "uuid": "02f65f07-55fb-479f-9506-d50c18d88dfd", "comment": "Malware payload", "value": "7714193529f0673ffc926d66d964bb7f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725565, "uuid": "28f23f56-2ade-4344-b0f4-2089b2e1c344", "comment": "Malware payload", "value": "0ab3a599159e9d8d97ea5cfcbb32ba1fc3e40d4210012f2bf75b624841e6a559", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725565, "uuid": "5763ddb6-6754-48bf-97ac-aa2920fb4ba6", "comment": "Malware payload", "value": "af473688c6c5bd081c5d640f449cc8e9ee31ac71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725565, "uuid": "947a641a-76b2-4bc1-a541-60f819bcc235", "comment": "Malware payload", "value": "b3f35bee31c6cdd7ddc70fa10e4b3ca2a6ffc5875403c36c91afd39f1923225d759d69c8600bcdcc107a9c016dd228f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725565, "uuid": "e8f743ea-fe4c-4ef6-ad63-ba8cd825de0c", "value": "T179A34A5B76E900BBE1B7863888670E45D776F81617619FEF03A0425A2F633E18D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725565, "uuid": "5b5426c5-ab91-4fa6-97bf-5f912d315b83", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725565, "uuid": "66dfe569-255e-4b77-aa86-94dd9103ce28", "value": "3072:TDAwoPt0PRG7nQbwAwZDuf+0PpEqFOAkw:fol0pAMwAwZS/lhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725565, "uuid": "f5650e12-a17d-4fe5-80a6-8b6d075c9b1b", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725565, "uuid": "515faa14-6a56-49d1-874d-b65bf6314516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725565, "uuid": "a4387d87-b74e-4155-a9a6-8f3d21e84c0f", "value": "0ab3a599159e9d8d97ea5cfcbb32ba1fc3e40d4210012f2bf75b624841e6a559_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6838de8d-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725892, "uuid": "3df26b65-46a9-4cd4-8cb1-05aa61566d6a", "comment": "Malware payload (AsyncRAT)", "value": "2c6e2b0754086b25f22e5885f4a5a4c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725892, "uuid": "d7e133f5-3d0b-4432-ad71-3c85ccdc44ca", "comment": "Malware payload (AsyncRAT)", "value": "0b834be7c5b7197451ff729390f6c4048d9108738b015bd7dbccdb39e3c9432c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725892, "uuid": "c73c0dc1-e15f-4afc-aea5-7bdaf37a1850", "comment": "Malware payload (AsyncRAT)", "value": "afd60d7bfa46986c3d85dd62ca66b2dda2ffbbf5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725892, "uuid": "3fd48750-9f93-4fb1-8447-6a86c39b1368", "comment": "Malware payload (AsyncRAT)", "value": "3bc84812faf783630deb24461494db5581f0281451ee008be6741923da799819fe4ed7369f2c4b167f9b6416970eda79", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725892, "uuid": "7c710ff9-adc3-4eb5-8e85-568408e797fa", "value": "T1F6B34A1B72B640BBE2B78238C4930A05E776B8555761AFEF43A1425A1F237E08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725892, "uuid": "464b9903-ef33-45d1-b163-48304fa6aaa3", "value": "ffb74f31e87b8cba424df1a04cac76c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725892, "uuid": "0e78af9c-ac88-403e-9dd1-5937fcebbeb2", "value": "3072:0lCEK4auFGUFQbgQe9ma+JxZ4Cv2GWwD80p5wCDvmXT7RLyzfWC7PlCaHZkWEWn2:VEZas9MgQe9N7anYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725892, "uuid": "e52cb125-fcce-4801-a1b7-abe6da6c8d7b", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725892, "uuid": "cbe72c27-e5a9-44fa-9510-289c9765cf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725892, "uuid": "1c483c69-9b41-4221-9676-c6b5ca197883", "value": "0b834be7c5b7197451ff729390f6c4048d9108738b015bd7dbccdb39e3c9432c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9534c998-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725538, "uuid": "ca541790-44cd-4604-991a-07b4090c33b3", "comment": "Malware payload", "value": "926a0f9e832cb9c03d21c4bc31d0c328", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725538, "uuid": "d77e93dc-b142-4899-94c4-dcd6e55ff2a0", "comment": "Malware payload", "value": "0b95a5f8f11fcc69e72663fb193d1d63d3250b0a4e76f3420d3fbd953a1dd909", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725538, "uuid": "43db72ba-11fe-41f7-aff8-cf648ebd6581", "comment": "Malware payload", "value": "e5edb77e8f31d3230d99f7af7e5cfc40c7f707b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725538, "uuid": "683783c2-050a-44ec-acb6-c27f8b2a8cfb", "comment": "Malware payload", "value": "f068ad2fcd55fe26bc14230d202e5697f6e193f68963dc337a7fb1e7000140ba7a19f2a39047b5c39ecad2eb3cfb773c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725538, "uuid": "0bd8470b-c00a-4dfd-b515-da196e9d479e", "value": "T191B35A4BB3A500BBE1778678C5630A46D7B2B8911760AFEF03A0461A1F277D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725538, "uuid": "ef2d21be-e909-40d7-a08e-cc3d6be44f47", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725538, "uuid": "ffb602f5-fa5a-407f-ab30-18e4a79c326a", "value": "3072:I/azEnyFSpckqn/JqGlJxSjj8TckVPxIiTRQEol:IuEyY2n0hsiEol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725538, "uuid": "3e16ed2c-e036-490e-9409-a4f5d06f9a21", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725538, "uuid": "fdd38846-0283-4787-ab7c-6c74b6134ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725538, "uuid": "ef2baf47-005b-4736-9bed-4091b426739c", "value": "0b95a5f8f11fcc69e72663fb193d1d63d3250b0a4e76f3420d3fbd953a1dd909_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eec8037-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697503, "uuid": "2ae6f2f7-24cd-4396-a731-0d27434624a4", "comment": "Malware payload (AgentTesla)", "value": "c174a894e8c586d4a4bc489d30eb955c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697503, "uuid": "d95135fd-7193-4523-9114-e160aa0ebd2f", "comment": "Malware payload (AgentTesla)", "value": "0c47be0e418a8aea71b8fa800dbcadb1e7731f726de0539b3afee21650fec8e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697503, "uuid": "0a4adfc9-72d0-41dd-b346-8a15c9c87ec9", "comment": "Malware payload (AgentTesla)", "value": "367137228b3527ad49deb5266c0e9b2e2bb60a42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697503, "uuid": "368ad245-a688-4a87-b986-b72936bf60a7", "comment": "Malware payload (AgentTesla)", "value": "87b7edabb3a4e0a7f230c390394e3eedb388d43938f7c9274bbc6311cc6ad9aad4b90adde7dab9d51b0dabbc2459d003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697503, "uuid": "4f968a52-67bd-4584-bcf5-b13a72b4413b", "value": "T19C55021189C42FB9CFAC5A1D90FE160EA3F0498E5016798EFB63BD47AFE7604521B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697503, "uuid": "8c527796-5eb0-4f58-9ce9-f48f5d105b9f", "value": "24576:bd6qoKi71EQK0pWm15UFMLpHl73GHiWzadZ/f:B6IspWadI0dZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697503, "uuid": "09db3e39-c368-4635-b2c3-944ec22e3d95", "value": 1303373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697503, "uuid": "d9bdaca9-970b-491f-bff8-74dcba82bc73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697503, "uuid": "b9ae0642-a2e4-4f1b-82c6-80b25aea7f3c", "value": "Payment_MoneyCorp transaction.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3948a0f6-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776688017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688017, "uuid": "dc691be1-2d94-42a0-80b6-a7a085dd404b", "comment": "Malware payload (RemcosRAT)", "value": "bedc0a91e08fd638d369d88fff6d07f3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688017, "uuid": "2ca80a81-e2f4-4a43-b160-b6dc7b5d11bc", "comment": "Malware payload (RemcosRAT)", "value": "0c931150e84d9035b8650b5c69746765e0ac6798c5e06fbe4100f3c1fa4acaf4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688017, "uuid": "0bb0d5f6-48e0-4e2d-b0ed-8291252fc7e9", "comment": "Malware payload (RemcosRAT)", "value": "c099a1fe8facd5b9db13deab11ae80e99da152e4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688017, "uuid": "ce9938e0-e4c3-4c96-943c-ac8e01abfc2e", "comment": "Malware payload (RemcosRAT)", "value": "0b3789bbe6846196e1bed1dcebe6834b8d47fcca7021131c332bbd508020a75fd61e641bac36d8e96e13a77c82b9afef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688017, "uuid": "2d323bdf-969f-4458-87b0-b78e7e30b0e5", "value": "T18A25E076F94588CFC417C2B07A12DC900B4EAE52B758ABD2342E7B66B773E5DDA83041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688017, "uuid": "5cb64a3b-7f74-4e6d-8c3b-27cd902708fd", "value": "24576:f9rVcBeAK3odlP9rVcBeAK3odl+mYEwu:fhVUnhhVUnIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688017, "uuid": "efa7f631-dae7-4f9a-b9d6-7ffd1a225017", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688017, "uuid": "dfa0dd3c-1c6c-4292-aeae-74f6b38e7c4f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688017, "uuid": "a4822ef3-7f2e-46a5-b165-e918c1d501cd", "value": "WULMAX_PL Zam\u00f3wienie.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d700af6-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776725122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725122, "uuid": "f2cb2cc4-d113-4efc-8ef7-b300f08fdb20", "comment": "Malware payload (QuasarRAT)", "value": "b07eabb4e5fa3b77a6a491c3da6142a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725122, "uuid": "6ca6d9f4-3717-4559-94b2-8662b1604597", "comment": "Malware payload (QuasarRAT)", "value": "0cc99818eb254032519590737c6df2552812a605e76c2fc74d15bdf1a8f86210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725122, "uuid": "2b028670-f203-4547-a940-4572958c81eb", "comment": "Malware payload (QuasarRAT)", "value": "1dd0607023ed31b660853f2639c9e236f8cdc1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725122, "uuid": "5cceb666-dfaa-4a10-b025-0d0156507747", "comment": "Malware payload (QuasarRAT)", "value": "c4f9903ecbdb8d5876bc3f530bf7c77ec862cd48ed79a12aea21b116c673f7cbbf41ca7a8409f7e7368686e431b7aebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725122, "uuid": "46746aa8-d8ba-4817-98d2-896688664e58", "value": "T1D0746B1477A8C6ABD2AE8779B93107094BF4DD07B1A6F34F8A6450B93DA3381DD406B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725122, "uuid": "a3304e5d-3a46-4bc6-a34d-2e852666cb53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725122, "uuid": "9dcad768-0573-4488-9c98-842b3f2cfede", "value": "6144:5kgFocJuquq7VzxYSabOi7GzMtHSZ+cxm4dQrbNHull52LTPte8u:5DFtJuquqzxYCi7GzMEO4dQZLTPU8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725122, "uuid": "f73a57ff-2f4d-4555-9d0a-08c0b9a7c990", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725122, "uuid": "cb5611e6-630e-44c3-9c32-c986cd68b3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725122, "uuid": "27ab3913-08f3-4934-abbe-8dba3ea1f7ac", "value": "0cc99818eb254032519590737c6df2552812a605e76c2fc74d15bdf1a8f86210_86375a27-2b57-4440-949b-8918f07746ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8796365-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726053, "uuid": "19fba6ea-a77b-4f0e-b588-9941de330c35", "comment": "Malware payload", "value": "51e78c20682e05f93fdd911531217711", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726053, "uuid": "64cc355e-2761-4733-b83e-2dfd7bad902a", "comment": "Malware payload", "value": "0cf1d46ebb1eebd5bf79489157f02aa719d5b50445f3eca3fac20f3cb0a581e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726053, "uuid": "22ef6f66-21b5-4ad6-8d3f-49b111e23cad", "comment": "Malware payload", "value": "9c0723d56cb3fb9e144af29dc5fbbcb2cb8761ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726053, "uuid": "fb7f7307-7f4f-4f78-92e7-08143e911cc1", "comment": "Malware payload", "value": "549381bd5c880f9ba4400e61c75cf17e0c4d70f4056ff5ca6024cafd8a4f3e3c956b9fdd0565e96b3818ce904eaca536", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726053, "uuid": "275e490a-137b-4edf-87e4-05c7f8a13438", "value": "T136C35B5772A500BBE577C279C4A34A05E7B2B8120B60AFEF07A4425A5F377E09D3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726053, "uuid": "b641c3ee-4889-4d3d-829d-6ee1b613e542", "value": "b4e7a0bfff950e00d188e81796a83b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726053, "uuid": "71b9db44-7382-47d6-a6f2-b5f64a88446f", "value": "3072:TldHpV7E/49XAvqTadUWKYwjgMFWU/IPeiIoDav:f7E/eAvCMZwjgAWglkav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726053, "uuid": "d6146d80-48ec-4a07-83de-fd1a29c68ea2", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726053, "uuid": "ff6aa6b2-5031-4a46-93a5-79612324908f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726053, "uuid": "4f6e9d4a-e467-4099-82f0-acc8d8859cb9", "value": "0cf1d46ebb1eebd5bf79489157f02aa719d5b50445f3eca3fac20f3cb0a581e8_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977da7e8-3c9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776677438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677438, "uuid": "12f56c24-9a12-445a-859e-7d0788492ec5", "comment": "Malware payload (Formbook)", "value": "e7bd99fb1b2d4cf2b974bd25d461119f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677438, "uuid": "b26633bc-2e6c-4b8b-9635-4f8be6ae34b8", "comment": "Malware payload (Formbook)", "value": "0da7e11fab603527628fab5096438b2efc5fd75d1763773069a094ae4e68a9bb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677438, "uuid": "6f36da59-3565-45d3-8982-acbd1f75e7e6", "comment": "Malware payload (Formbook)", "value": "8dd4559db6824940457c381b772219b6cd144021", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677438, "uuid": "523bbea0-523c-45c2-b009-f886ead3e4cd", "comment": "Malware payload (Formbook)", "value": "52ac73be025da9432ab4a492e51ce87a2abe49ae9fe0a088a275d4a9ec305e14282f350e5c828e53dab1a876672c3777", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677438, "uuid": "7da97ab2-ce5a-4b7c-acb0-d73a11ff8024", "value": "T1C6F261C83BC7B5A21E4230FB382B7052F53E8D80650D4454F6E891BDB968769D5BEB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677438, "uuid": "d7907668-4f53-402e-bae1-a098d76415d2", "value": "768:eB62ZJgG5HOs5DUM/lSz8gJ71jKN1YxMInOJ8aIFZ2n:eQpG5HOs5gRzXJ7JKWMRJ8aIf2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776677438, "uuid": "c5d928f9-8578-4d32-b129-f0072feb32ce", "value": 36169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776677438, "uuid": "64f8844e-7acd-42b8-aeaf-0101f930a236", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677438, "uuid": "eb6a845c-b5cf-444c-8d49-ad010252c213", "value": "Bozza dei documenti di spedizione \u2013 Conferma dell'indirizzo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb8b56b-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725659, "uuid": "0da81a14-d734-404a-a4b2-77bf2ca7264e", "comment": "Malware payload", "value": "4978ed03bfc965f76de5e5125db2255f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725659, "uuid": "03635c0c-6559-49c4-9c2d-52ad3bf7f105", "comment": "Malware payload", "value": "0e6e36bbddb377f477e49c6555b10d0cd7e9c2d5715dd925a31caf1fd6d4706d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725659, "uuid": "2838463f-041e-40a5-b8da-cc684856674f", "comment": "Malware payload", "value": "7c66035245ca703453e506518599dcb0ca7e58ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725659, "uuid": "a7bff00b-063d-4b73-85d3-154fceec237f", "comment": "Malware payload", "value": "2556e1a46f1ef6d53cccc270e41235853ef07c68c39b1d1c84cfc0c154e18db764d24ef6a17db7029cbadde09d25f92a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725659, "uuid": "cc69e704-55f5-4203-a1e8-b4718ae37bb6", "value": "T144A34A47A2EA00BBE2BA8678C4530A49D772B8551760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725659, "uuid": "9951c5f7-9e35-4618-a91a-1b7925028386", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725659, "uuid": "3a657fff-6378-4b33-abb1-45f2d432fea4", "value": "3072:hhTeXQwDasaAmiTQhAS/xYN0q51756565rnIryHi/C9rK:HeXbuFaTcAS/0Ki+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725659, "uuid": "b11eefd1-aff6-4529-a072-f3676d4083a0", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725659, "uuid": "64c4ffba-7cbb-49b1-a505-80b5b6e482f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725659, "uuid": "a8a79cb6-f92e-4160-b9b6-031ed6476edf", "value": "0e6e36bbddb377f477e49c6555b10d0cd7e9c2d5715dd925a31caf1fd6d4706d_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ccb291-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725841, "uuid": "5285c650-7bc3-4925-b470-5a6bb3ca14df", "comment": "Malware payload (RemcosRAT)", "value": "0859f93ed53ac3cceb08f99a6764f653", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725841, "uuid": "eb348677-6022-4fe0-89db-658bd18761dd", "comment": "Malware payload (RemcosRAT)", "value": "0e90a3a7cfa876bb10a2e8711bbff64955f709b39df6abb3aa76f85328fc6a91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725841, "uuid": "a1c4cd38-478e-423e-b651-64d63a1ce900", "comment": "Malware payload (RemcosRAT)", "value": "a5ccf263218cc595e9bb04401716aa4f2f69d966", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725841, "uuid": "63918d3e-4c29-45b8-b2c8-fda56078af17", "comment": "Malware payload (RemcosRAT)", "value": "389adc032ecc194748d7a070f1d58ef1ee37adce9d6099c35c40d4aad8fc8f58bad742d75bf9930cecd3056278fdcd19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725841, "uuid": "0d9683c4-284d-4e41-b7e3-7e5e25c7aff6", "value": "T134821B0EEB4BA4BDC909F27858EB5733B0B5B93206395B2F2328CBF64E40594635F914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725841, "uuid": "b8e75704-7592-406e-a48f-9933570de76c", "value": "2e60d59de481c5fa87667a02d88bd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725841, "uuid": "aadfea29-4cb5-47b6-95d6-5df4883eee7c", "value": "384:4caOs9z9mk5crff4txw7FV8LFJymckVPxIiTR+uTALMy:4XOs9z5c3gxOFasmckVPxIiTR+uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725841, "uuid": "1babdcc6-3dc5-4ac8-839d-6677f4045389", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725841, "uuid": "0d58af73-e25e-48e1-b1c8-0240837a39cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725841, "uuid": "ad48fa08-0a6b-42b9-afa9-624eaffcdedf", "value": "0e90a3a7cfa876bb10a2e8711bbff64955f709b39df6abb3aa76f85328fc6a91_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c23455-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776687990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687990, "uuid": "9554f74e-467e-4fb2-a7a5-5a9842ab3a34", "comment": "Malware payload (PureHVNC)", "value": "a9379508304ca7c2bd340e0a6a2028f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687990, "uuid": "d0b17aae-9f1d-414b-9c64-00d374e309b3", "comment": "Malware payload (PureHVNC)", "value": "0ef84c28fef31e4457241009cada38ee3ba37d7827b6755d046586d4e49159f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687990, "uuid": "ce771a79-d799-492b-8f2d-59b14a55e7fc", "comment": "Malware payload (PureHVNC)", "value": "a9c6851dc49ca8ad60cc5dcf34b756da0939f82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687990, "uuid": "b833c806-eb96-470a-a65a-be4ddf6a727b", "comment": "Malware payload (PureHVNC)", "value": "90328055e76d77c434b4f52c1028af2d31aba82a671a9dc3fd1a7d15db9d631d5bf6c810138169d0e1ea5c0f1e8c13ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687990, "uuid": "1ab3b256-0e23-408e-8cca-e4a573264a9f", "value": "T12DB4229D65E3F883D69223B1F6B6077A2E349F4E5095E663037015EAF8717879E0A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687990, "uuid": "b6caa99e-0320-4a4f-9147-d6b916bb2819", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687990, "uuid": "19a983b3-da10-4660-80ce-2036d17fd210", "value": "12288:GYhFcpFX6JAby4BLF/iAWBnwm9ShSo8l7dHiYVVVRfdzG:RcFnjado0BBCYRPzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687990, "uuid": "4be271c2-ccbb-4d81-9e62-76c2c9d1d9a3", "value": 513607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687990, "uuid": "a46df7ab-0bb7-49d9-a135-3931827ca0ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687990, "uuid": "6123c242-e383-42ee-ae5a-f3f9c43b6900", "value": "SF EXPRESS SHIPMENT CONFIRMATION.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54c108-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726058, "uuid": "d4b3e06b-8a5b-4551-9c4e-31bd6be34b34", "comment": "Malware payload", "value": "dfc30c27b902bcc7b03dc54929ad54e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726058, "uuid": "a106d6e3-790e-42a0-9d73-c49ac57fd110", "comment": "Malware payload", "value": "0f36122ac39cc9bd526d5c414939f72841d1c7495e16990f5cd24dbaa0864f79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726058, "uuid": "5991e8f7-1cc0-4567-9892-1a6b5adce1f4", "comment": "Malware payload", "value": "66d49b6ac1debec1bb3d1d8357e3b950152f515e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726058, "uuid": "80ff75bf-d1ad-4c68-87f5-30b8962f99ad", "comment": "Malware payload", "value": "a76d2b63027cc5a57628a8f366b9946f0c83f2d314183727ef394144cdf24da8e05da97f46750b8e20320e60c72bfee1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726058, "uuid": "4642aa35-e993-49a8-8c05-6649a8e1c86a", "value": "T15AB36B5B62A900BBE17782B9C8670E05E7B2B85507209FEF47A0425E2F237D58D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726058, "uuid": "246f9e30-ea54-4207-b118-093ac98368c4", "value": "0e598da1f6960a365cb8ec24b056e82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726058, "uuid": "5b5df6f0-d27a-4fb5-92a2-8e280e85feb5", "value": "3072:yJrVFRNobqYigGFvQbS5QP2FVZfVQq14KckVPxIiTGpy:6oeYtuMS5u2jXsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726058, "uuid": "4541b6a9-aae5-4b5c-aa90-99959781e46f", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726058, "uuid": "e1444305-2803-49b7-b49c-a7f061877f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726058, "uuid": "30595182-f7f7-4b0d-baf1-c909b4c7cd13", "value": "0f36122ac39cc9bd526d5c414939f72841d1c7495e16990f5cd24dbaa0864f79_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2860423-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725641, "uuid": "743fc671-8342-4b93-afe7-c3fe0bfd7b19", "comment": "Malware payload", "value": "4529f0e9f250c647ea638bd3cd72edfa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725641, "uuid": "b5b91f80-2438-4082-b0ca-3da121a87af9", "comment": "Malware payload", "value": "0f55011a79a851db19afd2e1863867d861dd9c823c1c58e135b6904c9ea634f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725641, "uuid": "93f01c93-f9c6-4b91-ab02-fe0d888a29ee", "comment": "Malware payload", "value": "bff71ae77154c29de1d49b6b40e56f4c6c086591", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725641, "uuid": "3d1ed733-7210-4012-a984-88ca70eff3ac", "comment": "Malware payload", "value": "19bea92da929fa4fe05b7fc633f512061f19c3212d3490f6881f68bdf0784dae86bc4b15a8d9ab64050cf65a09bc04cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725641, "uuid": "4539e140-1c99-45f4-b18f-ae1ce11e47ee", "value": "T158A35A4BA2E600BBE2B78678C8930A49D772B85517619FFF03A4425A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725641, "uuid": "43da97d1-6e9b-467e-a468-3cf1bfb257ed", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725641, "uuid": "95977ded-1aa8-43b9-be3c-1ecf5d54dc02", "value": "3072:8vBGrVNNR2AJNQKAfRAtVvrXT/7nM4L3zm2Q9ZVbZacTShsrHkBhj3N:4G5HoqXAfRYWKh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725641, "uuid": "b2539e50-42d2-4798-8abf-57add7bc4a85", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725641, "uuid": "09e91d38-893d-4bcf-9ea8-eb32d41c9768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725641, "uuid": "7ede1b53-2486-4cca-9d8b-1007c786b223", "value": "0f55011a79a851db19afd2e1863867d861dd9c823c1c58e135b6904c9ea634f7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00188804-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725288, "uuid": "bfa2bfb6-481a-4b7a-8fcf-48249eccf7bc", "comment": "Malware payload", "value": "221f053fc4259df0785eb3c4cf0bae5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725288, "uuid": "96baadb0-5f9e-4475-85c5-3d17099776f0", "comment": "Malware payload", "value": "0f5a4aa7888459dd56f194284db0016aa854f4b25df5f63e975b8f1be3e4f316", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725288, "uuid": "7bd29647-d9a1-4876-8d9e-898ee0d54f46", "comment": "Malware payload", "value": "ba3b6ad3b9acb8dd505dc12bf2627864ac09d9c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725288, "uuid": "889cf2dc-ca59-4904-9fc8-2095ec735ce8", "comment": "Malware payload", "value": "775a2f611de7147dde825a85eed3f2728951a8872ed40b21d61fdecd01f0eacf176a5cedeadf54e213681431b96ab0ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725288, "uuid": "e44dbdf6-fa33-400e-b17e-16f5e832b2ef", "value": "T133A34A57A2E600BBE2BA8678C4530A4AD772B8551760AFEF03A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725288, "uuid": "38b97db4-fac6-4a96-bfe5-b791da84bfae", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725288, "uuid": "14055623-b0d7-4a7c-99d4-89a1ee285d2c", "value": "3072:eNTeXQwDasaAmiTQhAS/xYN0x51756565rnIryHD/CE7K:yeXbuFaTcAS/0biO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725288, "uuid": "0131287f-6bed-4b51-bdcf-7205985b35f6", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725288, "uuid": "cfda8b8e-d7f5-411c-a1e5-b2a941417137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725288, "uuid": "426c5a47-7a6b-47b3-9f34-f4d46aa2e12e", "value": "0f5a4aa7888459dd56f194284db0016aa854f4b25df5f63e975b8f1be3e4f316_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236379b9-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689269, "uuid": "72788bb6-ba49-4180-905a-dc3b28a49c07", "comment": "Malware payload", "value": "549dea9088294b6afff77bfc8c7c2c01", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689269, "uuid": "76ef637f-f792-4a78-b90c-490aab04db54", "comment": "Malware payload", "value": "1056ba2ec7a2151e1ade4a02279ace0c291fadc329cfd661fa427b4efed53578", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689269, "uuid": "d4aa4d36-91d6-4530-876d-c5e707d6527b", "comment": "Malware payload", "value": "1ce6d0ed6c3012a758853a53945c55791abfefbd", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689269, "uuid": "3764daef-a865-46f5-b453-9eadf483b7be", "comment": "Malware payload", "value": "91a44bace0f5393effba7fdb471a0344233232b599eecf2599aa4d54827285e349ca7ce90427b4e02ef3474b44ef98a6", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689269, "uuid": "53c06713-15d2-46a1-9475-87fb5aa8ef64", "value": "T1C125A58926DA05BECBAFE33A8602305FF62037E1532047A7165A4F4A3B7797D663D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689269, "uuid": "5a399265-8838-43b2-bd69-b252c3dc9147", "value": "2ff469e8a85333f8e6ac6f93c3cf6824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689269, "uuid": "586f871b-080e-4854-90fe-5d58698dcf78", "value": "12288:s44Eo0AqtgGtR71cQOLHmwgv11ypjFG5AbydZaHvA2:sfE3tfXcBmH1yphG5AAAH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689269, "uuid": "a9cd5650-ffb5-445b-a091-fb4914dcb6b1", "value": 985320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689269, "uuid": "6b687795-c5d6-4add-9b36-78976c069139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689269, "uuid": "49e74028-b4e4-4353-b503-c72dd509b64f", "value": "1056ba2ec7a2151e1ade4a02279ace0c291fadc329cfd661fa427b4efed53578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b61fb1-3cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776697237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697237, "uuid": "1bf2c0aa-41c1-4d7d-9bdf-cb622a2292c4", "comment": "Malware payload (ConnectWise)", "value": "51e241db4a872728b183dc3c2e0c1522", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697237, "uuid": "25d54335-99fc-4981-9d1d-c07f0fad650e", "comment": "Malware payload (ConnectWise)", "value": "1079ddd38cd9d74ad13e254ff709932bd97dd3907ca00bba368382f64a6f6e87", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697237, "uuid": "3a69dc82-3118-4821-8899-5e6fb2ba5cba", "comment": "Malware payload (ConnectWise)", "value": "443def3817da419526006ce5b21023ecbe7fb679", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697237, "uuid": "1dd28017-d316-4f78-9269-9810219ec4e5", "comment": "Malware payload (ConnectWise)", "value": "27b892d03acfd2440f5d3e7d9128dc649905dc0544af0d6bfd321b2c58654f9b14c0004c5b42919ad30d794daf9c4ba6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697237, "uuid": "c8973364-bc87-489d-a91e-54ad599da249", "value": "T10E31010FAD06D361497249A74764AC1ECAE1153709618148BB54C88A4F3667FFBE80FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697237, "uuid": "c0a01f34-013b-4b82-8283-24db4cc3b74c", "value": "24:cSdEPK2hNcRiE5d3s39A18bzOMa7Am/30qQhYY7toLgIMaFONX8za3h3OQ0F652A:cXNcIE0NA1dAm/ujouNmaxO765T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697237, "uuid": "5c5b9d83-debb-423d-a81c-cb8edb2cd852", "value": 1778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697237, "uuid": "2215e5f4-65e8-4433-931f-b48d74d23abe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697237, "uuid": "e418db64-5019-4787-acf1-fcd11952f804", "value": "Statement_Viewer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d1a60b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725081, "uuid": "5e1b4030-6afa-4355-8b24-52ea9b49e010", "comment": "Malware payload", "value": "621a059edbdf3d2390519f6eb0c8993e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725081, "uuid": "8ff84529-1a4f-4fe6-938e-a8977ae4764c", "comment": "Malware payload", "value": "10811c7cb1aaeadaa5ec8ff33922d53d2fbb1761295e6549e6508cadb3a6a6f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725081, "uuid": "3b931df2-b1d4-447f-820d-cef27aee37cd", "comment": "Malware payload", "value": "5ecd9db3bc11c942b4f67e51740dc06566fdaa6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725081, "uuid": "a5a8dcc5-f006-41b4-98ab-fef3a1048590", "comment": "Malware payload", "value": "8eaf6ca8976819851b7ff24bee60c6b6c8b9d0e66e1af39535da37cdd72022e9ecd0b6abc1f15b07e5d1046f786107cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725081, "uuid": "241bfd28-cbd8-4457-aa83-a70789da090c", "value": "T187B5AE02F29646D9C46BC0F8C9116A77F0BE78250A29AF377AD80BA46B13B3057FD745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725081, "uuid": "8d642a16-5ccd-469e-a076-9a70701fc921", "value": "bb7621664af31facb7c3b53ae67dfd96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725081, "uuid": "67a9ccf1-2db7-4ee0-8c0f-6c08ded41f73", "value": "49152:0uwVEs1J3jMFi8DpEy7biLE5dbchm1eyAdrTfg:0uwV558CvgdYhkep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725081, "uuid": "35426428-d8a8-47da-93f8-ab28ea5f1822", "value": 2302976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725081, "uuid": "e0a9e156-51be-44b8-bb8a-fb092f558f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725081, "uuid": "3f636211-64f2-4ae2-9776-6a5d2b0b547c", "value": "10811c7cb1aaeadaa5ec8ff33922d53d2fbb1761295e6549e6508cadb3a6a6f9_c144ec73-2707-465b-8eee-b2ac600a5aad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82943d7f-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776676973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676973, "uuid": "34bc99bd-c25d-4bc8-a700-997e14f8d6d2", "comment": "Malware payload", "value": "e0a097af71d016aba19f9076ca1d7b77", "object_relation": "md5", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676973, "uuid": "36c434ae-98e4-4acc-bdfe-497c9d49565c", "comment": "Malware payload", "value": "10c69e7f0d2552ac602c9a9617943ccb862f4afc96fc76e5679b306afc671e38", "object_relation": "sha256", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676973, "uuid": "956c2b12-8e84-4915-90aa-9d767faad2a3", "comment": "Malware payload", "value": "f9d4c2b66b01b3545204c618222a9cff4cb627b8", "object_relation": "sha1", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676973, "uuid": "363c86d4-9dac-46a4-b9b7-8b99596d6bf0", "comment": "Malware payload", "value": "99c6c4e41c86f6bac06adc59f54f0089b29d8a68d62bdff821189f09753b0899cebd72049a7461568254b0b489646df3", "object_relation": "sha3-384", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676973, "uuid": "40c333f4-4b8a-4659-a722-e8daf8213d39", "value": "T1C0A33A01B9C1D071E5BE19391824EAB59B7F7830CFA06DAB77500A698F343D1DE34A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676973, "uuid": "2d580b82-66fd-48d1-a8b9-12852de22bc8", "value": "9df2d6276661d8492ef09b26648f2f08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676973, "uuid": "8e6a2d06-6858-49df-b781-b0bc6c3f3105", "value": "3072:JSFuki0GFv/IUnowDWH2CpdGngrn3Uj0U:YuysoUowDl0kj0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676973, "uuid": "1fec5b66-1352-4938-825f-c8457cc7132b", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676973, "uuid": "053c20da-dd96-474d-8d09-a89c245e5d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676973, "uuid": "7e64d893-833f-4e60-9407-9da181399441", "value": "Utility.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92931b9-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725652, "uuid": "895c38de-a43d-46e9-80b2-93c8b13f85dc", "comment": "Malware payload", "value": "95f347900d08f9e80602e6f545105984", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725652, "uuid": "d775b7ec-f4b2-468a-bbeb-b6b8d35bf727", "comment": "Malware payload", "value": "10f7f483512029d6a7ceecc154c9cb8bda6d34fa65dfbd2c67a49c12e763449a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725652, "uuid": "88fbf82f-85c2-473a-b138-5fdb105a09a7", "comment": "Malware payload", "value": "e64409b33b4f864400a96ffff6b36af80a588f32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725652, "uuid": "9f62eb2c-d2f5-4e65-bcc8-1b2a66280e88", "comment": "Malware payload", "value": "dbee406dea7cfef1c75106d480702bc8a50e95f152e0e03bc0fa2d77b69980da9d9eab32f88a8d938c9bc70939946933", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725652, "uuid": "9dec4685-57c0-40a5-b4d1-5f57531574b9", "value": "T13F43CF0EF65B589CD40DC6F989FF47337276BA6154B36B6C26A0CE781F505A03E6E900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725652, "uuid": "06060b4e-fb13-411b-8a73-226af7b67a92", "value": "fe21e882686b5b4fbd50889e1395d60c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725652, "uuid": "abc7fab2-cb8e-4b0b-a9d9-7db7c4ff9898", "value": "1536:E6tWOPLuqURBOvYpizkCMsxwnyAa49pmckVPxIiTF:1WllM6JgxswckVPxIiTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725652, "uuid": "4404348d-eef8-43a1-b00a-052e1622ccb1", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725652, "uuid": "20427ddc-9d45-48eb-b715-8ef689652282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725652, "uuid": "faa598b1-1411-4f6e-9e20-eb5f1d6a5156", "value": "10f7f483512029d6a7ceecc154c9cb8bda6d34fa65dfbd2c67a49c12e763449a_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f100a8-3c97-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675602, "uuid": "0a1cf5a8-2146-4356-92f3-a904d14b8fed", "comment": "Malware payload (SimpleHelp)", "value": "79391a87a8a6ec03af91bfcbde4e112c", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675602, "uuid": "59f54501-a8e7-4e84-844c-98fec33fdbd5", "comment": "Malware payload (SimpleHelp)", "value": "11c5809356389f3a772d5661e7daa97ab9bc1f9be62ee74da9592db56665e3f1", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675602, "uuid": "a041fc36-4b3e-49b8-8a39-aaf640879d67", "comment": "Malware payload (SimpleHelp)", "value": "e5686ef6921016622f49ec36a694dee0fafe4109", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675602, "uuid": "71f544a5-b8aa-4861-a200-10ac419b6207", "comment": "Malware payload (SimpleHelp)", "value": "79d92bbc4972d1fc3b3a3a24a8d8358847c567f5ca7996e9d02c1b5ab4ab404e0cd50eb0c7d728404ebc49643379ca76", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675602, "uuid": "0b08998c-c26e-40ca-9cf7-806429f83a00", "value": "T160873324F6E598BADF27D4BCC146C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675602, "uuid": "f8a0de1c-dc56-4479-b29c-4e1341a2987d", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675602, "uuid": "c88d28eb-fd3d-46e8-9520-0d22283a313a", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7RmH:pJF2TAmHv5V7RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675602, "uuid": "d64938df-6dbc-4ce0-acf4-8ca4af0757ee", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675602, "uuid": "acbb068e-cda3-49f0-8e55-e6f1afd4e2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675602, "uuid": "eb88fb37-91f2-4ccd-9233-8931d4630c98", "value": "11c5809356389f3a772d5661e7daa97ab9bc1f9be62ee74da9592db56665e3f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b53c9b8-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676800, "uuid": "29af0149-0b11-4b80-ad14-79d756b0588f", "comment": "Malware payload (ConnectWise)", "value": "bf7deaa4aad3e5231a85da265976adc9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676800, "uuid": "9ed30d1b-6e58-441f-9b1e-fbfa30469ba8", "comment": "Malware payload (ConnectWise)", "value": "1213487c618b6db0b11b2eb89747740341602127456c4611c1feee1bd9d55ca0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676800, "uuid": "d9b87bc6-338e-49a7-aec0-b3fbc53d8c5b", "comment": "Malware payload (ConnectWise)", "value": "35226f115a5a1dba709a47163c4ef388dd83ddc9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676800, "uuid": "61446007-0f40-4595-9e56-b80f3daad4aa", "comment": "Malware payload (ConnectWise)", "value": "4bd9751a2d7135b12062fdd849da20362a6da3ca0026c2772128ab0bc475cc01bc30b57bc9d9fc50a487edba15a7c10b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676800, "uuid": "6291a091-8bbf-4efd-a622-32d14f5fc05f", "value": "T194836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676800, "uuid": "ce6f1096-7132-40fe-9170-ce13680e1b37", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676800, "uuid": "246211d4-adbf-45b5-8465-2d45d4ea94e9", "value": "1536:poG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYV7fJ:zenkyfPAwiMq0RqRfbaWZJYYV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676800, "uuid": "7b9e07a4-3a5e-4f52-90a8-4034a9f7e267", "value": 83336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676800, "uuid": "3d10280b-9a3e-48f1-9b77-23e8c1059c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676800, "uuid": "79caad94-8ef7-45a0-a773-b50e6f961438", "value": "1213487c618b6db0b11b2eb89747740341602127456c4611c1feee1bd9d55ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb4fa74-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725899, "uuid": "b7d23bc2-4aaf-4c0a-bc89-9e05911ae624", "comment": "Malware payload", "value": "8e7d282e1bc3ac2ec58b3764e4435e17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725899, "uuid": "2d6b3b55-4a11-4142-8fbb-0b6e4efb0c1c", "comment": "Malware payload", "value": "12331a3d0f49b06fc013a6cdd96c3d85ad5c86cb446a53b79941d30f47604a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725899, "uuid": "40760388-bf8f-4544-8b3c-daeca27cc645", "comment": "Malware payload", "value": "6825e9e483abe77a44680ee25590497db8d52baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725899, "uuid": "7f964745-3a0e-4458-a498-2e0976b18cd5", "comment": "Malware payload", "value": "2c11b859752d19004276684fb921d99d29e0eb54b31606eeeb0e47bb7dce2010230b9fe05e0c5faef493065b4d7a081a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725899, "uuid": "9d26f5c5-217b-431f-9b6a-b7d7f726a312", "value": "T1D6040812F3D720ECD177D5709A7BA633A431BC5945F0B96EA5448A383E21F50BA38F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725899, "uuid": "f63dcb8f-5318-42ff-b8c6-bebb1e215005", "value": "23a9a8414cd627301f397b47588ec899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725899, "uuid": "068e9e08-d41c-4c3d-96e4-34ba2cb23f51", "value": "3072:9bQJQ6qcKxHOJ9LSFUSWVbEl4CkGKD/oSgi0giCBBjqXIIIIIIIIIIIIIIs9IIIe:9E261KgfSWVbElFkfoS+wBjqXIIIIII1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725899, "uuid": "30fef496-5e58-4029-a5ed-7d352dc273b2", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725899, "uuid": "d181917a-7579-4e1e-b056-27f425abcb89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725899, "uuid": "c1ef0405-6f54-468d-b57b-6b473b7e8617", "value": "12331a3d0f49b06fc013a6cdd96c3d85ad5c86cb446a53b79941d30f47604a39_f2f6e36b-74a4-4f62-b978-0bd726ea5f74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8413359d-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674399, "uuid": "58d0788d-ef3c-469f-86da-842aeb46fb47", "comment": "Malware payload (ConnectWise)", "value": "8fd3ceb1c41d827329a6ee844898c0b2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674399, "uuid": "ee8f8438-7095-4253-bfc1-e00d5ebe7cd7", "comment": "Malware payload (ConnectWise)", "value": "123d076e4c2650cc117f48de3afe7a10f6d3959b781e954635874f23c6c58b31", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674399, "uuid": "28cc3c15-ce47-4f80-8459-641d090dbcd7", "comment": "Malware payload (ConnectWise)", "value": "b723b0a00d4b87fbe879303445f1d831aaa5562c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674399, "uuid": "363be0aa-b809-4034-b657-dca0bf936087", "comment": "Malware payload (ConnectWise)", "value": "9bfc2e7974fa61132d691e058b755f771f1bea9a20a39e8d58811b985eaedf00acf8bf95d2bfc40b9ac762694a202045", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674399, "uuid": "cfd794a3-8348-443b-95c9-ecee86329778", "value": "T156D6232267FD0918E1F36778FD3A91E291367C658F12C09F2654786E6871E8097A333B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674399, "uuid": "bb310927-b7cb-4c5b-92ee-d71cf21cd4f7", "value": "196608:mrnLYG3zDhukOXrnLYG3ztrnLYG3zGrnLYG3zLrnLYG3zkrnLYG3zbrnLYG3zV:mbDDDgvXbDDtbDDGbDDLbDDkbDDbbDDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674399, "uuid": "4b448490-685b-4c0c-9099-e16b5aefcb19", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674399, "uuid": "8c72de4e-a198-456d-ad92-c5323b4f41f9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674399, "uuid": "2233ed80-a7e4-4764-9655-df04836c7d28", "value": "123d076e4c2650cc117f48de3afe7a10f6d3959b781e954635874f23c6c58b31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8045485-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725167, "uuid": "dee051df-3df9-4fcc-888f-6ba8071dcdf8", "comment": "Malware payload", "value": "7d85683a846f0467e068927e5e7a0267", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725167, "uuid": "421d9767-34a6-41f9-974b-8c99e82cffb2", "comment": "Malware payload", "value": "127226334ce62510f9bb1467d9d006108bd4d4884afa48f64cb4b03be47851d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725167, "uuid": "4f69fcdf-a461-4c47-ba49-94078770a5e2", "comment": "Malware payload", "value": "811e7aad3bea7ff8341ff5106bf0a29db3bb9fc2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725167, "uuid": "be5fb796-192f-4f7c-8718-1a0ab71cedc0", "comment": "Malware payload", "value": "aa04d223841e8cdc49a84af6701f51e75ececfeb3c629e98f2c5469b5d44369f13d9314494ef6a9bb1e506028904bfe9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725167, "uuid": "506b457c-de59-440c-be42-24b60ac734f8", "value": "T1C2A34A5BA2BA10BBE1B68638C8570A49D773B8555761AFEF43A0425A1F233D08D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725167, "uuid": "200642e9-b78a-4cef-9179-64d41a7f04b1", "value": "500afcac24ada5096b15630df71ec442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725167, "uuid": "27b28c0c-ade7-4900-a442-d5f226cd5325", "value": "3072:n7FEVRoWiGqsGQbXAL/QiYl2GWwD80p5wCDvmXT7RLyzfWC+YmSO/2nePGyufbH9:ZELobqGMXAL/DY2id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725167, "uuid": "b02e7464-2518-43a0-ae35-3bf2c8b75b8e", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725167, "uuid": "311eb663-5462-45bf-8015-7d46e95ee7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725167, "uuid": "32455877-94ab-4479-899b-3effd29cd02e", "value": "127226334ce62510f9bb1467d9d006108bd4d4884afa48f64cb4b03be47851d2_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d62d4f5-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725337, "uuid": "586d6f0c-9788-4781-85cd-244d0d99182b", "comment": "Malware payload", "value": "88f11758b77bf89f167d5ee80d8d77fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725337, "uuid": "c7853cf1-22a4-4802-b108-d07a09ab3a68", "comment": "Malware payload", "value": "129f8c5713c11b19868f9dd765e46364225f9e1fce950ce64cfb6f53fcf81ee2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725337, "uuid": "ea5a50e3-a097-4432-81d8-92d334be6aa6", "comment": "Malware payload", "value": "da9297a94a7e98053655032625c752c688c8bd93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725337, "uuid": "73f9b250-2797-47c9-9964-de9e55816ccd", "comment": "Malware payload", "value": "dd381215017ba606794dba1d1d2bbe11200c1dd014cba91080d97ddfab9941b03105d9dd52a3c3d4cf1d8b1311c28270", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725337, "uuid": "1c49f017-6abb-4d7a-bafe-0c8ecba3556a", "value": "T1C2B34A57B2E500BBE177923989630A46D7B2B8114760AFEF03A4464A5F237D28D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725337, "uuid": "10198182-ee9d-4a75-a505-c3bb8871927d", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725337, "uuid": "3dff22bc-474f-407e-8d00-f1063a7b00c3", "value": "3072:DTA+vkXsN6BdfY0rxDY863xmNkF1JPLS55c:bv0suFrxklYUW5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725337, "uuid": "a4d97539-466f-4cda-a0ac-011b87887988", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725337, "uuid": "4c7f5ce5-2d1c-4d45-acfa-30d3dd7eda38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725337, "uuid": "09b4148f-4842-4d8b-8bc5-962b2dd11b51", "value": "129f8c5713c11b19868f9dd765e46364225f9e1fce950ce64cfb6f53fcf81ee2_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b1f399-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776697616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697616, "uuid": "cc6696f0-4b16-4724-b79e-c1e6649d0c56", "comment": "Malware payload (Formbook)", "value": "48b75c191c8ab7a18c24db30efcb62f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697616, "uuid": "b2d833bf-d663-44a8-9a14-5e9b5576c0d5", "comment": "Malware payload (Formbook)", "value": "12dfe3c21696bd6767fc43dbe4bed6291ac09409597d9e47ec665519c9c5f519", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697616, "uuid": "1bd8756d-609c-4c16-aae8-b40a6d02a437", "comment": "Malware payload (Formbook)", "value": "492139bd9d2ea84c0af960a876ed7b12f62f8335", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697616, "uuid": "aa43150d-7873-42b6-85e4-d6b071e5fcee", "comment": "Malware payload (Formbook)", "value": "61bf60e4aef4cf73473ce3569ec8c6c3526e1cb7f0a56cfc634bc925bfbf4fdedaa8876bf4535640a4708c95a36a83f0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697616, "uuid": "75527983-793b-440a-b89b-7f8d431eb5de", "value": "T129F261C83BC7B5A21E4230FB382B7052F53E8D80650D4454F6E891BDB968769D5BEB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697616, "uuid": "1a9067e9-5ca4-4930-b8a2-9f98324d5706", "value": "768:eB62ZJgG5HOs5DUM/lSz8gJ7T/jKN1YxMInOJ8aIFZ2n:eQpG5HOs5gRzXJ7TbKWMRJ8aIf2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697616, "uuid": "03e1102d-98af-40fd-8031-7d7769958547", "value": 36167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697616, "uuid": "4bdcef65-5fae-4ffc-9125-e12c38e0326d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697616, "uuid": "e239c340-1eea-4fb0-a35f-326c0f734e9e", "value": "Dettaglio bonifico.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292518b6-3c78-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776662220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662220, "uuid": "588c8f26-fcdf-4560-8925-6d0e3d6b2056", "comment": "Malware payload (ValleyRAT)", "value": "c4d623cec7721acd1e00a094c13b1afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662220, "uuid": "8adc4f04-af49-4db1-b52a-db0a5f005932", "comment": "Malware payload (ValleyRAT)", "value": "12eeb42b6c685304e9619f3988146b5a68db3fbe7f0ac28b1c5fda9481315c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662220, "uuid": "2afc4eab-8214-4217-8363-286974cda53c", "comment": "Malware payload (ValleyRAT)", "value": "9c534cf6e40ae7c362af95455643d8dbb35cca56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662220, "uuid": "17bb15af-67ce-4627-9966-6a14c4645c48", "comment": "Malware payload (ValleyRAT)", "value": "6fc2d5af3ecfea5ca42f571b7d8d671e46a45ddb9265f280bc7b0b300949a6daf27d9db0b3ca1f749d8db57473c7f311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662220, "uuid": "801882e0-c623-4891-8d95-b974d5bc4fc2", "value": "T1D195DF23B2CBE03EE45E0B3B0572A15494FBAE65A523BD169BE4949CCF350601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662220, "uuid": "3f5f9b24-29dd-4f73-8db9-9ebb427bd1e4", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662220, "uuid": "d61a32ab-225b-4949-977c-3bede2287295", "value": "49152:o+MRvHm9bGFG367MZ2Z9ftchfudg87dqn7iM1:oru9aFG3+MYchXqdnM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662220, "uuid": "6d36d3b3-b8ad-4367-8e88-79d892f24b0d", "value": 2008208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662220, "uuid": "e9367766-19f3-4ef1-9b2d-6efc8e08b7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662220, "uuid": "ef50740f-43a9-4bb0-a3a8-ef47afc05303", "value": "12eeb42b6c685304e9619f3988146b5a68db3fbe7f0ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd874d3-3ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776708476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708476, "uuid": "f2ad9876-ef91-4da6-a7a0-a0855b995454", "comment": "Malware payload (Mirai)", "value": "574bcfdcda105e92fb2b9a710da4299a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708476, "uuid": "9a9e5b23-1250-4a68-981e-580b3d95759f", "comment": "Malware payload (Mirai)", "value": "13246fd8978a2eaf908876df462522d38d8ac6876fe309b773efb878109e5169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708476, "uuid": "10fade13-e86f-4864-894b-2bf72d735b1b", "comment": "Malware payload (Mirai)", "value": "a18d36079cc18f7c5e5ade05e0dd9454c595f144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708476, "uuid": "ceac35cf-79d3-4996-89af-b8f297a8ae9a", "comment": "Malware payload (Mirai)", "value": "3283033d56f26e9ff376a7f4c812e64ef548ff11888d962a11e9d139d85faade40b1ecaa9e840af7d38aa8d622574766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708476, "uuid": "59f1f811-5344-4963-8ed4-33134137ef24", "value": "T1BF735B31F975192BC0D4917A62F74722B6F287CA21A8862F3D710F9DBF615403A43EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708476, "uuid": "84fb0a47-a3c7-43f1-a58e-1d3b6d930bf3", "value": "1536:F5Y4IyxiPiWHKpryZ3EPRtzJYm5is9Jsmtt6/bt:Dz4K9JYO592/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776708476, "uuid": "00742927-a637-450b-90bc-707835e4c5bb", "value": 80296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776708476, "uuid": "d1631728-7352-4b87-ac84-2cfc47ac0dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708476, "uuid": "cfa7be91-a8a5-4c22-9151-5af4e29ae146", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf65065-3c6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776656375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656375, "uuid": "3fd1bcde-b269-4f17-b8b6-24265e9b571a", "comment": "Malware payload (Socks5Systemz)", "value": "dd4febf88d6bc79228de81366b1d38c7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656375, "uuid": "31570438-acab-4ce6-9f93-d7da3dcb4c20", "comment": "Malware payload (Socks5Systemz)", "value": "13b17c414f0db01f537d3dd03dcf2db6b870597a045d91e7bf58d3473a47f1ec", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656375, "uuid": "446b3c94-4972-4060-93ba-a85996ad7bec", "comment": "Malware payload (Socks5Systemz)", "value": "c883bed97b4df650a0d4f623e0f4ede9ab53dde7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656375, "uuid": "172d1655-00b4-4c71-80ce-b60ac459520a", "comment": "Malware payload (Socks5Systemz)", "value": "f0502e2a6aa2fd5e95d4b3e55d825405ffccda759eec8cd50f67572bd31ace0c950f4c853eec5cc8661ba1c19e458363", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656375, "uuid": "df502e2e-2030-4430-9b1c-1c0c14cc1ae7", "value": "T141B4B465C7034B6AD84D0E7CEB4E1BAC9011AD7AFA6CF5CEAC8F054B41D8D3E52112E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656375, "uuid": "6dea2c42-97f7-4a5a-a602-248a89baa0dc", "value": "2c603b95012ce8e93f6b6a124be5f2e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656375, "uuid": "0470cfec-8ad3-4f97-b6ec-0c0c0c952272", "value": "12288:Euyb87D7B4uFqiG0uZbRwcAxxUIi2bxOUIiQC3ZQ5eId:Euyb87nB4uFqiG0uZbRwcAxxUIi2bxO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776656375, "uuid": "2ac6edf6-7000-420c-b3d7-c3220dda03bb", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776656375, "uuid": "310369f4-de8a-4a41-a1c5-efae64cb52ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656375, "uuid": "0f55d7a5-cfcd-477d-bd12-982bc6a7fa36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465fd95f-3d11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727982, "uuid": "b54561e2-6223-4c4e-a174-ce67b69d1dae", "comment": "Malware payload (Mirai)", "value": "2f8835b544a196adcfa7f805c999d3d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727982, "uuid": "10370b64-7bed-4b1c-954e-e7fd0a2bd2ed", "comment": "Malware payload (Mirai)", "value": "13d3ab9aab1a2d605392ed5af2d1d292c6e67de39c097e306001e377898cb201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727982, "uuid": "5d393deb-0d3f-4e9c-b456-4cae969779e8", "comment": "Malware payload (Mirai)", "value": "06f58bef34466c2a5c22fee4b86a8e025a88112e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727982, "uuid": "6d614a5d-97ba-4d1e-98f9-10d8b5749f73", "comment": "Malware payload (Mirai)", "value": "5d10030b650813b6048e6dfd9809942d8b241a14a1b687064f3c4c25723cf67b5de101b59edcb74c85f3fb8e4d969ea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727982, "uuid": "186fe64e-1824-41aa-b2af-00dbeb9aa1b6", "value": "T1C8234B21B9392F17C4D4A8BA62F74768B2F5124E25E8CB4E3D730E4EFF54A8095136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727982, "uuid": "d5a09f6a-98b3-496f-acc4-a4e502c5de01", "value": "768:MMouY0Fbq9jJWijbp9Nbojodqmb1sO+2jzh1:MMlY0FbSjJWijb7porQ1WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727982, "uuid": "fda2eba6-aac9-44c9-b7e6-c8b0620e2e48", "value": 46804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727982, "uuid": "50b56c57-8b01-42fd-9626-86f5573a46a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727982, "uuid": "6810b118-bc87-434f-a9d6-6e83485ae9c3", "value": "00okspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e01a52-3ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776708465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708465, "uuid": "3d987ff5-0e98-446d-82e6-38a7b3319ad3", "comment": "Malware payload (Mirai)", "value": "d4752492bb9e90c6ea401f52845a6a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708465, "uuid": "18b90f43-156d-4010-ad9f-52eaf60a2547", "comment": "Malware payload (Mirai)", "value": "1407dc742e9b3229a10840770d770cb7c38c636e616111c1cfcc06ef7d20d00b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708465, "uuid": "37b885c5-be41-462e-a9fc-0efe632c3de2", "comment": "Malware payload (Mirai)", "value": "d900c630462898e4d5830d54fa57385935771a62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708465, "uuid": "b7197439-66f0-41fb-8308-be9ec9cf8ea1", "comment": "Malware payload (Mirai)", "value": "e82dd986c959d44089ea71ca2c1eef2e0f5a212bce46bea6e155a55b2f3fc31155cc83f221356a1fa32d9d9337387b4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708465, "uuid": "b9cfab08-ed81-4a74-a5e0-f0e9c09b5aa1", "value": "T133036DBAC4296D84D5154275A8358A7C6F63E110D3833FFA5B4989A68047EFCFA0A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708465, "uuid": "5ed61b7d-3e9e-444e-ada4-6cc52af5019e", "value": "768:Ha9fewtwwF6KHX/3ee1dEigANW3/rfCXoCfaCi:HadewtrVbCcKfHMaCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776708465, "uuid": "bcd3c7f2-4dd2-4590-aa1e-ede7da7b46e3", "value": 39212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776708465, "uuid": "283633b5-b145-4acd-8b5f-fb88ef5c5a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708465, "uuid": "fcbe9c2c-9e7b-40c7-a07b-2db48da406ff", "value": "00oksh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359317f3-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687152, "uuid": "8ec14440-1846-4564-a39d-d6d2a0561953", "comment": "Malware payload", "value": "e2deda6da43c54d29fa2e2dbee677e62", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687152, "uuid": "3d0a44d8-8470-4468-a4f1-e7b9a351e3da", "comment": "Malware payload", "value": "14628ab5eb71a1bf587a9314bf55504885b29aac8bec2703d4ec27fee6a7dcec", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687152, "uuid": "178cd47d-0598-493e-b113-2762951180a5", "comment": "Malware payload", "value": "f35be65b2792d9829aa31aabfda1551fc4cc0c24", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687152, "uuid": "84a26d3b-164d-4931-a4d0-b33bb0526909", "comment": "Malware payload", "value": "368516cd89e6de3f842a88e3f34bc430d02b70f08fd2c722c1a84086b0b270e7721a5e24ef7fd45b7dce3ad2ab8eb8ec", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687152, "uuid": "d9cbca92-8eb5-44e1-9670-88de18aa9d41", "value": "T140268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687152, "uuid": "c5a2f8a7-5cf3-4cee-836d-7bddbdbd1dfb", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687152, "uuid": "bfa35c86-0c3b-4af7-a215-1c70f131602d", "value": "98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Pv:7xuHjWfZIzev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687152, "uuid": "50212382-bea9-4c36-9ae7-a1402f46632b", "value": 4425728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687152, "uuid": "cad9205a-803e-4b1a-b324-892af60e5df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687152, "uuid": "4b984106-b0fa-44c7-b290-67d89cb37675", "value": "14628ab5eb71a1bf587a9314bf55504885b29aac8bec2703d4ec27fee6a7dcec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cd0a57-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776697546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697546, "uuid": "0861866a-2ad8-4d8e-bd35-2e185670f288", "comment": "Malware payload (RemcosRAT)", "value": "f1a69468a2ff0e5ff1080e9523d95b5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697546, "uuid": "d34d101d-b84b-4734-a00d-54ddd8e678a2", "comment": "Malware payload (RemcosRAT)", "value": "14871ed0de7fb24775a7c51fb6c88c68a02d31a07050612e457b7f2b66a06285", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697546, "uuid": "ed2884d1-8a4c-40cc-94ac-cff115867db7", "comment": "Malware payload (RemcosRAT)", "value": "e0b4758f76c5b3c1a812ace8f22de8dd4a75b7ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697546, "uuid": "d94f9f2b-e32d-474f-94a6-639ef215cf64", "comment": "Malware payload (RemcosRAT)", "value": "970de262670574bd669cd17e252f4d4a4541f14e5f92fc4e3e2e9ce4fc3bac49872bc0f74a5b3d50ae4edf5abb04b94f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697546, "uuid": "4222e6f2-30b1-4e8b-b3e8-82e81fe94c11", "value": "T1D15342FE46452CBA1D9E5FACFCC594654E4A0F6261F5C216A608789FBE18CD8004BE3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697546, "uuid": "d134e90c-82bd-4c8d-9fea-11ed8d10f6c9", "value": "1536:b1EowdAUTYRwyeYT5YpoYx9xMAgoPYFJLbbs1hAtSG3RluJa2AzFA:REowdAUTYRwyenpoYx9xMAgoPYFJL/sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697546, "uuid": "42e4b1f2-ea02-450f-a531-85a18529bbdb", "value": 65506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697546, "uuid": "95544d81-ad4f-415f-93fc-909f1a7008ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697546, "uuid": "c2d91b94-043c-4369-936f-f83c20c447d7", "value": "MEDUGK931749.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f211e10f-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644948, "uuid": "82e89709-3d28-4936-bf96-f87fd6efc0a4", "comment": "Malware payload (Mirai)", "value": "846bf633b6283a647f0a7da0f7573d43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644948, "uuid": "f8c6c652-2dde-43ab-bb03-6346b417b9e2", "comment": "Malware payload (Mirai)", "value": "148d31c590732b49fd4632ac63d4c7f0d4e56c8900204968a6adfdac1e7e7c3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644948, "uuid": "ffd7e06e-42ce-46bf-b967-97858bbf227f", "comment": "Malware payload (Mirai)", "value": "a02ea881f5478fbaebebf46663407dfd8d1b3ec3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644948, "uuid": "fb535cad-369e-4314-afd6-b8e067f3b0bf", "comment": "Malware payload (Mirai)", "value": "5b591ad331b59a3a0975836388b6afe937b1fadc414ef1ca51fb97424e979b489d19c30cd4265437704a389872613e48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644948, "uuid": "dcec09f9-da11-49d3-bb63-c34ed8bb9f03", "value": "T15C218221390054766E3DEC197606E00D00C55BEF3D3BB7F8DDD5A81AE1B80487AA2D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644948, "uuid": "06ded055-79e8-4b85-b812-6a6d6ae3572d", "value": "24:0FdBjeBeNIGmk7eK/Jv9o0wS/pdTdb4B4dAiVEiRzI2zu43vWyOcMBMlsGc40G:0Bhml6JvzwiTd8GdAZiRZl3jOssK0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644948, "uuid": "1dc98ccd-69c3-4154-a559-5250b80e4178", "value": 1434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644948, "uuid": "6f99036b-46d8-4a7d-a42e-07646c85d4cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644948, "uuid": "b4ec5323-fa4c-46d2-a922-566776a18e77", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6beb2c3-3c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676309, "uuid": "82c30a49-fe87-420c-97b9-d849b35ae073", "comment": "Malware payload (ConnectWise)", "value": "c61f5dcca1b41bf6d6199c39a72b7c6f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676309, "uuid": "cfe51c6d-fdfe-4b72-9875-45490b3f662f", "comment": "Malware payload (ConnectWise)", "value": "14c61ffdb501389170e3e9560ba711014283906934394856100a55b45da77eb4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676309, "uuid": "d20329b2-d49b-4c2d-a112-d49efae0ede8", "comment": "Malware payload (ConnectWise)", "value": "fbbb43f2e1b4186b89fd43309732599cdfda3161", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676309, "uuid": "dfdedf6d-61c6-49e0-b063-f9bb21f5697c", "comment": "Malware payload (ConnectWise)", "value": "5dd5ed8c27d1abf6a4eed796c8ddccdcbc8df4039b6d0be8c6d9f2e1c551937c6446d73b19df06e39274c0dfb0ae2618", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676309, "uuid": "d5c3d786-69e9-49a5-8ffd-9c64d267aeac", "value": "T1D3D6232267FD0918E1F36778FD3A91E291367C658F12C09F2614786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676309, "uuid": "58df713b-f2f4-4433-acce-2f1a20de7af9", "value": "196608:3rnLYG3zDhukOornLYG3z4rnLYG3zBrnLYG3z+rnLYG3zCrnLYG3zzrnLYG3zU:3bDDDgvobDD4bDDBbDD+bDDCbDDzbDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676309, "uuid": "9654e9a2-0411-441d-8aa0-6d4513597b94", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676309, "uuid": "5aab5548-0313-4168-a6fd-eeb3781f7288", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676309, "uuid": "110a0637-bcea-4194-8ac9-aa985393a32e", "value": "14c61ffdb501389170e3e9560ba711014283906934394856100a55b45da77eb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a31a91-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673888, "uuid": "ca77c2a9-b631-4d13-871b-d304b47c8f8a", "comment": "Malware payload (ConnectWise)", "value": "39ec34bb5f40716e47c8201703bb2294", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673888, "uuid": "2bd1695b-0e58-4f0e-8343-cf3a96c66f79", "comment": "Malware payload (ConnectWise)", "value": "14dd855abb2530d9cf5f039ad1da6f15f2a5dac6ab2427adacb443cdda68af0c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673888, "uuid": "f01e6328-d6b7-4e40-9754-c7b0beb42858", "comment": "Malware payload (ConnectWise)", "value": "314c2ef3090741f0ee94eb33103da9aef95d22eb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673888, "uuid": "b0b2612d-62be-427f-9988-e298287ded6e", "comment": "Malware payload (ConnectWise)", "value": "9544ce5fa063bd41c30bd898b057034213edb1c661b8422950ded1baa450094bc475e83257c072244069e02ae7b8cc0d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673888, "uuid": "a67652bc-3ce7-492c-a19b-a80d5e2d4cc6", "value": "T1F546E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673888, "uuid": "240c19a5-7a85-4655-859b-4bc6579c056f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673888, "uuid": "722c5969-090b-4bb9-ba44-27d6e65399a9", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlUgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673888, "uuid": "1209d49d-c821-43f3-8449-7dc54b8563f0", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673888, "uuid": "88c55472-9e2a-425d-bc86-bb107e3fc6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673888, "uuid": "99b25ace-33b0-41da-b94a-230da9b210eb", "value": "14dd855abb2530d9cf5f039ad1da6f15f2a5dac6ab2427adacb443cdda68af0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d3bbc3-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673899, "uuid": "85b73b72-d021-4d84-b33d-4891dde698c6", "comment": "Malware payload (ConnectWise)", "value": "de54fb96b430c75652f296e7af98dcda", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673899, "uuid": "ebf2d0f4-ad51-4f86-b818-2ca197808d90", "comment": "Malware payload (ConnectWise)", "value": "14e7c8d684ce4cd36b77a756a5df2441f16d554e087c8cd25aa21a80173b70aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673899, "uuid": "4859cae6-a5b4-4a42-9b4f-fcde82ebceaa", "comment": "Malware payload (ConnectWise)", "value": "07f49349d4638f4157eb5bfeb9e872d8244fc5da", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673899, "uuid": "254fcd6d-5487-49e3-9a4c-60561ad779af", "comment": "Malware payload (ConnectWise)", "value": "6744874153a0dc50cbb40f1cecd86cba6754f153faaf57852ee34280026cac5cdf8a41a383308fca57a9f70961f9a236", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673899, "uuid": "d9c552a5-54e1-47ea-a835-d279af9e507c", "value": "T1AC46E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673899, "uuid": "f7fc1a02-a9cf-4ab2-a40d-ab36737c0e50", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673899, "uuid": "44fe21ac-4a2d-4152-ac51-c7f84c612ce1", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl7gLLLLK:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673899, "uuid": "8e315f4e-466f-47a8-9b1a-10e3814aedb7", "value": 5788664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673899, "uuid": "9cd87442-b30b-4045-af6e-64389c01f92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673899, "uuid": "38e05bca-d057-456d-87f8-fbaefa1fb1f5", "value": "14e7c8d684ce4cd36b77a756a5df2441f16d554e087c8cd25aa21a80173b70aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df35fbfe-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726091, "uuid": "81be37f8-cec0-4f71-8c25-dbeb41347298", "comment": "Malware payload", "value": "e7c3b787c0af52dd102675ac8d398bcb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726091, "uuid": "4e3dea42-4261-43b8-9dcb-b6c413c7f1d5", "comment": "Malware payload", "value": "14f17d7c548ddf02bbe3479d133ad2241b625fde26ce5ae641b297434c23956b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726091, "uuid": "c9a22be0-20f7-42e6-99ed-212ac2007f79", "comment": "Malware payload", "value": "89a1abbf6bdd63a927979743dfda314b571a373a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726091, "uuid": "b4d40d90-a836-4141-b739-1eccbe0efce8", "comment": "Malware payload", "value": "82d04904135b3e720ce642286de6e19b421d16cecf1f62a8f79f0627a4d0738d803212fa39c336ba2d4b1d9799ab5d27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726091, "uuid": "334e8b8c-5ed8-4123-bd6a-52c3064e15cc", "value": "T18CA34A47A2EA00BBE2B68678C4530A4AD772B8551760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726091, "uuid": "79960b1d-25dd-4087-b062-ed3179e0c3ae", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726091, "uuid": "ca42c615-6921-499d-94db-8a269f61e58d", "value": "3072:m6TeXQwDasaAmiTQhAS/xYN0D51756565rnIryHB/CWcK:/eXbuFaTcAS/0V+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726091, "uuid": "5f739ea6-82cd-4b5a-ba70-c45b9abf1ec2", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726091, "uuid": "affd6afb-1ed0-4ff6-befb-464e0270575e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726091, "uuid": "100186d8-3c98-4de1-b7d9-ec174313132e", "value": "14f17d7c548ddf02bbe3479d133ad2241b625fde26ce5ae641b297434c23956b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c6c474-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776686751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686751, "uuid": "be64e9f2-b8ae-4799-b597-906d82b8b730", "comment": "Malware payload (RustyStealer)", "value": "a43c9dd9cd128e207145985bb8467927", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686751, "uuid": "1fc49818-f488-4d2a-a65d-720d689e215e", "comment": "Malware payload (RustyStealer)", "value": "1569cf96e4b2e88a7ae4429159a96b9a5810bb8d18fb864d5e4d412ad7bcce07", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686751, "uuid": "844ad385-a147-48bc-b3d4-1d627c819acf", "comment": "Malware payload (RustyStealer)", "value": "f70254454ba84ae742293ebeac8f47a556d96240", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686751, "uuid": "4c13f22f-cbf0-4d59-b464-6cd5e2f5ec84", "comment": "Malware payload (RustyStealer)", "value": "910d0f6e5362239a9fc0125c43acdf2b7597e40565692597284b3e3bb18f0fb80acff4dd8639125ef3c2250886620fb2", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686751, "uuid": "8f7d4508-57a6-4110-9993-f20b3594d284", "value": "T180E46B13BAA485ACD05AC078835B9632FA77BC8E01207A7F47D45B303F69E646F1E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686751, "uuid": "d376a466-e69e-4572-96f3-6496fef35e36", "value": "c2679ecff03021add547076874f38940", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686751, "uuid": "5c76a310-cffc-416c-b36f-3bd94360cf64", "value": "12288:j24F6FKFuFpQjoa91HqXlAOT4FUAmpTTZosId97NjOFCAQvUSQP+e:Cus8opBm1HshT4gpyTxVhU7P+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686751, "uuid": "1d058ac9-090a-4dfc-87a2-ce6ce91dad12", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686751, "uuid": "769e2ff0-4ba4-4d9e-bc14-460fadee7e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686751, "uuid": "aae42699-bed0-47a3-8fe2-a636cb6df5db", "value": "1569cf96e4b2e88a7ae4429159a96b9a5810bb8d18fb864d5e4d412ad7bcce07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf3a70b-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688319, "uuid": "3b8c1306-ae9d-4582-88fd-924c4cffcf70", "comment": "Malware payload (ACRStealer)", "value": "63b42bb38a11c5d3ed900063749fb13d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688319, "uuid": "deb5ca8b-7a33-43bc-9278-8e1a925c83ec", "comment": "Malware payload (ACRStealer)", "value": "1572171342a0812aa6adae003b03fe559f0593fd3837f16ab3bb26ee4aae43cf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688319, "uuid": "c6ceaa84-5f3e-4260-ae7f-b002d4d04d1a", "comment": "Malware payload (ACRStealer)", "value": "9f1aec318ce22dbbadf6e1d767a2178bb591dcf4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688319, "uuid": "f27191a6-1e48-4364-a7ca-0451757b28a5", "comment": "Malware payload (ACRStealer)", "value": "099c0e29dfbc728c8b550320178d120bfdde9b1aca5b8c54ed798ffa2d140aef86b471d7f3a5bff70d3dfe7f9169de8c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688319, "uuid": "8042461e-25e7-4ec5-8a7c-ce097fa530b1", "value": "T103168E1BFCB958ADC09EB13484737A05B6A5B8051B2357C72670B6A82F3B7E04BF9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688319, "uuid": "a5585599-430f-436a-aed8-426327f812d1", "value": "9afdd1dbfce43b3a5d5c1cec7fdce06f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688319, "uuid": "f59e484b-9cae-40e7-be0e-3806396d31fa", "value": "49152:pTk9Nowq2psCmZCQcKZ5DJldvMWEUKpyDSj0nQcQd:pTV35RLC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688319, "uuid": "b341949a-abb2-4cd0-af46-580cac365eda", "value": 4283864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688319, "uuid": "5f6d1611-12a6-493b-a208-573f0622560b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688319, "uuid": "16027bcd-fc57-4007-a21a-09a4fc515a52", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67d8fbd-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676604, "uuid": "c2d2dcf3-2fca-4cc9-9f3b-420085c57af3", "comment": "Malware payload (ConnectWise)", "value": "c276bb59d7baa72546e05ff8432984fa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676604, "uuid": "7c1ad08c-7a5d-4b4f-a34c-bdc0e2d3446d", "comment": "Malware payload (ConnectWise)", "value": "15b39a6586c48aec528a6cb7802a5e393f76325aa880b5b02926ffe794bea4b7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676604, "uuid": "3db2f2e9-37ac-4b0a-853c-c760a2d2a519", "comment": "Malware payload (ConnectWise)", "value": "bda0602046f75411ac05bb36626c2054ab00c998", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676604, "uuid": "fbd2e17e-6c15-4c96-93c7-d10308ca5f06", "comment": "Malware payload (ConnectWise)", "value": "2657738a86b8244dab626b8e3355e0c3509664ec8aa98d494185cc0fc69cebf73328c77b9f16fa4ad3b97aa67a073347", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676604, "uuid": "e8efad17-0112-48da-ab16-34d663bdfed8", "value": "T1D046E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676604, "uuid": "aa420a71-664c-4bc2-b5b1-7da02beef8b6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676604, "uuid": "9728014a-4c7d-4f42-8adf-518a06fd54ad", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676604, "uuid": "2ffcf8c2-7bae-4d7f-808f-8bb1bbecd5ac", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676604, "uuid": "86973e48-48b4-4af2-84ad-25d3888324e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676604, "uuid": "a2f47853-2416-458e-9d70-0e9d39e0b9c6", "value": "15b39a6586c48aec528a6cb7802a5e393f76325aa880b5b02926ffe794bea4b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e283161c-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725667, "uuid": "181e8d48-430b-492d-90ed-86c72756dd68", "comment": "Malware payload", "value": "979a435091d9b574ecf3e143392fdca5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725667, "uuid": "3086ed58-e546-4bbe-a4f8-276799ff894a", "comment": "Malware payload", "value": "15bc00dd1f01dc2ea97a59e9f094f55d6b95084d646d7b6e11f3899d7c8e4291", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725667, "uuid": "ea2d50b9-502d-4a8a-a438-95160528229f", "comment": "Malware payload", "value": "78e5a5813c485c84eb3f31ad9cab74b4334e7d2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725667, "uuid": "6ed7510d-7aff-4696-86a5-a03b978c018b", "comment": "Malware payload", "value": "1eb696fb5fdf4ce6241424534ebe570a6b289de8fce431f827e46417e51cf2facfd2cff5bad5921c8f952bf29f9b92b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725667, "uuid": "9e73f66c-bdde-4ba1-a806-7ef2eacf4391", "value": "T1F3A34A5B72B600BBE2B78238C4634A49D772B8454761AFEF03A0425A1F673D19D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725667, "uuid": "90a3d887-7ee7-462d-8fba-2fbbc95f151b", "value": "1db8242845956bba39a653cbe367a0dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725667, "uuid": "04a0f683-35bd-4a74-84f9-b0bf8a840528", "value": "3072:NDcdd+k2M31COjvyGOYQb6Awrub9ATME5JAC/T/2njLhbCDvmSOo2iePG3ufWC+G:yak2E1JKWM6AwrQ4i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725667, "uuid": "c511af56-be58-450e-9502-013255562a88", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725667, "uuid": "d9b06579-cd60-413f-a34b-eb375be5da75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725667, "uuid": "b05b896c-208d-4cdc-99df-6fbb74ee41e1", "value": "15bc00dd1f01dc2ea97a59e9f094f55d6b95084d646d7b6e11f3899d7c8e4291_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d754c3-3cf6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776716417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716417, "uuid": "2f07fb32-e34a-402b-9f16-eb9741848f6e", "comment": "Malware payload", "value": "d58716fd615350ade2cd14cbb861fcc8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716417, "uuid": "6f6fb69b-fccd-4b7a-babb-85b5988fe29b", "comment": "Malware payload", "value": "15f0afab127b657e6c3d2390d867b7a610acee6902fd097c1f28dcf77449fad1", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716417, "uuid": "a98095ee-2ce2-442d-8a3d-ba6f3906826d", "comment": "Malware payload", "value": "7761e0c386a05e1c8f88a8c38c87ceaae67bbd22", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716417, "uuid": "06b06e95-435b-49f0-9874-a6e039c13187", "comment": "Malware payload", "value": "379691b202efdc681eeae8b6410470ce3d8bac28e24b4868476a38a6284aef24346bc90ad7a5dcc11b24831c44d8fcd5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716417, "uuid": "14edd23f-81f4-4a2c-ab62-294f925d2c11", "value": "T10D333B03F27660D8D0FAD13D625A6632BCB179598B342BD397948A272B70BF4B63D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716417, "uuid": "3223c414-29af-4a90-afde-c89edb7979c8", "value": "7217d23c629accf319a08f2127eae757", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716417, "uuid": "f674d20b-8f34-47b1-a06d-fcdc53c00e1a", "value": "768:sMQlerr/RPFQgHnizO0f8p1Sco58NjtYhj0V9b/qf5LQGVg5mKY:7r/ffHnHp1ScBw0V9byn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776716417, "uuid": "59d7fdb1-2821-4076-9b45-588a114bdb0d", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776716417, "uuid": "4ff130fc-e409-4bbe-87e3-936ebf594784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716417, "uuid": "6cc6e1a2-fc95-4b3c-bc88-e6b93dab221f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e406ea34-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1776726099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726099, "uuid": "78f1c6b7-8d91-487a-8ba1-b241a6429cfe", "comment": "Malware payload (Adware.Techsnab)", "value": "d739261408014adc87eb7328e65f0931", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726099, "uuid": "aa1f293f-f5ba-46c0-a286-34b1efbd2f28", "comment": "Malware payload (Adware.Techsnab)", "value": "1602ef30af3b5de3f45ced75594a202a9e938a1b6e9375a210a33d269540430e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726099, "uuid": "bd32a547-0b54-43f0-b6ec-f3b6fc10b684", "comment": "Malware payload (Adware.Techsnab)", "value": "20f2817cb1c74ae7667b0462289c833cd2993a9b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726099, "uuid": "40a91fc7-9c63-4a73-968c-59f76ce28faf", "comment": "Malware payload (Adware.Techsnab)", "value": "79b1d9e02b5af1dfe63b2b0fda482e594e45296199dee4d82b59cb4ec27dd67f6e755132cab172f0b0ea4f7efb5b3f20", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726099, "uuid": "6edd632f-5516-4701-929f-7d620e86cb0e", "value": "T1A8B35B5B63A534F8F1778A38C8910A46D776B87217609FEF03A446561F23BE18D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726099, "uuid": "607a154b-a53f-42d8-bc06-c1d5f3441479", "value": "bc154ae61cef2e9bba953b01a2adb1d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726099, "uuid": "4376b5f3-a9e0-41dc-a0b4-aabf4130b16d", "value": "3072:yclT2CbShPahJB5pLWthk4xhoZgPzxw5Rg:tiC2hPW5ith77A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726099, "uuid": "24d3c278-185e-456a-990f-dac0e2f0ebf4", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726099, "uuid": "9004a993-ad54-4e40-aeeb-f100140844a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726099, "uuid": "4923d740-a709-4080-9c17-e0c3085cc8cc", "value": "1602ef30af3b5de3f45ced75594a202a9e938a1b6e9375a210a33d269540430e_1c77f395-f741-4ff2-8e19-d245b2ad3379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3037d296-3cf7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776716778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716778, "uuid": "2b6de15a-f56b-461f-9411-222cb9e5436e", "comment": "Malware payload", "value": "21a3389e0d4c9d449b0d79d4defcc758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaKiller", "colour": "#0CB74C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716778, "uuid": "a93512cf-2bd0-4964-ac6c-6e245d99bb63", "comment": "Malware payload", "value": "16d40adf1f39e3689b4ddd04fcdba1755acc2624242c9da9ed075d7373736603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaKiller", "colour": "#0CB74C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716778, "uuid": "9e816a93-80d5-4059-ae92-6369fce72a59", "comment": "Malware payload", "value": "3650f3a5d690f250a4ac3620b1c7e8330f84f2b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaKiller", "colour": "#0CB74C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716778, "uuid": "6da38c47-9acb-4c3b-b14f-321e974880fe", "comment": "Malware payload", "value": "fae78707e0a70143db97bb0fb9491b6fabebd6959e83596b0355639c8999b265e76007972ed8911c296263a676bf4f58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaKiller", "colour": "#0CB74C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716778, "uuid": "70737d99-4d6c-4e8f-b5be-04fca7a673c1", "value": "T1AD24905366EC3CE6D1368330B7BB43C1D72EEC6552A1C69E46D002859E3E193BD26BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716778, "uuid": "29e0a9bf-efba-49b3-a74e-c87bd60d2c8c", "value": "241b61c7b9eb651610850e09bc7eeb18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716778, "uuid": "2093d919-13fa-4d42-8ac2-90c99e6dc4da", "value": "3072:hJbZpKauh4MR4nWz0H8+xIUOA9zm/wQEQi8zhvbB7GC:hvRuau4bubA9SJFtV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776716778, "uuid": "d58f61dd-7efb-4509-b52f-2c804393e28c", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776716778, "uuid": "a9ff82af-a8a2-41ea-931e-0eab7f2480ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716778, "uuid": "93abd590-9445-4d46-85a7-e61b7f92ff32", "value": "BitWareExternal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f949144-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725314, "uuid": "9046a2ef-0692-4b77-8a55-f5eba54363c5", "comment": "Malware payload", "value": "a94ac3ebb735696ab683d9aaac625ed0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725314, "uuid": "549cbd6d-e509-4ce2-86a2-3969e85ae0e2", "comment": "Malware payload", "value": "16fd8f17f6b2991f20e4cb31deefb3a21cc7940a2e28ca5854935ce84c82c671", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725314, "uuid": "91a79cb6-a74e-45e7-991c-e7874204eab5", "comment": "Malware payload", "value": "200bb92002e786bb1e8072bbdd67845d1e205969", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725314, "uuid": "3e92fb27-2dd7-4378-9d4d-055a2f54e79b", "comment": "Malware payload", "value": "f91a9da03c823671cc23a2dbad974a58947934c1bfa79a0501bbb3db843ec18f865ec4b0430bb3fcdbd8feeac57c54cb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725314, "uuid": "029bb7ae-fd74-4f63-a245-810ffb952bd9", "value": "T1BBB35A57B2E400BBE17BD23985A34A46D7B2B81457609FEF07A4464A5F233E18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725314, "uuid": "49269146-7af5-49c3-b680-bf59d0fda13e", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725314, "uuid": "11c8bfc1-8bfa-473a-9866-01e880b034a2", "value": "1536:hXj0eyoElaUrYG2a0ETuZYd2THgS7VFrd0wfEZsEHPsWvfdN9dlIbtWJRdU+:hX9Fuq4L2YduAI/d0wcZsIV1da5WJnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725314, "uuid": "501f2e4c-50be-4ca0-bcaa-cb169e928917", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725314, "uuid": "4b7e9407-82ab-444d-8d4d-802081ed2491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725314, "uuid": "a7801147-2527-4ce8-961c-2e1270641640", "value": "16fd8f17f6b2991f20e4cb31deefb3a21cc7940a2e28ca5854935ce84c82c671_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2c3646-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727081, "uuid": "1b15e3dd-06ba-4afb-8a8b-69fbd6b2d3eb", "comment": "Malware payload (Mirai)", "value": "0fec672bdb29777e21083ffd883b0e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727081, "uuid": "34394afe-89e1-4c8d-a858-dd4a381cfcfb", "comment": "Malware payload (Mirai)", "value": "17d40b9ed8355fddf8d3390a9d6e53290e921069945fda9331a77c5e13abe7b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727081, "uuid": "24a63100-661a-4d0a-bb19-1184ce4bfdf5", "comment": "Malware payload (Mirai)", "value": "d9ee7364ea9f5f15c51fac19ca89c5499b4be39d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727081, "uuid": "147dc4cc-311a-452b-9dbd-f93bf7e55b9e", "comment": "Malware payload (Mirai)", "value": "b44b93e6c18d651b47235270a10ff96857f36207833e9da85e872173affd124975675b50ff4e107012fe4cb5dd7270fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727081, "uuid": "edb8a149-da05-4414-98af-e969c2bd3eb2", "value": "T112734B31F939092BC0D4917A61F74723B5F297CA20A8861F3E720F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727081, "uuid": "fbcd6eb8-6337-453a-aee0-48af76909a9d", "value": "1536:U2kN6QCXbqt5guvvF7tR7SYm5BHxS1H1tTtfT:HhilL7SYOBR2tfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727081, "uuid": "51fc2588-ddbb-468c-b4cf-61e9b1101adf", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727081, "uuid": "61964ef6-7173-41fc-b1f7-e5115938801e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727081, "uuid": "7e46338d-c4f3-442f-a8cf-6ca6257597ac", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5075dc-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726115, "uuid": "8f40b23b-673a-4c2f-8c96-22906a5bcade", "comment": "Malware payload", "value": "25d2ef17c88378b6428a7ed66c11f456", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726115, "uuid": "ccbcafb2-3c3e-4a51-b452-2e0dddc778c6", "comment": "Malware payload", "value": "184c0292f6619e5f0e9cb36f94ba43232175a6212a0ab27a17f39e73cf4fe44b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726115, "uuid": "16542d23-8112-4dfe-8e1e-3304b94c2d1d", "comment": "Malware payload", "value": "119290c08260bff74e0539164cf651e9af4f21a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726115, "uuid": "bb3b5a97-91c1-4d2f-8fbe-d076277f97fd", "comment": "Malware payload", "value": "e6005729bd20e8ad37609988c1d687aa356d9538421b0af83195be5900baaa5836dc1c4324dda21854a7478639d23452", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726115, "uuid": "b7d18de6-7f8b-43e0-af2e-2fe88976aeaa", "value": "T115340C90B281FDF5EC998FB820D25319A3FAF081971DEB2BA620FE3C025AB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726115, "uuid": "3612a5b9-a492-4592-97df-5ed327c9ef45", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726115, "uuid": "a0362eb8-907d-43ab-a1d3-0897e33b37c3", "value": "3072:19gVl7xAaMFlBT0S+EtKnk5sT2v3KVu6HyNOiZPU2TU2j/u7qM:I7CaMaS+cKnky2vKVu6HykiZcZ2j/u2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726115, "uuid": "17ec0339-ffbd-449d-ac86-bebd1027ae30", "value": 241110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726115, "uuid": "d0553679-4273-4514-969e-7ec6fdeca790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726115, "uuid": "73eec1e7-243c-4326-9277-09cb8b33e3c2", "value": "184c0292f6619e5f0e9cb36f94ba43232175a6212a0ab27a17f39e73cf4fe44b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc1b662-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776665933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665933, "uuid": "a03b2fb6-65ea-43de-8df0-1613dce76f61", "comment": "Malware payload (Vidar)", "value": "bed6594b6b9e719c9a12d44f80fd1dff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665933, "uuid": "0757acc3-f0de-4407-a463-522b2a5dec51", "comment": "Malware payload (Vidar)", "value": "1880e8aa663438d2daa2e622b066e05038811fc2b4d1657f011aadee4aaf1390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665933, "uuid": "17e936cc-bf41-41d5-b37a-d549160a5857", "comment": "Malware payload (Vidar)", "value": "766f51614e1a921e093dc145609dbaff84895498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665933, "uuid": "b95afda8-090d-4c2e-b1fe-f39be6f09696", "comment": "Malware payload (Vidar)", "value": "885eb609b1a0aae0b9ef152e1dba4ecb45260490cac45ea7ebb687a64e207cad2e485e6320b9a7cd18ddc12de5f133b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665933, "uuid": "69e9ea83-fe18-445d-b0ac-aab959b078c7", "value": "T10BA59E16BCD119BAD06AD33288B652A27B31F8190B3233D32F51AB783F7A3D45A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665933, "uuid": "f53ae9ff-34f9-4d43-b182-8cc628aa0d5e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665933, "uuid": "2b97fb42-60dc-493d-92a9-b0646c438280", "value": "24576:wYETW5uhzBhKegFSihT3sK5Us6wsEE7AWEudZyy9Gizstbd:wYEy5uH0SusDs6wsEczdZvob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665933, "uuid": "76e21cfa-0a20-4b09-853f-d6763beec119", "value": 2143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665933, "uuid": "d7be84bb-4993-4a08-8259-3f23be660f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665933, "uuid": "1ecbc0d6-bc9d-416b-a322-928420a294bd", "value": "t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac06f4d4-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725576, "uuid": "72c64606-98c2-4009-978d-885eb0ca27b6", "comment": "Malware payload", "value": "2e7055ef4bccf1ce3734f38ff4d9f39e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725576, "uuid": "8adffb36-f4b9-459b-a3bc-ff62d709c910", "comment": "Malware payload", "value": "188cb7f9fa424124258542cbc3cb72f014af66d51772664a237c042dc7f99ce1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725576, "uuid": "24d8260a-fbea-42eb-ad1a-9f088b23dbca", "comment": "Malware payload", "value": "d286efb30dc304520fb08cdfaffc3d981c323952", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725576, "uuid": "549d69fd-e196-416b-b67b-187e281256e7", "comment": "Malware payload", "value": "b1ad2f66045ef2dbf1efb732d393973dd23c3be30ee370b80740e63d0725465edfeb4b2d099bff379fa1663010f56169", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725576, "uuid": "527c159a-1d6e-4aed-9db0-7f2f5042266e", "value": "T1C4A3495BB2B600BBE2B68638C4570A45D776B8454761AFEF43A0426A5F233E18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725576, "uuid": "de64e31b-2c7c-4500-80fc-bc5e83c21378", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725576, "uuid": "d9fd2715-73b8-4035-9efb-748610d4088d", "value": "3072:zDNPzHPB/+WGPlQb6Ab7y34oyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHPvGO7:ZHZ/LWM6Ab7ka1vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725576, "uuid": "bf75b675-9420-407b-b4b8-5c89e03a2a22", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725576, "uuid": "9b20dabe-f21c-4ae0-8c10-57d446c86685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725576, "uuid": "b5d8b072-1807-4cfd-9926-86eeff4cc28d", "value": "188cb7f9fa424124258542cbc3cb72f014af66d51772664a237c042dc7f99ce1_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c0aef2-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725918, "uuid": "1aad9f3f-adef-43c8-bce5-df5b6f2d9030", "comment": "Malware payload", "value": "2a89ab276ad575871168b9a93e7e3e74", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725918, "uuid": "cea5bc65-9540-4bda-8517-2bd9238694b4", "comment": "Malware payload", "value": "1904c38b3941d6f8cc2d363701a23fb295acfe739dd2ee2148c249edd38b23fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725918, "uuid": "2bd57a39-0cf4-4d00-8efb-07f9d6d76fba", "comment": "Malware payload", "value": "cf860168b863635acda936ab20a43561ed99f6bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725918, "uuid": "f22372fc-16c0-4398-af6f-3a0455dc14f4", "comment": "Malware payload", "value": "64c66e0cffdc05c8b9d954f3858f3016fb4bfdef86831b98a8b042a3e3693ad44b3f84424d14b21e1d83ac4adfe83728", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725918, "uuid": "40f0a218-0d46-4088-bcf9-b43731bfa902", "value": "T14DA3495BA2AA00BBE1B78239C4670A45E776B8450761AFFF43A0425A1F277D18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725918, "uuid": "52e0f2d4-46c7-4a02-a714-e80ec0522c14", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725918, "uuid": "55b9c8b4-7eda-49e4-9382-66841a9dcddd", "value": "3072:E3LSyZJasQbORk9ETLFTpIS/GWmATME5JAST/2njLhbC3G1+SzoQsUSckVPxIiTu:uuy96ORkmTLHmwlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725918, "uuid": "b4ad623d-02e4-4976-8d5f-6e29afe24cc4", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725918, "uuid": "635aaebd-c8c1-4f38-9aaa-7693d649049d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725918, "uuid": "877f0b6f-0238-4493-8cb0-dd452d7fc74b", "value": "1904c38b3941d6f8cc2d363701a23fb295acfe739dd2ee2148c249edd38b23fc_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7df0c8-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725280, "uuid": "99412431-796e-4c32-8c20-6728dbd594d5", "comment": "Malware payload", "value": "fad48a931f94ffaf5a969ea9f28bb59c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725280, "uuid": "c9f8dd4a-e8d9-4595-b79f-431000c0d827", "comment": "Malware payload", "value": "19f7e0250094904f5abb1339202ab730c232d05ab88f7d539e0adfbbf77b33e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725280, "uuid": "c4f569ff-8e7c-47aa-b17d-dba4408d3487", "comment": "Malware payload", "value": "2d9252632ab5a1b2c9089c0276bda5cb6ba46156", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725280, "uuid": "5fe0e4bf-780a-4558-83c9-3d5354e31d62", "comment": "Malware payload", "value": "a3e0aa9e95d9c71cb6a5fbfd7988a0676942f89f58777677d7bac7e0065fa78241d345d3fd787f16715f842dc7e840d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725280, "uuid": "4ed6b87d-e1bb-4e49-9fac-470f4a5fb2a3", "value": "T19EA3495B72E600BBE2B68239C4630A49D772B8511721AFFF43A4465A2F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725280, "uuid": "ef647876-3a79-4c06-bb73-9957cbcab1b2", "value": "ca2cc89d744b30b4fd945d67c7483af6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725280, "uuid": "750113d0-b280-4e81-943c-130699f764ca", "value": "3072:vMIFxnPKtpWAePQJA/saq+mvmSOo2iePG3ufWC+vr//T/7nM4L3zm2Q9ZVbq+b2f:0Wnyt4H0A/sd+oAkNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725280, "uuid": "459be70c-2c01-4f32-9a26-12498f0e9358", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725280, "uuid": "3aae6c3e-141d-4915-aae3-d9e17ebe5e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725280, "uuid": "1b0d6e6f-6154-4ec1-96e1-b7ad527cf563", "value": "19f7e0250094904f5abb1339202ab730c232d05ab88f7d539e0adfbbf77b33e3_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a84fa45-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725735, "uuid": "e2dad800-4736-4ff9-ad38-48f0cb79e8d4", "comment": "Malware payload", "value": "b0b5c1d51041746b4377793072676b90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725735, "uuid": "17cc3bd0-b477-40c5-9be7-668c964f84e9", "comment": "Malware payload", "value": "1a08f4781707c147b81afd5f367f63fd2b0ace445511206cf859c89a9d781a29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725735, "uuid": "f8ea3c34-cdab-4b1b-86fa-0187b3688705", "comment": "Malware payload", "value": "c4691315e7868a017e5e87e7e4c27755a8e294b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725735, "uuid": "3ec11d2b-62d5-4d4c-8812-6d56cca9538b", "comment": "Malware payload", "value": "bd1cb3ce4fbb5b9d85ea86089f6f74ee2bf386b6f5631d099f063e6585ec50f22e75ba06ef29e6532cd30f921c01849e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725735, "uuid": "82d3396c-7ac7-4bdd-8a85-83094ca43d21", "value": "T1D482290EFB0BA8BCC848E67858FF5732A472B53306666B2F1314DFFA4F00554266E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725735, "uuid": "55bfe4fa-989e-42e8-8a8a-c0095c40cbd6", "value": "7e6047e86dfc28c96b06e3621db487ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725735, "uuid": "116c2ec0-6a19-443b-be9b-0367bcd69677", "value": "384:wSqD9rVoCtQyJxH7Iw7H/YyGGmckVPxIiTrBX3qWLkN:w9D9reJWJIOH/tmckVPxIiTp3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725735, "uuid": "81d2948f-fbb6-4ac1-a781-3ae20686003a", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725735, "uuid": "71440c97-e3d8-47c9-a237-a8a2814210c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725735, "uuid": "28613392-6db7-43af-9370-181486a75752", "value": "1a08f4781707c147b81afd5f367f63fd2b0ace445511206cf859c89a9d781a29_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5039e1-3ce5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776709281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776709281, "uuid": "ea30336c-5a36-4cec-88ee-2d9c59df9c5b", "comment": "Malware payload (Mirai)", "value": "77e20ed378ba184c3bdf288d175a4bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776709281, "uuid": "f5b0cbfb-ff36-43b5-9098-379d821c3c53", "comment": "Malware payload (Mirai)", "value": "1a3b92826a5094ae1cd44e7bea95a6ca888b181f70f7f99da60385cf61552431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776709281, "uuid": "2b7fe1e8-b98a-46b9-921b-f8b3674fbe90", "comment": "Malware payload (Mirai)", "value": "66db17452c4767885373b11ab9d4e7c48a4efaa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776709281, "uuid": "d94f6904-5ed7-48c1-a203-645fe5fe3087", "comment": "Malware payload (Mirai)", "value": "7509b39398371d736381dc6bcefb1b476cf8d35538c8a22d6dbb4bfd161df952a41dc90fb14df975b7191263f4bd3a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776709281, "uuid": "a0d16093-f823-4807-b3ba-809bfe8390e8", "value": "T1EC639E56CC251919C28A45B470EC8E3B1F23A5C053877DF716AAC3B9A067E9DF806FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776709281, "uuid": "a9bd987c-0c10-465b-8b36-02e12d37966f", "value": "1536:waW/FLeLiKJDgp4KbCV+7BuIzzCwZKEieMe:wjde2KJgp/b9IIzzJhdMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776709281, "uuid": "a6b182b3-0065-4312-b490-7b4a14866d9d", "value": 67372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776709281, "uuid": "99a209e5-ffcc-4b57-8c46-917647ae80ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776709281, "uuid": "b56ff214-b1ef-4324-a446-d7bafb88dfca", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0106f1ea-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687493, "uuid": "6376ef88-1d9f-42a6-b650-4f933790820a", "comment": "Malware payload (Mirai)", "value": "8a1b09ab5cc0b1abe0b49b75a7d5c815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687493, "uuid": "b577ccab-765c-4d90-a948-49c03774659d", "comment": "Malware payload (Mirai)", "value": "1b117bffef19e515c8fc9140e754dab732fd612894b5ceddc3035c1ddde58750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687493, "uuid": "8b7c13ff-9656-475c-81fe-61855d7e9ede", "comment": "Malware payload (Mirai)", "value": "04d1ba45a2d5af6a224770dc3365d19ad5bbefe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687493, "uuid": "60b98859-5071-4aba-9324-5cf13c863243", "comment": "Malware payload (Mirai)", "value": "8cad43bc611dd165446940141af106736ee87de035ef4ca699dcd7069f18916bc384b2e23673eeaa447467ab282f35f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687493, "uuid": "087f857f-d61d-44d7-89a2-d63ac1a5fb84", "value": "T1698312B4E4A6BF61DF688F36CC5201813E0F5B60DAB93D2414B64D24EDF166E82F9417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687493, "uuid": "97e20fa7-787e-4c72-a541-0863b010cae9", "value": "1536:4DjLGoq2aHf3f9Sq4BkzH9mbBxqIa2OGehl4AqANXhL7c77QwpZxlSb+qK/3q:4fLiuq4o9yxPOGedrL87xlt/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687493, "uuid": "cd8d18ed-ecdc-4326-9199-97ae240b81f7", "value": 87012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687493, "uuid": "4b26eba9-67a4-4fab-8940-5e06f70716f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687493, "uuid": "56f46a5a-478b-42ef-b22a-28dc1ac4f9ec", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9458f84-3c77-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776662113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662113, "uuid": "5c4038f4-d733-4785-b609-3850137906a3", "comment": "Malware payload (NanoCore)", "value": "73479891760291583ebe415c4b8dcbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662113, "uuid": "35d2a9ea-e8ff-49d0-a485-8ea2ada95784", "comment": "Malware payload (NanoCore)", "value": "1b53dd85b7392738c1810b950552fda5c6b274c7dd2e5b731a1eb101e3946b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662113, "uuid": "a942b60f-fde5-4ea6-981d-d86ea43b0203", "comment": "Malware payload (NanoCore)", "value": "487b7e3486c7999564d1fa7fed22d7ae5b3ca7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662113, "uuid": "db5ac012-7d20-4e4b-ad2a-21e63b151bd8", "comment": "Malware payload (NanoCore)", "value": "ebd11ac781bef180c0a11d70e203b683e0f22ae7b682711e05963a73f9db6adea75a420a153851d77dd4629ea822a993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662113, "uuid": "4237208a-8b4e-4cf5-aa8f-107a7c1f9d05", "value": "T14D64AE1137A4B52EE29D467963116272437489E2ACC3F3DA24CC72EB7A7EAE405371D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662113, "uuid": "ee1f4a43-15ad-4ef7-9c59-973ecc26b71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662113, "uuid": "fad20316-bbc4-4fcd-9dfd-a2f87eabad8e", "value": "3072:2zEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIBmDvfO32vT/T6BQ1bxjOhdii/:2LV6Bta6dtJmakIM5PvfO32vTj19B+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662113, "uuid": "c9d2e54e-8527-4550-aed3-8940a23f3d12", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662113, "uuid": "2ddb32fb-cb44-4357-bb11-9e47a4354d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662113, "uuid": "1b9709ca-93b9-4491-a301-47cf4bccd029", "value": "alppconnect.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f93201-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725135, "uuid": "f66f12d6-a2ff-495b-a8b0-cee6783f9228", "comment": "Malware payload", "value": "6ec8e9114705f153b9f8527cd3154157", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725135, "uuid": "b1813c04-7d9e-4985-adc3-4ecacd9bfd9a", "comment": "Malware payload", "value": "1b97037b3410f37f35209a512a1efd5aa4935251c93eeed78e65d34fb6e178d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725135, "uuid": "0833246a-4820-4afb-b86d-9c6848f5892e", "comment": "Malware payload", "value": "b0c54dc86e3bc27de9f55b7cc5389e5c1737d676", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725135, "uuid": "3983c8b9-2ffd-4bf9-a7cd-f425b7f3ab99", "comment": "Malware payload", "value": "afb0ba70361401e1008de36e90ef1a1f507b5212fae225721d7fcb50aa63c7382c990db7e10f4c855ff5838a046fea59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725135, "uuid": "36c67ae3-a354-4b51-a428-1d02743e12d0", "value": "T119B35A9BB3A500BBE1778679C5630A46D7B2B8511760AFEF03A0461A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725135, "uuid": "becfeea1-7a8e-4bf7-b224-c95cfc067ff8", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725135, "uuid": "06ac3b24-fb68-45d7-b884-318fdedbb8a1", "value": "3072:kTjx/azEnyFSpckqn/JqBJxSjjibckVPxIiTRQnol:kTjxuEyY2n00S6nol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725135, "uuid": "44e441d0-8878-4e2b-ae6f-29d0cb390313", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725135, "uuid": "cc4f4aaa-0194-45aa-8812-24b211851409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725135, "uuid": "1fbc76f8-e8cc-4906-b019-699e8d95c7bb", "value": "1b97037b3410f37f35209a512a1efd5aa4935251c93eeed78e65d34fb6e178d3_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efbe4eb-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725742, "uuid": "9d11f4b2-c296-47e5-81ef-e4ca97d224f4", "comment": "Malware payload", "value": "448e3a993155f155aefb78f35ab2a6d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725742, "uuid": "40a7b4b6-d46b-4a43-b443-63098d9ed966", "comment": "Malware payload", "value": "1bb312e1770e3a1684eedeee54b9bf0ec74f367209ee46fc0dcb76c4390e6ff2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725742, "uuid": "09174e0e-1b81-4874-a710-c8e30e2aab70", "comment": "Malware payload", "value": "1b0050f00409923489c0dc6f789a3455b05d30cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725742, "uuid": "0e08cacf-26d4-4954-bffe-c7dda71c5a82", "comment": "Malware payload", "value": "572585b2fc996918155c4a1eb0eca9076646f6dfee16afd792ac91cbdd3f4099023f18f4946f12c5e6787cacd2a74e7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725742, "uuid": "62cd6455-c058-4a93-973d-078441b809d8", "value": "T1C8B35A5BA2A900FBE5778279C4670E46E3B2B85117609FFF03A4425A1F237D18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725742, "uuid": "5cbc7f74-9506-4ca6-a81b-91b7d1c36543", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725742, "uuid": "f73c1b01-02d6-4fed-aea4-1c6060f54bcd", "value": "1536:9yxttrLOUnelseYw4MhLVxj5pVTH4SFcSdhn+hlLDvtEJsWTrd79dl27cxVrxpN:9yB/Rngoyhj5plYAhn41DtqBzk7wrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725742, "uuid": "653e0ec7-1252-4bde-a230-0acd2cc75b38", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725742, "uuid": "ab7d7a6b-84b9-4a40-86e9-eb393524cda8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725742, "uuid": "fb409865-3cae-4a9f-b4a1-14d57fb71957", "value": "1bb312e1770e3a1684eedeee54b9bf0ec74f367209ee46fc0dcb76c4390e6ff2_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49e690-3cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776711997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711997, "uuid": "27d94477-84f5-41fc-8faf-5eecd1a70974", "comment": "Malware payload", "value": "e19d1955a1cc0c8f74be3d286a34cfa1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711997, "uuid": "077353cc-7813-4ce9-9cf9-1d24a1fac04e", "comment": "Malware payload", "value": "1bcf17ce99fc748536317f9d28fd79f103f6166c1e548c0255ede0b434314352", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711997, "uuid": "565ca33f-77db-4d29-92b6-27c73fa3dd11", "comment": "Malware payload", "value": "53b768a2468031504a9fe92e29a418d78deb5452", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776711997, "uuid": "ac585036-04ba-44ff-bd26-0173df17ed8f", "comment": "Malware payload", "value": "065b645da751145bf1116acc4e4de5b27e37ec6d2cfdbf3ee5fcfd7c3b3339778239f09f402ff95458f51fbcaed60e32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711997, "uuid": "536e91c9-349c-4a95-81b2-f8fe532f6db5", "value": "T1E3D21998B3D0399827831BF77D3B65E6F67E089D3984089AC148BC9CB9A1356D5F2434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711997, "uuid": "474bc1d0-5c34-4e25-892b-ec8c0b1424e8", "value": "768:YtlKkvEHGykFFSwGaN2dWSdy2vVoDIajOAwktuY2qG1qD6WB4/gqX7fJena3FWqW:rgcSOO8Xgr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776711997, "uuid": "70d0167f-4c0a-4ae1-8524-43cd34aeb20b", "value": 30928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776711997, "uuid": "5bad30c7-4e8c-4f3e-a4fb-9aa3495ef866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776711997, "uuid": "d7dc369d-cb5b-4542-afab-eb3c30b558bc", "value": "parser.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7600784-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725998, "uuid": "5bb7b0b0-660c-4323-9c97-0192b59df1cc", "comment": "Malware payload", "value": "b62be21a2ee54b9577768b100b6061a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725998, "uuid": "a47cfea1-0c42-48f0-8406-7786549be46d", "comment": "Malware payload", "value": "1bf06a7957a65f5b54dfd34a1fa484215bc2fdb7892bfd1ebf07c47291b6da6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725998, "uuid": "b8a8cb7e-c973-4845-b9bc-42b8d0f104e0", "comment": "Malware payload", "value": "c39362d1a03d48b97c5a7edca16972705a985baf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725998, "uuid": "fe975698-5ef6-4f4c-b2d8-cf25acfaf0d1", "comment": "Malware payload", "value": "bfde37bf29a299cfe770cc144145a547ed1f8735c96c7baccfc095eb4f7641c7e75e06c0c208a65922965bb852286866", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725998, "uuid": "d7001f92-1105-41ef-925c-5e5536229529", "value": "T150A35A47B2B600BBE1B78638C8534A49D772B8454761AFEF43A4429A1F273E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725998, "uuid": "4d308b35-3d22-4f66-a2b5-b1f4387b1138", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725998, "uuid": "da24a960-bb69-4391-990e-1d10be87a86c", "value": "3072:ZnhriAfIJGupGCBQbfQMPOGQp/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMM:ZfSGwDMfQMP5P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725998, "uuid": "22793bb2-9e6e-4898-909a-7d1bd016e0f6", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725998, "uuid": "ac1928f2-2cd8-438a-8905-80d302a6257e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725998, "uuid": "2d8217ec-fa8f-416e-ad1f-c1437112a4e5", "value": "1bf06a7957a65f5b54dfd34a1fa484215bc2fdb7892bfd1ebf07c47291b6da6c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bc58fb-3c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668010, "uuid": "9725da92-5128-4595-9aed-3f48cac42159", "comment": "Malware payload", "value": "33981354a184e7603620d37e01f9f4f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668010, "uuid": "5bf5fe72-1f3e-48b1-bc14-624427e56bf7", "comment": "Malware payload", "value": "1bfcaf5444e67da8630d8f7077167268be09c47a9aa4e976e1d87979fd64cd42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668010, "uuid": "eace7e8a-50fb-4915-89a1-76e1ff230410", "comment": "Malware payload", "value": "14432aa3d3cd358af57935f1d8c783cabeb6e98b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668010, "uuid": "6a1ce9fa-e49e-4841-9297-04e139a128d5", "comment": "Malware payload", "value": "45c792c690fd1d15c15d23d9595f0fe6cfc702776a3ede6f132f293ce938dae245c3e4f36eeb72634c15d48933a1a3b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668010, "uuid": "129e0bfe-b12f-4cbd-93b6-0d69a8393519", "value": "T194561897B9D24953C4E43677B8BE80C433631EB99B8A16565E04FE383EBE1D90E39314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668010, "uuid": "f3590f83-a9e6-49fb-8ece-bdc72714bb82", "value": "49152:LoY5H6qpc+Z0AbnOWu53Mgv6RT2SgbaUrzVDv7wK5EZ:XBc+ZDbnOWu53M5RqDvVBEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668010, "uuid": "48dc1a02-e7cb-4667-a214-30b7c969a667", "value": 6357154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668010, "uuid": "53332c71-b99d-4624-a658-25baf6274d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668010, "uuid": "d2a12139-e4b2-4ffa-be56-00f69aede2b8", "value": "krane_armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ac4e35-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676675, "uuid": "b15bef79-578c-4af1-a5f4-aec6cddd5915", "comment": "Malware payload (ConnectWise)", "value": "7fe3d1a8aae5d52f2fdff909457f27f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676675, "uuid": "6ca43d1e-badb-4056-b383-fb6a792f77f2", "comment": "Malware payload (ConnectWise)", "value": "1c6cb8f90a751add097004c4fced1f1b74e3140a8c372a60bdda787e01b3df5b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676675, "uuid": "e8533afc-875d-4b6d-8d12-de25b36213c1", "comment": "Malware payload (ConnectWise)", "value": "54d86aabec25a1b9092e2ef1616939bd16377477", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676675, "uuid": "69bae4ae-7896-4a18-8b7f-7262197dac13", "comment": "Malware payload (ConnectWise)", "value": "f44e2e73de17e6974f3d6a991fec5965467c35168566ac2a699ffe6b1f9b3d0a4ea9f53ae764ff6257b8c9862db99499", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676675, "uuid": "f6b5f38f-3fff-404f-8d94-40c2fb005cff", "value": "T18E646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676675, "uuid": "7298e9cb-cab1-4720-a7e0-7cb7eab15670", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676675, "uuid": "99da6483-b47e-4011-ac18-b67825de9d1b", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9un:h1iw7gryNkSV1hy1Z1u2JLI9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676675, "uuid": "7686c853-8cc7-41d6-8064-f1d0269b19d6", "value": 312720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676675, "uuid": "2c1a90ef-8528-4830-88ab-bbd1d7a34f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676675, "uuid": "bb81be3e-39f4-491a-b883-ee8aa529790f", "value": "1c6cb8f90a751add097004c4fced1f1b74e3140a8c372a60bdda787e01b3df5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99def76c-3ce7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776710084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710084, "uuid": "509bf25e-5acd-4312-acd5-2b1d8fa15080", "comment": "Malware payload (Mirai)", "value": "f7fd95f4e9d35bcfd4dba0c367173a9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710084, "uuid": "eb3f9812-1f3d-46ed-a919-0414df1aa519", "comment": "Malware payload (Mirai)", "value": "1c8144b767fd8b2d139516b611df431e57f25f55470845660693397dae47cc71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710084, "uuid": "d00e777e-ace2-4634-8346-6ecdfdf39462", "comment": "Malware payload (Mirai)", "value": "c2d1039f504c24313699479fd843b6bc2c677f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710084, "uuid": "fbb5af29-21e8-422f-9fca-3d4acfeac6d0", "comment": "Malware payload (Mirai)", "value": "ab1a524d93a49e3ba8ce6135cef3858a372e6955172ec74b115ff01cff4f0f474d3752c17c09869ffbcadb1a350a18e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710084, "uuid": "f826e9f5-020a-4476-bf38-19486f71884c", "value": "T149734A57B94180FDC8A9C07883BBBA36DC6231FE1379724A13D4FE366D46E611E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710084, "uuid": "993cb248-2946-4f0c-b9b1-1a1e9269cbf6", "value": "1536:XnxtcSNyCkNvCKrh3L0t4B1IZbXLuO5WbdN:XxmSN5kcKhE4BkbXKOgbdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776710084, "uuid": "3909f994-7ffb-44e2-8ec7-aebff116876c", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776710084, "uuid": "0af21510-d0db-41d8-b355-2866bd79a63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710084, "uuid": "92ad87f2-cc48-4e63-b5a9-155a69ae6924", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060aabd5-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725727, "uuid": "e52cbb30-3ad0-4e2b-87fe-611e7052ebaf", "comment": "Malware payload", "value": "993f2dfd5218496532f5e8ca716c993f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725727, "uuid": "16b98705-7ba8-40cb-bfbb-b262da935588", "comment": "Malware payload", "value": "1cdcc64c28013ea9639884b194265a55ad065b7649ce7ba9e28526d17be8ddce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725727, "uuid": "0d37677e-de05-44f2-bb76-32d6f2372711", "comment": "Malware payload", "value": "e9f9deaf4dc0d6658ffbe3f83dc59880f9e8cd6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725727, "uuid": "27b2ce78-11d6-4777-ba2a-1d6341449f9f", "comment": "Malware payload", "value": "946c52d91a4afa73b18a73ec7a3eb207e95572cfdbf7cf94b056e87501a8e07f3ac133d5793fb13541fc99b9fd33c9fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725727, "uuid": "c81ff0ee-587f-48d0-8fd5-0a0749206988", "value": "T1D9341C90B281FEF6DC998FB420D2630993B6F081971DEB2BA620FE3C065EB54D5B3545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725727, "uuid": "1f7b58cd-ea16-46af-bba3-62576b2f8ae1", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725727, "uuid": "6708c852-5115-4bb7-a32a-aa2ef94f8dd1", "value": "3072:XcK0DaVl7xAacJ0S+dtKnkksT2G3KVuUHytOiZPvxU2j229J:Xh7CacKS+bKnkb28KVuUHyEiZm2j22j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725727, "uuid": "741384fb-773d-4bb5-a9d6-32d5ecbc4da2", "value": 234536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725727, "uuid": "51fb7a5f-2e47-4041-94f1-3791567b66c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725727, "uuid": "b605db73-2329-46af-933c-3f04729f36c5", "value": "1cdcc64c28013ea9639884b194265a55ad065b7649ce7ba9e28526d17be8ddce_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee8bb93-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776724910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724910, "uuid": "e6fcf24f-a7e1-4154-86cc-394068316cdd", "comment": "Malware payload (AsyncRAT)", "value": "f939381f2c65f068b5ad98c89bcc08c9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724910, "uuid": "22fe751a-c834-4087-ab33-c86f0c2a1d77", "comment": "Malware payload (AsyncRAT)", "value": "1cde2ae1a6ee52afc43f19279ea1a345510ed148822e6fc3960867f03ae5228b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724910, "uuid": "8656fac8-10a0-4a00-8ccf-62fe10062941", "comment": "Malware payload (AsyncRAT)", "value": "2e759123e6dc6d3274eb9eb26ea2605d37ed8dd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724910, "uuid": "0604e488-df80-4a6b-8908-7633152e34a8", "comment": "Malware payload (AsyncRAT)", "value": "e7875abf75f102b7b4e77470687111ef4df4f616f741a9c7311838cc7099b8d722add95ff5ec14b64fa81156e40962c5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724910, "uuid": "3ec88933-13e9-4721-8cde-50dfd8b44abe", "value": "T127A34A5773F600BBE1B68238C4A74A49D772B8450761AFEF43A4425A2F633E18D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724910, "uuid": "079ef29d-cad3-48d7-8fb2-a67a4154c210", "value": "75bd77cb82e3a8826ea92f57fb3fc322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724910, "uuid": "4955f9bb-a0e7-4cfb-8b02-09d1006d9d66", "value": "3072:+2pXzx5iu/sWZGaBQbiAKhO2NoAOjzJoyfm2GgzskZpgyzfWHRzR9aiDUYcS:+Szx87UnMiAKhdfkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724910, "uuid": "183fd55c-841d-455c-b35d-d1c342f3ba58", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724910, "uuid": "e982c156-50b0-40e6-94ab-e2fbccc75116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724910, "uuid": "e57a2992-fc35-45a1-a4ca-2ab2aecd553d", "value": "1cde2ae1a6ee52afc43f19279ea1a345510ed148822e6fc3960867f03ae5228b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55539c3f-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687205, "uuid": "e003d05a-6321-4ff7-a653-2801c98345c4", "comment": "Malware payload (SpankRAT)", "value": "4b060f9f38bef55dd66b71738081de99", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687205, "uuid": "81c15b57-d290-4cf2-90a7-7b63ad735d44", "comment": "Malware payload (SpankRAT)", "value": "1cff650d240b7d73b03d19da2c522ea69baebeab217a3fc118ebaab3428f4219", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687205, "uuid": "ffa8ca49-9fcc-40cc-9811-3d7a377bb850", "comment": "Malware payload (SpankRAT)", "value": "18563bd8b31d9b89b17e7d8059dab8a1b74b0c16", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687205, "uuid": "1a31435f-c05c-44da-baab-d896645e1943", "comment": "Malware payload (SpankRAT)", "value": "ae6cd8c95ca488b69d70a22037c6dc7ad1acb8d4e4f9c2ca3d5ca1a648c4b5917fd6381ec0cde231cbe555d2486a0456", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687205, "uuid": "7b1e5b2d-2c32-4a29-b6eb-4a3d8e01fe89", "value": "T101055C03FA5985E9D59EC03C875795366A37B89D0B3076DF22942B283F6BFA12B1C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687205, "uuid": "db9fc84b-73bc-4c6e-b050-e31d3c064464", "value": "91a180c32f0b25ac86163ec9ed546b0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687205, "uuid": "1aac4055-f906-444e-acf0-eb7ac73ea976", "value": "12288:pusfzQI8H4DnjHd6lCyt5vcEItcARjk264izG1HycF:pFzQFYDjHdPJEACo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687205, "uuid": "78d2199b-d491-4195-84fc-5ae4a334b9ed", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687205, "uuid": "62efe441-a830-4b6f-a3cf-df9d1412a797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687205, "uuid": "f4a645b9-aeef-4ebb-b48a-9dce2c13fc4c", "value": "1cff650d240b7d73b03d19da2c522ea69baebeab217a3fc118ebaab3428f4219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24e5358-3c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776670611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670611, "uuid": "0fb05ada-87bf-4b84-85af-626f9c0771a6", "comment": "Malware payload (AgentTesla)", "value": "044890ef0661b2e2e12c558e5ed84a4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670611, "uuid": "212f3317-5ee2-44f2-bdf8-2ee62d3a6975", "comment": "Malware payload (AgentTesla)", "value": "1d2db76233b09e357be8dd7324f6b7dff6a9f8082e12ba057508c478d6523e01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670611, "uuid": "82c4b0cd-3289-45aa-9c31-9066776f4921", "comment": "Malware payload (AgentTesla)", "value": "7110fffa93d75d86e00f158b6e42121b5d5fee57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670611, "uuid": "8dcbc584-8b26-44b8-a28a-03e9f19e1b91", "comment": "Malware payload (AgentTesla)", "value": "4d1a85496a44dd16d87744bdd9e5ca74f47e322ad439781c3fbdb91091d3cdd94b30f7f2718c7f6fd02363edc9e19e53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670611, "uuid": "7b00ae91-62ef-4e60-a8af-065b5931b879", "value": "T1A3B5F1990B8EC6F8D32BECB486C79C4BDBD5C21E172DD6859B637DA52022C6CF0B5484", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670611, "uuid": "bee57590-03e7-4604-b8b5-3fd669f6f5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670611, "uuid": "55051085-d60e-4f03-9778-8a1985d9c0ae", "value": "24576:EOY1t1aTtDCR8aRvjVcY/ddwAKoGXaJ6/X:EoaR7eyddKv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670611, "uuid": "3e440266-7b2b-441c-b14f-24202bc872c1", "value": 2486784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670611, "uuid": "fd93c674-a27e-411f-8719-90083353fe2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670611, "uuid": "1e4ed233-3a34-4ef8-bc61-5c6195599da5", "value": "mmmrrrrr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4beff02-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725644, "uuid": "fef30396-6e8c-4ff2-a9bc-e1c9f7c7b525", "comment": "Malware payload", "value": "a9572d21a0e9fe79e85eaae3cdd92a14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725644, "uuid": "148efc61-7866-4b33-a7a5-199eeeb2ddda", "comment": "Malware payload", "value": "1d313d369d52d346d5a29ccc248de32ae5481101f45c4198e6c2eff1447a2aa4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725644, "uuid": "50a9c9fc-1a7e-4c3c-a535-1aafe12fc47d", "comment": "Malware payload", "value": "09e3fb2e363916406d670b1951605c67952eec43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725644, "uuid": "e8ac7535-580f-4903-9f56-72c891dcbd1a", "comment": "Malware payload", "value": "28a309c9614a351919c3366a1102ba27ed40ccef12c87689c59943562e2488899eb2bd488fa993e1bf783def6d0cac0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725644, "uuid": "b4a43f51-3101-42dd-bfa3-b091b97445b0", "value": "T185A3495B72EA40BBE1B68638C4630A09D772B8560761AFEF43A4425E1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725644, "uuid": "d65f6d54-0db4-4f76-a0aa-7010a10f26cf", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725644, "uuid": "2f3c5cc8-ba93-491c-b455-e37f169cd312", "value": "3072:atd4yN6xpAqJQVAvfhxt/rB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51pyQ:+dJkTB4Anh/6XJsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725644, "uuid": "e8f3ad9f-42bd-4040-907e-c4e46e7d4eb0", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725644, "uuid": "db84f2e2-5de6-40fa-b4af-f5d40f0504fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725644, "uuid": "500620fe-b8f9-43d9-b516-87762bfe7c46", "value": "1d313d369d52d346d5a29ccc248de32ae5481101f45c4198e6c2eff1447a2aa4_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13997714-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724891, "uuid": "c91858d3-f819-4c6f-94b7-14bec91c9c27", "comment": "Malware payload", "value": "fcbf40449e5c67d3a16fd6aad629cb31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724891, "uuid": "54cb1fac-f1af-4e0b-a5df-5c3349c60e48", "comment": "Malware payload", "value": "1dab18df9509122bf317e7a2e65374611098928b3a72348ebca362d71410cbb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724891, "uuid": "9a2c34e4-469d-4ed0-a484-7fee2f0ff61f", "comment": "Malware payload", "value": "c49fb02ce7912501009c84ea0fafdde58c2294f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724891, "uuid": "eb228510-a46c-4143-be76-1883b827df6f", "comment": "Malware payload", "value": "c60c1354c9b84bb48f6f39e22a6bb07abda5f209a0dbc4a8d7957a8a9c3c814a3f226def6bfcd59bbfe7930597e7f27e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724891, "uuid": "0c3bb9a1-1d65-4c89-93af-a70fad334059", "value": "T1A1B34A57B2BA50BBE1778378C4670A45E7B2B8414B61AFEF4390465A1F233E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724891, "uuid": "79b4e8b2-bd0b-41e8-ab4c-ef05870ff5b4", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724891, "uuid": "5c00b348-7e2e-4e10-b441-8e767676712e", "value": "3072:iLTXxQHNopvHzzSgGyVQezDZ4C/x5qVnV5K:WxA6VzXL85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724891, "uuid": "da2436fd-e23f-43e1-83c7-07576c479364", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724891, "uuid": "54a0b4aa-86c8-4365-98b5-d47180df7fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724891, "uuid": "61cf4320-e241-4c6a-aeba-9b51b7a4b60e", "value": "1dab18df9509122bf317e7a2e65374611098928b3a72348ebca362d71410cbb1_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd29dda-3c6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776656407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656407, "uuid": "9b968c37-95cc-49b2-8382-073f61e9fe53", "comment": "Malware payload (Vidar)", "value": "9356cb9f49cba76f7ea12b3305653d6b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656407, "uuid": "666ba7e6-35f2-48cd-aa66-616c0d79c9b0", "comment": "Malware payload (Vidar)", "value": "1dbd3996d8476d052855fcae5ca9d05382b2d8ed22d09e18da072b7a27037acc", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656407, "uuid": "99143801-7885-4b52-8548-3b1c5c456960", "comment": "Malware payload (Vidar)", "value": "1b77975de1ee64987dfc923cadee71e44bbfe9c1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776656407, "uuid": "33af6130-b766-4120-bc98-de1c430b21c9", "comment": "Malware payload (Vidar)", "value": "a9d5a66c57b0c7fbd3a91a4a989e463f3a4949acb6129d70dc570377c2974faaef015c20b8919161f3caa94ec31feba9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656407, "uuid": "8548d4e8-79d0-46cc-9653-b7d8fdad0adb", "value": "T1C9D58E12B8B952EDC44D7E3644F16191EB74FC090B2A27DBAE957E382D3A3C10C7AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656407, "uuid": "8ae7fc01-abce-40ac-96c4-74cb43304301", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656407, "uuid": "f0b9f432-41d4-4a58-9730-1f3086c0a1b5", "value": "49152:6MSfVpzZctzVDl4Nb4SmulHCS6HzFFwzPVH2/Zkt3CD:6MqHmp4Nb4SmulHCS6HBOZHeZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776656407, "uuid": "4ef0f444-dbfd-4861-a77a-5b7d242e2fa3", "value": 3008136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776656407, "uuid": "b5290009-713d-4b59-affe-a9364be0f31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776656407, "uuid": "9939abed-fa31-4aa4-8c45-011f66ff98d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4f5c67-3ce8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776710356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710356, "uuid": "268a572c-72e9-48f6-a8da-99ed77c37145", "comment": "Malware payload", "value": "aa024bb8db61c46efb00c81efb37b769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710356, "uuid": "faab6e82-2a98-4112-bffc-1500038e4581", "comment": "Malware payload", "value": "1e52d255d1cbaaa27189559e168289c7a93c3daa513a75102350939c3bacabf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710356, "uuid": "4343c246-33b7-4e18-901f-903a247d9fe8", "comment": "Malware payload", "value": "10419dc44269133dc66c76ee2c0cbab052d071f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710356, "uuid": "0668c767-f6d1-45ef-96be-274f15b26d3c", "comment": "Malware payload", "value": "56de33264c668c81197ebeb45c3eb4bf16eb91242478ec1b0c87b2d43f470a51ade85caf65b464fa4cd58a7e47198bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710356, "uuid": "9f77c93a-e87d-4601-a717-28994ba74a56", "value": "T12DD71221398EC426F52E35B0DAECDA6AB62D6E660F7144D773D8BD5A1A304C21332F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710356, "uuid": "156b8a08-fe40-4eb4-b279-f9038ed12447", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710356, "uuid": "0cb6545a-96b5-407c-8c01-e3566c9dbcd2", "value": "1572864:EN5tgqSn+Tqv146hJ3iS9g3WyQcOrYEoaMetzpaqdKbBE0SGE0Epkl1/yDfN:3yS9glQcCYEoa9pJ4+0SGE0ea1yN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776710356, "uuid": "d2704e0f-2fad-41be-9c3d-e16bde4c8f8a", "value": 59576323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776710356, "uuid": "3fa8b06d-2a8c-44c8-8b67-880c855dc8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710356, "uuid": "42f3bd33-ca8e-4c55-9664-84319534c086", "value": "Gyroflow_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9ccd17-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725954, "uuid": "40936ce4-f956-4d0f-a808-228a9295edb5", "comment": "Malware payload", "value": "15248dff6895bf1274fe6cbca41de0ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725954, "uuid": "3d956203-ab5b-4bc9-9c60-b27998293ef6", "comment": "Malware payload", "value": "1f0191cc5bd8838fdd46e8969eeeb6e22b0b1972912271fa1afd06265e2aa6e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725954, "uuid": "d61cf7ca-104c-4561-b552-706f442a8000", "comment": "Malware payload", "value": "c9afe9abe54ffba8a0a2a2b91baa6b2d15750e4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725954, "uuid": "4437130c-d4ef-4e52-9141-c375fee50701", "comment": "Malware payload", "value": "8e446b11f525659622f36c8722569e3cb593f48da4ac02e4a619e2c936974f286317b0041ebf0ccff9b6cf2b290ed94c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725954, "uuid": "f6d10d9b-1198-42f0-83b5-10b465c7d8da", "value": "T12D72B60EF75358A9C50AD1B845FF8B72F8B4746286775B2F3260D2B62E115B8632EE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725954, "uuid": "fa9ee723-ec2d-49ba-abbf-e0e1c962de42", "value": "97cd355bfd26c86a2d6dc518a82bee6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725954, "uuid": "779d0051-700b-42a6-9005-00b8d0527f46", "value": "192:kT9DA9mw9U2nz/+tNayK5w5nWAjZwhC0TGeYEeJL1LJlJ/5/qZSLUu:kT9DA9uS+ayK+lWcwhCCK/L7/qZSLUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725954, "uuid": "7bab1302-c743-4647-b859-188ee2122172", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725954, "uuid": "b8cf765d-4e90-49f1-aad2-f71996c3ab76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725954, "uuid": "5498b0a8-9307-44c3-9d6b-f8a32cb13266", "value": "1f0191cc5bd8838fdd46e8969eeeb6e22b0b1972912271fa1afd06265e2aa6e2_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ebabe8-3d13-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776728955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728955, "uuid": "e2d9c969-bf6d-4d4a-9fb0-831fee7185ab", "comment": "Malware payload (Mirai)", "value": "8c145c4e3ba890b71fcd18c00eb18cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728955, "uuid": "e7c5ce8e-e06d-4ba3-a803-e3c1685e6a27", "comment": "Malware payload (Mirai)", "value": "1f6b5ebca75ffbfbbfcc9092d64cc479ecd4b2b3e124ffe64137b3555bcf8d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728955, "uuid": "0891726f-d72c-4849-b67c-56ff1c5ae88b", "comment": "Malware payload (Mirai)", "value": "3e29f1443662fc0c47e0a2813e3306a30784fa8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728955, "uuid": "ca4e031e-15be-4b7e-9e39-0dc285b7a875", "comment": "Malware payload (Mirai)", "value": "69a2b5053a129b23e99559fca3f1aa102a64df5752eee895bd34e5a77baed35db3407071e62d6b8d3e194ee79ac0ae55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728955, "uuid": "82eb506c-a97a-4545-9b62-b523eba89213", "value": "T1DF132B42322C0E5BC6A66AB0253F17E093BFE9A020F4F584655F9B868675F371087F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728955, "uuid": "cf28a4de-adad-4610-a1e4-52809297edbf", "value": "768:sJu1MhGolG1QN8GvotOR0jMJZaGfrnEVnJF8RbhoIAA92:8h/lG1QN8wo4xvlEofAM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776728955, "uuid": "222982ce-8575-4da6-8453-c8359938b396", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776728955, "uuid": "0897f6a0-9f54-4361-875b-1435f8607ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728955, "uuid": "fffc7171-b527-43f5-8aa6-71952560f7f7", "value": "00okppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feae635b-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724856, "uuid": "00373c80-a580-441b-9269-3fe5d2ded275", "comment": "Malware payload", "value": "ffd52dffdfb8340a2dda27fcab828fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724856, "uuid": "cb178786-b97f-4f1e-a52b-98991837a8fc", "comment": "Malware payload", "value": "1f97e6b66a3bdcac1b0438d9dbf7b298dcdc57593692f10f354fef9640397817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724856, "uuid": "c6c510fc-e02e-4606-b499-e19879fb298c", "comment": "Malware payload", "value": "232c99c09b04b98ea62e9562454a492ae27099eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724856, "uuid": "31f9d2c2-38c9-4c11-98ea-52c6f1eabcbb", "comment": "Malware payload", "value": "067dfed07506d93392d4f85186aca0de72a96f6ab01f6980d2db82edcbe642c28e835963a16ef0e1cc9581c56b6e8c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724856, "uuid": "1ca51ed1-e286-4966-a267-39b9a5cb270c", "value": "T164040812F39760DCE1B7D1345BBBA233A531BC5945F0BA6EA5448A387E10F50BA38F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724856, "uuid": "3f8fb017-0657-4028-8672-b279d7de3c1a", "value": "f65036381332bdce4f4cdc464cdfaab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724856, "uuid": "ffb3b716-dc89-4992-8800-3c971cfe4dad", "value": "3072:jbsjDT7Bvx29xUYuDOH/OhuJw758TEO9niTGq/9O1gyugnB62d:vID3t0UZk/Cgbiz9iwmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724856, "uuid": "93551f11-a35d-4e22-a7e1-7f0dae6de27b", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724856, "uuid": "81cffa68-ce5c-4c9a-9aa2-f0c37cf781dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724856, "uuid": "e6a62cc5-125e-43ef-970a-e8a4a840bf0e", "value": "1f97e6b66a3bdcac1b0438d9dbf7b298dcdc57593692f10f354fef9640397817_e5e0e831-4830-4057-bf9a-a995e6377dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1616a5f0-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687958, "uuid": "112e19b6-f972-4dda-9d26-f07374724e10", "comment": "Malware payload", "value": "3100e1b3c629f2770d6f167c2f43de17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687958, "uuid": "0a1042d1-876d-41f3-b7e2-af696dac201a", "comment": "Malware payload", "value": "1ff108d9632defe85c04d10387fa6bcb1cbfdd4f5a0d3be908421eb64eccda04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687958, "uuid": "245ab123-4f7d-4b3d-9cf2-de7104351145", "comment": "Malware payload", "value": "77e18609d68c596276b78a8d487d118748345d84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687958, "uuid": "90a253f6-535a-4016-a75a-b4e6d9d68ef4", "comment": "Malware payload", "value": "cab17c5ad049f0b1dcbd25ed0d8a4cdd713b6fbdc1ca77153de8ab4a964b647629e0d06ecc639c0d083ead025a9df81a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687958, "uuid": "b1557559-5474-432d-aafd-c60c4bc9aa6c", "value": "T102D5233D33A815A5FD77A07CCF45A3A2D3F2B20A92D0A39A1A704B746F53A55F12D390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687958, "uuid": "fed39d5e-5bad-4483-9c94-d2a98e3cab73", "value": "85d2e8c6ec9e8b6911ddc0df3580b80b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687958, "uuid": "9bcc2aca-c5ac-4bf9-ba30-3a963c39e435", "value": "49152:zoIayIyFln36y6vC5Qvu7GbjczW30iANypJfkoiWMPFpizw:pDnH5KvBbjcy7+yDfkzW4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687958, "uuid": "6ed696ef-3923-4d2d-93e2-f74f6fe1d542", "value": 2938368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687958, "uuid": "7028f962-c77e-43cf-8a1a-b7db2e0e94ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687958, "uuid": "e6fc9980-2ed1-46ac-a4a9-405e7f517b61", "value": "netdde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c8091f-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726081, "uuid": "1e78e3b2-e2b0-4e2a-b732-c0dcfa40add8", "comment": "Malware payload", "value": "2ca1815f40b0ddc93d4d1883ae777297", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726081, "uuid": "ab5119d9-c647-4f88-983b-2fd6202cbc1d", "comment": "Malware payload", "value": "20094e09a2d2778a3d17fa871c7dec42c39472dd651ad08a8910bcf26139b90d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726081, "uuid": "c9104c9b-7b1b-4f98-958a-9f5e614383dc", "comment": "Malware payload", "value": "b7482c7de51c3c62b0301986f8d116e90235706a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726081, "uuid": "21262476-8881-492a-9f3c-a098e7d6f104", "comment": "Malware payload", "value": "d6b61e4db954f0393ba2057d7e4fee9debb3573b010d9078ad11388120b2262b1617c2a2647b26da63bec645b209890c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726081, "uuid": "127a3993-3d56-483c-a592-ce92f278a010", "value": "T19D341C90B291FDF6EC998F7820D25309A3BAF0859719EB3B6620FE3C035AB58D473545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726081, "uuid": "e12dd8d2-65e9-4293-8062-55a29dfddd07", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726081, "uuid": "ed173fd4-b1dd-4981-97ad-62f5df5640e1", "value": "3072:jBqsVl7xAaX4z0S+UtKnkvsT2y3KVujHyZOiZPzxU2jQJ8agkmM:77CaIQS+MKnk02IKVujHyYiZC2j88wmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726081, "uuid": "cf5e12d1-046c-4a34-9dfb-5e0c96991b29", "value": 241659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726081, "uuid": "277134a9-2ce0-4015-aa8a-66c0bcd120fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726081, "uuid": "0622b902-6624-4226-b4b7-b46c16eb9bd6", "value": "20094e09a2d2778a3d17fa871c7dec42c39472dd651ad08a8910bcf26139b90d_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ef2f93-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697568, "uuid": "beaaad03-63a6-43cc-9e16-b373b8766fc5", "comment": "Malware payload", "value": "90ca8a51e113613320602a8df171706e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697568, "uuid": "14cb7d42-44d9-4035-ab83-d735b6e7b594", "comment": "Malware payload", "value": "201b4407e714ab141fd095d1df64b2ec0dafb62deaa70b5fceb3d8a6d6563a58", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697568, "uuid": "6808f109-09d7-4bdc-9e96-75761e145907", "comment": "Malware payload", "value": "30e8e79f3ac5bc1d38e8e29c769c8daac7d6c4e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697568, "uuid": "11f0a073-8f04-41a1-aa8d-fd7352a5d908", "comment": "Malware payload", "value": "5f7a81c65608f79b3451ab6d9e71e0508870bf65654acb1a355bfbe285d40c91df159ba04a544111bebeb6a3f37fdc17", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697568, "uuid": "e401fe98-76e9-4c8f-a8ec-d4d68323e2a5", "value": "T14AF4BFBCFCAF75522927763ACA37C42487D4EF276025541CFA5C26209FAC3048AF59E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697568, "uuid": "5b6d0514-6050-48b9-932b-119225fa82b6", "value": "12288:k8FaJX5MA+/5ZJZ6n5ZJQxm5ZphZc5Zp5DBv5ZJSjAvZZJJZNZZpZnPZZpZBIZ5K:cX5MD5ZJZ6n5ZJQxm5ZphZc5Zp5DBv5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697568, "uuid": "109528c9-c02f-4a2e-ba93-7cfa41478071", "value": 785252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697568, "uuid": "d6aa1812-a318-4f8e-982d-15a2f22ad59a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697568, "uuid": "cb75fa8a-1b53-47c8-9fd9-9a8b328c9f95", "value": "RFQ-AJC-QINHP5-TIS-L0009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e918090e-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724819, "uuid": "992c62b3-8568-4d97-ac1e-61d61cf67fc1", "comment": "Malware payload", "value": "728d9d774f933d3639098c4394c33814", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724819, "uuid": "b5e15af3-0391-45b8-aa13-2aa8673a9e9f", "comment": "Malware payload", "value": "2078c3db731b4e5d3028f3e615a455b8222c364dfc7de40a9fd8ad8bf8c0d972", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724819, "uuid": "477a040f-958a-40f3-9f48-5314b1dd0ee7", "comment": "Malware payload", "value": "9b843f63739533290f701b285562b0ad0bba6df7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724819, "uuid": "1e81b149-99f3-4e1f-b28e-5b173facf44a", "comment": "Malware payload", "value": "911a99044d6b1245fde7171aa641a39eeacbd33041444f1b23e24c574386939ee07bea04c62f58947264717a22f97e53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724819, "uuid": "1eb2413a-5f27-4f0f-9999-f9a9567147cc", "value": "T1D1B35A4BB3A500BBE1778679C5630A46D7B2B8911760AFEF03A0461A1F277D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724819, "uuid": "dd8e01a2-b17d-4f5d-aa94-1c9193e573f5", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724819, "uuid": "1d1ea695-3182-45db-ae80-1fc8adad046a", "value": "3072:5/azEnyFSpckqn/Jq/JxSjjjPckVPxIiTRQrol:5uEyY2n0azOrol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724819, "uuid": "8e17fef0-780c-4e18-9a9a-5e426e1f9616", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724819, "uuid": "5fb6c8e4-0ff6-4c45-b944-a990598afad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724819, "uuid": "e6cd5ccc-ea63-440a-a217-6dde370c7fdb", "value": "2078c3db731b4e5d3028f3e615a455b8222c364dfc7de40a9fd8ad8bf8c0d972_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a2df52-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776697598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697598, "uuid": "d1ab7f6e-1147-46ab-a602-20d07b3fb43c", "comment": "Malware payload (Formbook)", "value": "dee953dba4233902bc2fef70706a6d22", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697598, "uuid": "7b552fec-0193-449c-a4a5-eafba849539d", "comment": "Malware payload (Formbook)", "value": "215ff84ed282c17113878b3bc732caf74795d6a81476969a5f96ca426c13f6b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697598, "uuid": "34c1aec5-8241-4666-ab50-5b29e77f09d4", "comment": "Malware payload (Formbook)", "value": "be41aa23b3b929f27dd5a813f01d442a2362de1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697598, "uuid": "64f66fea-d949-47ab-910c-2d8fa2b6b62b", "comment": "Malware payload (Formbook)", "value": "cc714bf62801b2d801d95e9e33d57c70184f05782c0b2a3e9dbfb2301ea0d8a9f32d0464f367f5237aaf348e67256a8f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697598, "uuid": "1e9c66e9-8600-4750-8369-ccfb4011d43c", "value": "T13195021599C43FA4CBAC261960FE290E63F0CE8A5059A58DFBB3BD4ABFB760441171DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697598, "uuid": "462338bb-0515-4d12-9d3a-7def5978b2a0", "value": "24576:0rW8XhuLqPuuy/BTuoYWuDZrevhpWsnh7XSEasVqQAU8dG1pX0AHNBDpqN02Fzd6:H7e6TDvysh7i+qq10gNHCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697598, "uuid": "61cce90b-7374-474d-b383-a8ea1f2bd5e6", "value": 1964333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697598, "uuid": "ecbe2875-3dd3-43ea-b3ed-c7e4a674e9df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697598, "uuid": "aebc5413-1e1b-4299-bd52-4ce0c2e86ce1", "value": "FESIRPUS2103001-RIDER.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243e210-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725399, "uuid": "a1947cfb-1047-488b-b22f-cbf50819b474", "comment": "Malware payload", "value": "49dca5606d0e97dc08f15b64919e6d90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725399, "uuid": "d5aa71e6-c337-4f43-8aec-6b06b68216c2", "comment": "Malware payload", "value": "21e3e759b4da8212cbc58c50e6f90335c65f5f83317f4c19cd5381369c2676db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725399, "uuid": "a313dd23-6bce-4b5a-a80b-b04b7ab55224", "comment": "Malware payload", "value": "212ba1c95d00b8a84f53df2596d4ba9da25418fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725399, "uuid": "bc487cac-96f0-49c1-aad2-b6e6290cdff7", "comment": "Malware payload", "value": "c1509ef5720a185480069616cd275d34c371286de6c26c0d6b57850fa3b617c11ed6e7fc00d6bfda5ebefc6cf3580a07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725399, "uuid": "58098e74-4ed5-4ccc-a5eb-e89d0449c6d5", "value": "T1B3A34A47A2EA00BBE2B69678C4530A4AD772B8551760AFEF43A4425E1F273D08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725399, "uuid": "145a8fc7-5910-4baa-95f6-9dc672f5e90a", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725399, "uuid": "b2164f35-a560-4fce-8356-217147686d65", "value": "3072:3PTeXQwDasaAmiTQhAS/xYN0O51756565rnIryH3/ChXK:LeXbuFaTcAS/0eb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725399, "uuid": "95f36a5b-50c0-450c-b55e-4e66a8dba485", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725399, "uuid": "536c0f8c-2b79-439b-ab4d-5b975157da37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725399, "uuid": "a95f035f-ba9d-4170-a009-93c0b27d1d35", "value": "21e3e759b4da8212cbc58c50e6f90335c65f5f83317f4c19cd5381369c2676db_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a41d16a-3ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776707454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707454, "uuid": "6a938fad-5baf-46ea-ab6a-6196369553ce", "comment": "Malware payload", "value": "6cb495759cf7147240626f03907b2c43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707454, "uuid": "49866e2c-176c-4b6b-a5bc-5fa4d538ba3f", "comment": "Malware payload", "value": "21e9f4f9742345c711c5ce69fce2f39ce848011fc0edad51f5671ac6f3767287", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707454, "uuid": "27cee399-8078-4f25-bf93-1829c4e748d7", "comment": "Malware payload", "value": "b4cb4a0aaf3a221826eebc798d3dc85cd28de485", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707454, "uuid": "2a7fd6aa-2b2b-4d0b-8142-142dccf9f2e0", "comment": "Malware payload", "value": "78ba0e665aec197cc85b777e4ed4cd7d861983f97b9dc85fe9ddae52221124ef30399cb568181cf1bffee695715ab5e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707454, "uuid": "c6799f12-2eaa-45b8-948d-6e92fbd697a0", "value": "T18A136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBF8B3CF18C55A9CE218719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707454, "uuid": "bc17600a-194e-4cd4-8463-f3b08f12b05f", "value": "768:bPs9NyXsZztC39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bkHusZ5cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707454, "uuid": "3d590357-bd59-4a54-9ade-5e6b530a835a", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707454, "uuid": "105f97e0-2dec-42c2-83b8-95ebad1e607f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707454, "uuid": "e851ab88-a0ca-42b9-a4f2-091d76d59f95", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166c88e4-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725325, "uuid": "ece543fe-e3dc-4c17-a275-fda9b89900c1", "comment": "Malware payload", "value": "604bd3f7fd627afc08f4fdf623edfc13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725325, "uuid": "a2a15d4f-2ed8-46a4-a195-7211c06cbb7b", "comment": "Malware payload", "value": "21fc49b47bd1c6c8412ac49a08a2013c91330608c2dfc353a3d196a0318e8e4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725325, "uuid": "370decdd-f356-4505-84ff-8ffc5479508a", "comment": "Malware payload", "value": "c3508ba08059106430e81fb1099a6c90690ba57d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725325, "uuid": "3773de51-98ef-4a85-901c-0e457f32ce14", "comment": "Malware payload", "value": "8f82e321b882fc2bb8a1aaade95be9079b9fae1be3bddb16937bc6b106a23fc1e76398351ed9bdff4137892ff0630faf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725325, "uuid": "c6449cca-9e72-4ba6-b3e1-138e41cbf13d", "value": "T171B34A57B2BA10BBE1B38739C4670A45A772B8414761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725325, "uuid": "0eb94038-ad76-44b1-b77d-4c2744065157", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725325, "uuid": "7b92b564-b489-47e0-96b7-7f571822d7ff", "value": "3072:N3QQah85ZpA4rwgw3L0VQezDZ4Ckx5qVrckVPxIiTlpmV:ZaabDw53vUoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725325, "uuid": "56e4d8b2-af13-44e7-84f7-0f6a1f12ad71", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725325, "uuid": "e3838ad3-19a1-4558-9238-72638908458b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725325, "uuid": "1ff4a60a-6ab8-4dab-a979-d4f03909f9f0", "value": "21fc49b47bd1c6c8412ac49a08a2013c91330608c2dfc353a3d196a0318e8e4e_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5b8317-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776666680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666680, "uuid": "6194b48f-7925-47ea-9d2a-300eade7b499", "comment": "Malware payload (Vidar)", "value": "498e8e039e78a791a521223ef9a7eb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666680, "uuid": "3a66c6c8-34c2-405e-8b15-b29fddb1384e", "comment": "Malware payload (Vidar)", "value": "2200d1f9ee35726e51abec037deff7962ae4d525186bd634b3ac45db29946aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666680, "uuid": "5e81bc46-426c-4a4e-bdf8-866ce6334291", "comment": "Malware payload (Vidar)", "value": "7e62ac04e2e86425c2233619b4fc4cec73821e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666680, "uuid": "140b01b6-dd27-434c-932f-e8223c3cc00c", "comment": "Malware payload (Vidar)", "value": "f169e536677fcd25bd51062a2277d3e30ab27eeaceac1c2ffae4df37ba4114803066d9edf1b8837689a58e5021591547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666680, "uuid": "6d065ea1-f632-4890-9de5-35250fff9097", "value": "T155B57C0BACD518F6D46A97328EBA26817B31BC0C0B3263D32E517A782FB6BD05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666680, "uuid": "2afc6ad0-6cc5-4a45-8527-153f5bec72ab", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666680, "uuid": "649494bd-a16d-4809-93ca-654435955022", "value": "24576:1tKE3A5+uKThdpHButUpc3WnsxswN2ZVbZtnRBv3COtPCptRRB:1tKKA5+uKThhuqpk4sxsnrd/Cj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666680, "uuid": "f609c6f4-4325-495b-a8d4-bd14ee5313de", "value": 2342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666680, "uuid": "1fe0bea7-7496-46f5-9ad3-878cf4830752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666680, "uuid": "06fc80f4-960a-439b-81b8-0b380f2d4b15", "value": "Bootstrappert.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4210663-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776696384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696384, "uuid": "53737632-4860-4d8e-a3da-6994f3c765a1", "comment": "Malware payload (VIPKeylogger)", "value": "3b396da3a7d15b78ce1a1807a61bf06c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696384, "uuid": "a47fa3b1-36ff-45b6-adbc-5ddb089b9f95", "comment": "Malware payload (VIPKeylogger)", "value": "2206fe74ee05f04cdd38d1dc93ecd82fbacfc1422d016e2e3955483f95ee6554", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696384, "uuid": "35ea21bf-05f9-489b-8080-98112e07cc57", "comment": "Malware payload (VIPKeylogger)", "value": "34a2055932aa442972bd58facb52a6494e9a2665", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696384, "uuid": "62669205-f351-4e83-b706-821145955377", "comment": "Malware payload (VIPKeylogger)", "value": "5d715f3bcc77100a4a00ad1a8a359754c5b26a558defd83385a89dc3b89dfab0d2416a4028a9127ef30709261c8b3ec1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696384, "uuid": "c23f6dda-fbeb-4d84-985b-01d07264298c", "value": "T1AA646B70FE6505694C4B6B9EFC414AB3CAAD810A563B50E0F7CD078D22085FCE7BDA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696384, "uuid": "20bf6072-cb41-4de7-adca-8ea8ba97958c", "value": "6144:bE+EaE2E+ErY0igiEWE+ErYME3E+E5EpE+Er8iE2UElEEGE+ErtBE+E9E+WE7E9g:ZXOiOCVOOOBKsOlKEOITqOeUO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696384, "uuid": "fe77fed9-2158-41ba-991b-26ade87422ef", "value": 315826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696384, "uuid": "60eb97f0-f47e-4660-98d5-43bea26d6fba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696384, "uuid": "3f735e35-f2ff-4306-aa63-f86326ab3d87", "value": "UPS 1Z34RF4204638017204.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea84c65-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776697663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697663, "uuid": "83f4ee83-ef79-4b64-b5df-1e13872b5ae4", "comment": "Malware payload (VIPKeylogger)", "value": "5daeffc9c6091412f1b3677372365301", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697663, "uuid": "1768076d-9bc7-4b27-bc4e-91bf18141d69", "comment": "Malware payload (VIPKeylogger)", "value": "2244d74dd1db14023ac2aff1088b344b3f8f63f3ddc1dcba86da5219c6b6a5c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697663, "uuid": "6cd29916-5764-47c6-838b-6c731b7f61a9", "comment": "Malware payload (VIPKeylogger)", "value": "8b4e2d89094ee069b863c9d404e0f101c2a0040c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697663, "uuid": "ae3389da-c66c-4c1f-a082-e48f482e9178", "comment": "Malware payload (VIPKeylogger)", "value": "5b4b65f797056b713927d307aaff287eeb07776d13c2971d76197a57c5ae0b53954fa5e59f6a1008f73ca32b5fcc566a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697663, "uuid": "a0e12139-bcba-478f-ae48-d0336d0314e1", "value": "T108037A16729FCB0871B2168946AB03794B9FB96F1FBF40850489EECA4FE351598473E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697663, "uuid": "d9869ec4-f915-4e6e-aaf2-683d047c9236", "value": "768:JUZUwU5UxUIUIUtU6U+UfUfUfUfUfUfUfUfUfUfUfUfUfUfUfUfUfUYUcvHV+dXV:JKriyrLWl5cccccccccccccccccbnP4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697663, "uuid": "2a57a1eb-148d-4763-8c8b-63a8efb54c91", "value": 40740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697663, "uuid": "e38ba550-7bac-41d2-9e99-fc57f8174841", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697663, "uuid": "4cf4a340-b095-4783-84e4-ce6c54ee3d0d", "value": "factura de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4246527f-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727117, "uuid": "9dc81e75-bc3e-446d-ad83-b30fb0120c4e", "comment": "Malware payload (Mirai)", "value": "ccc6c94ca807fd34d1f08d37e9fba14d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727117, "uuid": "17f26ca6-26be-48a8-97de-875c10320174", "comment": "Malware payload (Mirai)", "value": "2265a451819370d2e93fe00b8fc59c92e53961598e01c19d55a5ced54658e85b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727117, "uuid": "38092ccd-5b65-4951-90e8-2436476dab02", "comment": "Malware payload (Mirai)", "value": "26a2d611ca6390eeab8a0df2237c14ca59d30887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727117, "uuid": "66704b23-740f-45ba-8f61-9d892177fdab", "comment": "Malware payload (Mirai)", "value": "e1ca3bc332985b20e70f7b752653e4603b0b7c700b94f843f5f4f8b0684a679ec3265baa094f6fe550f4c8b729b254af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727117, "uuid": "e2df5b2a-e9ff-4c61-846f-95532086346d", "value": "T16103E1D875D22098CFA80CF595FD06B20F5050C93B69BB9D3B1A1C8C766359B7A498B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727117, "uuid": "057d0181-8e39-44fe-8253-a484a95d029d", "value": "768:fhpGLq2YEQh5q10MxYWt/y/1tgPUcDp/TBoWB:5pD2Ynjq10Qt/U89Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727117, "uuid": "26939a8d-8a9a-4ff4-9cda-247bd3e7dbdc", "value": 38696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727117, "uuid": "137d4038-ac3c-4e73-a5c1-bc063a2fee2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727117, "uuid": "dbe5c368-30e1-45d4-99ee-ce10d9c04148", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bf3ff0-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673912, "uuid": "116fd025-cd5d-4159-a8d6-611b2794df97", "comment": "Malware payload (ConnectWise)", "value": "d682a56ea2854351ef3e04a75381ace2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673912, "uuid": "be728f6d-9841-4a2d-8088-c6ac7b77b521", "comment": "Malware payload (ConnectWise)", "value": "23550640f394f3fae486838c74ebe4718d08dfb97f5d45cc35138d2c23373ed8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673912, "uuid": "b02ecff7-7528-4ce7-9bcb-0ca7aebc4f05", "comment": "Malware payload (ConnectWise)", "value": "53787e909bdb49d5692368ec1c0276a3456c214a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673912, "uuid": "c6806883-2b29-4fa9-9851-e0de200ed3b0", "comment": "Malware payload (ConnectWise)", "value": "5326b81b4194e85cf01ac4e0f5946df28959e0160f31ba43d3a8e5830ca39a68465e874ecff2b51e4e57967e76fc234e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673912, "uuid": "80edd660-eec8-4a7f-8d41-0801cbb3419b", "value": "T10046E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673912, "uuid": "8de0b971-c68c-44fa-83e3-1bce51bde374", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673912, "uuid": "229b3c28-66f8-4c1d-a3d2-c39fcfc11ed3", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlQgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673912, "uuid": "5fd560c8-d92d-4813-ac59-64d4ba5dfc3f", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673912, "uuid": "b1c52729-97d0-4631-86c3-655c4a135cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673912, "uuid": "fa34475b-d69e-479f-86c0-8ef2fc450c22", "value": "23550640f394f3fae486838c74ebe4718d08dfb97f5d45cc35138d2c23373ed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8125de5-3cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776690055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690055, "uuid": "1e6f5383-6230-471c-a8d0-921af468a1f4", "comment": "Malware payload (Vidar)", "value": "3be431dfe932ba0f62bc3eb9b7829265", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690055, "uuid": "400a22e1-862e-4e4e-84ed-da65237ce102", "comment": "Malware payload (Vidar)", "value": "23f4acf637670ef812924677ee493365a2a3c956fe42974fb8a9db47e695d639", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690055, "uuid": "d98fe15c-b771-45e3-a4ef-1577017a2bb0", "comment": "Malware payload (Vidar)", "value": "9ab4ace4dbcdf514bd86b4529f94d9838d5cb7d4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690055, "uuid": "a62f2ea2-9dc5-4d17-91fb-b7481b3efa5d", "comment": "Malware payload (Vidar)", "value": "d6799a7147c03a42e64c79965a5ef7775b8cdb837ec9318f9fc9f1fdbb96ac90efd1e75b045de2bc2654b46cc4b3be71", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690055, "uuid": "a53c293c-bc19-4033-8b32-037b073b99d9", "value": "T1B1968C0BACD418E6D86E97768DB622917B31BC0D0B3223D72E457A782FB67E05CB5704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690055, "uuid": "9b531e99-b7dc-424d-b4bf-a6019abf3131", "value": "49152:zyE2r6NLp9fqsMoghLwqbn7K5spNRqmsFICUt:zyQJrOF7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690055, "uuid": "64859dbe-41fc-4d3e-8796-83477034aac3", "value": 8781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690055, "uuid": "f2d63164-230a-4756-ab3f-dd625bd3a1ad", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690055, "uuid": "92ed5049-a5b5-4815-9757-a3521e7c0a8c", "value": "Avira Phantom VPN Pro 3.48.2.1951.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873c18c4-3cae-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1776685571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685571, "uuid": "ef8b1c5e-e537-47d0-aa72-d73852b5bf1d", "comment": "Malware payload (CountLoader)", "value": "2fa58688bad723ac8561c8cef2a8b026", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685571, "uuid": "326dbae9-3fe4-4042-b32a-1df6c56414ca", "comment": "Malware payload (CountLoader)", "value": "2434bf480a7c0ec3e09cfebc46a0cba424f8e4872650f146970b5f2e80955ff6", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685571, "uuid": "e6ef2107-4507-4f40-88d3-dcde71bf3fcf", "comment": "Malware payload (CountLoader)", "value": "2730b719c1359fc7f8cb68c08da8599adcd05678", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685571, "uuid": "1ae6e827-e92d-4173-831c-9da15d8a6ee6", "comment": "Malware payload (CountLoader)", "value": "8d8000884fdab03ccb89692075e8e706f32eb28fb06828482cfce43b0bd53621a5de0337eb178a7ebc96dad23945251f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685571, "uuid": "e156eadb-6670-4ab3-89a2-f59ef4421ddc", "value": "T139D342848FCF45D4CB2FA82585EF4C23EBCDA017061CC5957B5EEE846F116A8B0AE9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685571, "uuid": "9229b0e7-cc58-4731-b636-1ddacbc4ff7a", "value": "768:iNJKutxqLmQsEknxJPkhXxT7U5hsunBQwguiJlU4IDnnRp+n0u0sRMt9hskfJI6s:iNJKqCknqSGoF9ciEj6VoPXk/zP+33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685571, "uuid": "bbee12bf-044a-4554-9855-374e58aaa014", "value": 137137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685571, "uuid": "a3d01b0a-e3be-41a5-b0a1-af340ca72915", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685571, "uuid": "563dd905-aee7-4ae0-8bae-9292e1799750", "value": "Network_Invoice_Draft_2779.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4161df93-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776686742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686742, "uuid": "60da2159-244b-4364-bc82-f62598064322", "comment": "Malware payload (RustyStealer)", "value": "21a1da562c732bd4cdd1363ddba0dc25", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686742, "uuid": "f2f18f7e-9ed5-4161-a2a4-e573e955bfbe", "comment": "Malware payload (RustyStealer)", "value": "2441431ca3b608885080069a22ae9d5cc5e3d982190b29c3cc8cf8450195a213", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686742, "uuid": "bf3b46e3-e595-4fd4-9ad6-893d4d52008b", "comment": "Malware payload (RustyStealer)", "value": "7f3a9cc1416ed3bbc8997578f6c76b6d3cbf3573", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686742, "uuid": "3bca62b5-8e7b-4f9a-a859-8a0b56b7409b", "comment": "Malware payload (RustyStealer)", "value": "7a2b508dff7b86d98d8a3f717da756cea797bd11c4988195deb08fa5245572f0fb3bbbd7625f769b996d4860c03031c8", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686742, "uuid": "7705a7cc-ef5c-450f-a651-b9461eada6e3", "value": "T1DF356B03F69981F8C55AC07C87679636EA22B88E453076EB27D46F243E6BF906F1C714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686742, "uuid": "e7cde73d-5c65-43a9-a9a3-e61bad69e3a8", "value": "4c717babed418b9f93c0419721244225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686742, "uuid": "c0e105de-4952-49e2-b691-7adf8f8751e3", "value": "24576:AZImji71Q67z9nih4ZdELmIIQ8UdwWrH9iVkag:A2mji7O67z9nih4ZdBI9jdwWrdiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686742, "uuid": "807c26af-65cb-4ab2-b352-aa20a3d893cf", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686742, "uuid": "9ea22dc0-8462-4adc-afa5-f78e2bfaf278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686742, "uuid": "e894931f-ad7d-4b75-8498-6226ae00ae3f", "value": "2441431ca3b608885080069a22ae9d5cc5e3d982190b29c3cc8cf8450195a213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7acf302-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725569, "uuid": "fbad29a2-6070-41ec-a8a0-d508b09ba7a7", "comment": "Malware payload", "value": "9214075f7d36b6421d86b987f4e28ecb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725569, "uuid": "b9441015-7718-4717-a0eb-454d63f8139a", "comment": "Malware payload", "value": "247bb7865088b80ed0ea984faaec01ef3f6bd12b2a98239395e3dc198d40b99a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725569, "uuid": "701a19b2-964e-449d-a3eb-34f7c2c2446c", "comment": "Malware payload", "value": "884cc6c3f8b5dc26987925951f3999ca85e8e4f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725569, "uuid": "9f3352fb-4098-4406-b989-ba5cd839143e", "comment": "Malware payload", "value": "199536ca68304e6d8a56dc71dd49adbb0bc2fab8e5f62689528094e91a7f66d84dd4474001e9dbe3dc475408ae5d31b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725569, "uuid": "bf55c7b0-1f90-451d-95fd-5ab9ea036202", "value": "T1B4A48E16B79444B9D066C074CA278643DE36B8960F25FADF03A4927D2F77BE85B39320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725569, "uuid": "a0bb72be-2dd6-4a6f-a8a9-c68d65ac8632", "value": "592e6e55d4fe33d1bd84e3b3016fe3b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725569, "uuid": "0c60efd9-174c-4985-ba0e-a3002c2db83e", "value": "6144:rKEcTs/jvtGCIvT/BIy/71C6h7i6DPgwlXwuxkC8wmAj8hLeC3:rKEcTs/jvtGCIb/BI/CLPzxk7wmAj0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725569, "uuid": "0ef8de4b-9a3f-4bc4-983e-c4f793f6747e", "value": 481216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725569, "uuid": "15a0a07d-f350-430a-abdf-77ed9fd23a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725569, "uuid": "e3a145c1-f832-4dee-99c7-83cd8ba9c5d9", "value": "247bb7865088b80ed0ea984faaec01ef3f6bd12b2a98239395e3dc198d40b99a_libEGL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f125def2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725262, "uuid": "defb5ee5-2079-4974-9880-740cf4946c50", "comment": "Malware payload", "value": "7b12b4532919e0170999ce3dde941bc7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725262, "uuid": "ea2ab31c-2d46-4071-8795-41b1063b1a48", "comment": "Malware payload", "value": "248757cc516979565ba660787135c9f6bf94e4b1613c46a4bdacb02a2e444610", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725262, "uuid": "44ddc733-2fa0-48d3-b3aa-570cff05e369", "comment": "Malware payload", "value": "fc98340c405f245f1425d50b458b2848883a0f85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725262, "uuid": "122e6c0c-2c1e-4bd4-9290-dd331aec7901", "comment": "Malware payload", "value": "cc4ed4f72baf2fdd0f454ae2365e58978c1d636f382ee5a4f703177104e085e07ec359913ba0b19f4e38840f49f80d34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725262, "uuid": "2df28ac1-c386-4881-99e9-f1baf79c43e4", "value": "T121A35947A2EA00BBE2B78678C4630A49D776B8154760AFFF43A4424A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725262, "uuid": "7acbbcfc-ba07-4481-9a1a-c0eda6ac4a1d", "value": "17d9f6dc5709bc89a29a2a965c42f00b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725262, "uuid": "a632263c-2a6b-40e9-a867-c92b36fd0711", "value": "3072:9ontU6C5p1JRsGpDQb0wBqxFsymvmSO/7njPL3cIbHD2GgNJlLJKNryTuFbHY5M6:WnCjD2+M0wBqx+aKbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725262, "uuid": "35957fdf-1e44-437d-8854-14601f2ae861", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725262, "uuid": "c02375fe-7eaf-4118-9028-a2e3113dca8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725262, "uuid": "8f60e24f-c6b9-4607-ba51-218c62e4a814", "value": "248757cc516979565ba660787135c9f6bf94e4b1613c46a4bdacb02a2e444610_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71281014-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725048, "uuid": "c7b28f3c-ec2b-4382-be55-5afa9867e263", "comment": "Malware payload", "value": "783ff126601d43f89db63fa87145e3dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725048, "uuid": "7519c3d0-363d-4d81-b9a9-11e47a83be94", "comment": "Malware payload", "value": "24bb18b6ea9d20fb8f36fe7c653698012edcc0bfe5accac67ed5ffae35a1283b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725048, "uuid": "a16fc0b8-6767-467f-b0cc-ef6e9a794c6f", "comment": "Malware payload", "value": "7e9c7b69809b5f4b094608aae48ba96ae1ba449c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725048, "uuid": "5ef4226d-57cf-4b3f-87c5-41c68467f66f", "comment": "Malware payload", "value": "a24bd201514bf3c05e95ce45d48edb6625f6b2be89926ee7b40871b5aa38e2abbcf8a34f65c6b4621ad66fd41a710565", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725048, "uuid": "cafb30dd-8fc0-4070-9659-5c5371020392", "value": "T1D9A34A0B62EA00BBE2BA9678C4630A49D772B85517619FEF43A4461A1F233D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725048, "uuid": "852c7d4e-7eb5-4e11-b923-fa532b564d15", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725048, "uuid": "11131cc3-15e7-468d-8d69-b433da5b7719", "value": "3072:Fm4RP6gyAqpQQAZ+YAVvrXT/7nM4L3zm2Q9ZVbZacTohsrHQckVPxIiTmjt+m/:E4t6hh9AZ+RY3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725048, "uuid": "044f8523-8cfc-471d-9c01-30b84d1c80f3", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725048, "uuid": "348682f4-2304-4fa3-b605-c8e75380489f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725048, "uuid": "5abe6c82-a771-4dcc-9c7c-db91a6c5fac9", "value": "24bb18b6ea9d20fb8f36fe7c653698012edcc0bfe5accac67ed5ffae35a1283b_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1147cd62-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724887, "uuid": "f3ca2ffb-fafa-4cbb-bd59-b337786331c7", "comment": "Malware payload", "value": "8997f20d06a53d675e55a7e889144e85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724887, "uuid": "f0efbaf4-4261-4d9a-8ac1-4b2b4b4b0048", "comment": "Malware payload", "value": "25158b49f0f1aa26f6724d3cd2669d7efae472b2b5536289a79e9a4cd9363e2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724887, "uuid": "f80deac2-dfba-4373-94ba-51b2f7f8fa86", "comment": "Malware payload", "value": "f535cf5b970a27d92a436a93b0a1535c1dee7ec5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724887, "uuid": "bde2c3d7-d972-4873-ad84-05a47f926363", "comment": "Malware payload", "value": "c632d1da92fe518b969d36fd789e421f699b1b5cabf08cfed03b879fe8871b4e55dd27c3c942dd7762509d52409787e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724887, "uuid": "abbda08d-3488-47e4-ad7a-728f174c2d74", "value": "T199A34A4B62F601BBE2B68638C4530A49D7B6B85107219FFF43A4465A1F273D18D3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724887, "uuid": "779df3ed-b60f-4355-9f33-4b3f272935fa", "value": "89a97c0efa41b17c5ccb77f897c17c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724887, "uuid": "ff60605a-ebad-4a4c-887f-ac3e7bc31ec7", "value": "3072:JlRUbvuAcGSPQbcwXlsEvAtpFrpqpqpvvkTinyNAQ9:BULuHhMcwXlVPvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724887, "uuid": "4a04f46f-1f97-4151-ad69-70a1d51bbb60", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724887, "uuid": "0e75ed95-ecbf-4cde-af9b-5792c49bd7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724887, "uuid": "86df8793-85e8-44f6-890b-44e72c5e5bba", "value": "25158b49f0f1aa26f6724d3cd2669d7efae472b2b5536289a79e9a4cd9363e2c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b428266-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725467, "uuid": "32374232-f023-4eab-a29e-1616e9cc5475", "comment": "Malware payload", "value": "5a71a80b0bfb69e28ea7194e54abeef3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725467, "uuid": "c2b82e5c-0216-42ce-a390-208db66353e3", "comment": "Malware payload", "value": "253ac9bad9410d020ba58afd3a992451598768125116c9d42f945c0050cd4ed3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725467, "uuid": "cb957d7f-43be-4f83-a531-72a512f5f031", "comment": "Malware payload", "value": "ac593d79d808fada7764308712ab40b91c5721bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725467, "uuid": "0a144305-3d2a-43f5-87a3-44497ff274af", "comment": "Malware payload", "value": "6e8a5fea9174691e14be64d3b985f7ff0354311f3dd298c853c35334f2563acb02936b290baf8700acf18731d56d96cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725467, "uuid": "c18e5be6-fcf3-47bf-b706-722cd31d747b", "value": "T170A3494BA2E600BBE2B78678C8930A49D772B85517619FFF03A4425A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725467, "uuid": "aeae3eff-2de1-42fd-89af-5c104ee8ef6a", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725467, "uuid": "5a44a0fa-cabe-4b33-b3c9-858f4b3e5f9a", "value": "3072:YvBGrVNNR2AJNQKAfRAtHvrXT/7nM4L3zm2Q9ZVbZacTShsrH2/jbp:8G5HoqXAfRYQ+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725467, "uuid": "817a3d30-7561-46b2-b8d5-384eb5bef243", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725467, "uuid": "63fbd427-0c80-4ae0-810e-17c7b2fdc9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725467, "uuid": "534c37d2-50b0-4bc3-b432-ca2181430b42", "value": "253ac9bad9410d020ba58afd3a992451598768125116c9d42f945c0050cd4ed3_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b54f491-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725011, "uuid": "44863835-4635-48db-bb7c-faea84e57deb", "comment": "Malware payload", "value": "4ba2e8b223285a7a2b2062cb2bb248ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725011, "uuid": "c68f65a8-557c-4cc5-8b07-0ba11628b33c", "comment": "Malware payload", "value": "25645b677db5541b4e78ae32ca3de17f5894ae168e1c14d8f6260a8213435ff7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725011, "uuid": "0ff9c993-d98f-4a09-baf6-ba173ec4c57b", "comment": "Malware payload", "value": "515b0227e0da994bd393e971c9ff2ed2f679be58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725011, "uuid": "41fb754a-12d1-48dc-a0f2-7f2a32ae65f8", "comment": "Malware payload", "value": "3d7f7d9d1895f1fefe92da0befca516e613566ec64a491ccda5cabcca0baf00d2f0a61c7036b51cf217d901e0c344189", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725011, "uuid": "876265e2-8f8a-46bf-8cc5-a8bf973c0f23", "value": "T1E2B34A57B2BA10BBE1B68338C5570A45E772B8414761AFEF43A0469A1F233E09D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725011, "uuid": "0055c676-b613-4516-8d8f-c031fa97726a", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725011, "uuid": "2bff5da7-9cb2-443d-8050-3f7172c9062a", "value": "3072:yLpnewXSApGnKj7A8TVQezDZ4CHx5qV6Gl:ceg5LjESWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725011, "uuid": "ef46ca10-7139-4fac-a5ad-d36659e4f50c", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725011, "uuid": "e9e9403c-1139-4874-ac70-17b5e96a4259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725011, "uuid": "4dca0468-e4d7-4576-9645-308958aa51f2", "value": "25645b677db5541b4e78ae32ca3de17f5894ae168e1c14d8f6260a8213435ff7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528eb814-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725426, "uuid": "1e86a4e7-7434-459e-847b-3067d76e1736", "comment": "Malware payload", "value": "ab0ea6e1b4ac282b875cd6a94ab852f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725426, "uuid": "69ee0b73-9ab1-4797-a124-d431d5045739", "comment": "Malware payload", "value": "2568ebc0e9a4464c55c47b2f20fdc6ebb1defdc8d86210cf35b3dd74ce73dea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725426, "uuid": "97c3f59c-4836-447f-bce9-504b60164e50", "comment": "Malware payload", "value": "8cfce660b86e8d7c992f91bb65895ed5c468e812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725426, "uuid": "172c1071-b11e-4365-ad98-842b7a585995", "comment": "Malware payload", "value": "ffb814403c6c540aedcba07048b4f2a340f6c6c49ab6a94dc928bb7bd37c6ed76b702aecfb859c71e2626778f2d8d6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725426, "uuid": "7933b84b-94da-43c7-af13-5d7c8cf17ac1", "value": "T1A8E37C5773A530F9E2B78238C9610646E772783247619BEF03A447762F232D19E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725426, "uuid": "4654e931-4e03-462d-9ac4-c33c9be84bc9", "value": "90bf3712c207bc7d745cbd0ab6cfd8bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725426, "uuid": "3430008f-4399-4fa5-a0cf-361863324c2e", "value": "1536:uKjZscICeokhYjwemxZVUwdB6LZuDUCxLKGeWTHKSO89u1VYLHTtpwB63VsWGduH:uK1stLHiL5CxIOq0M1VYLHTnwB6UCdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725426, "uuid": "174a9e41-7b75-4d48-8821-ff8c97b924f3", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725426, "uuid": "fd3e51f6-b231-4882-9be1-75e6e8bdeed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725426, "uuid": "b2d26b15-ee28-47fe-a053-1c20fdb8679e", "value": "2568ebc0e9a4464c55c47b2f20fdc6ebb1defdc8d86210cf35b3dd74ce73dea6_8f994d37-6e9f-4397-a739-5089755e3153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e33ff8-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725302, "uuid": "400affa6-bd57-4125-8804-b39539984e90", "comment": "Malware payload", "value": "b07ab5d315021076705f1d552ab15611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725302, "uuid": "483f109f-09d5-4e54-8302-054f5e44d90e", "comment": "Malware payload", "value": "25b9cd7f36c03cf457f67007d1e6ffc571ab853748729517f68f2a603fa65f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725302, "uuid": "36988105-7ad7-4dfb-9c22-738118695617", "comment": "Malware payload", "value": "09fc69e721d39bbcf6c947b55f4dfcb93cbdf48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725302, "uuid": "20a84341-a97e-4830-8c77-d34e34194676", "comment": "Malware payload", "value": "7697cbc6afb7399cac67b4ad541b1ea0a03858d153af339b311c8660fed89711669a8e72974fb8c8bb86ff77f9402290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725302, "uuid": "0f950d44-e7d4-4085-81d8-0761a338f459", "value": "T15162F851B7FC8904D0BE1FB859B286141BB1F5161936CB8F1DC852AE1EB37818A527B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725302, "uuid": "571fb87b-3d89-4cfc-bb9a-18d99203b125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725302, "uuid": "c8b55f95-7c80-4ddc-9e9c-c76056150b40", "value": "192:HPkLGXZWh/gk71uLojQSjmmzQb9h+XZwrr2aM+x6RNIytCD2WBZF+622Q2hPr:HPxWh/gq1u67zQDOZwDM+QRWyQzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725302, "uuid": "320ac396-9def-4e7a-95b7-ac6e5cb63aa4", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725302, "uuid": "f3637f6a-9a59-44b0-a606-a693b29ead07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725302, "uuid": "871a8735-e0a1-4571-a160-0d23de56c455", "value": "25b9cd7f36c03cf457f67007d1e6ffc571ab853748729517f68f2a603fa65f43_f3c03e67-52bb-40f3-9bb1-ad1cb60e3bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e01a439-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725848, "uuid": "83beb05e-e882-4702-842a-2a90b969218b", "comment": "Malware payload", "value": "f6556e2fd0b7bda92f6dd089166bb630", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725848, "uuid": "46aae35c-bc77-4513-82ba-3b4419185df8", "comment": "Malware payload", "value": "25f2ed357ce7ed928f291e6e81ddc17ac0f8f2e4cf0a57fb76e20e501b61da91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725848, "uuid": "af6af462-3245-4bb3-8156-c0aca549c9f4", "comment": "Malware payload", "value": "139875afc0de59d3f80a3f949afc1eee6bd4bedf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725848, "uuid": "961f52cd-54a5-4489-b189-4fd9138fbb69", "comment": "Malware payload", "value": "d5f2cadfd925fbc49d401154ea89c225f4737e44c2628fbbd43637cc025f7441e64d3f7d3a98793f5ac124a9e0961538", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725848, "uuid": "588f6d57-dda7-499e-9fff-f5b92f30ac3d", "value": "T114A34957A2EA00BBE2BA8678C4530A4AD772B85117609FEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725848, "uuid": "4de0617d-a631-40c2-a1e7-55a215cb311b", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725848, "uuid": "36064f81-d226-4e17-b72c-7a32e23b7c38", "value": "3072:0JTeXQwDasaAmiTQhAS/xYN0251756565rnIryH9/C3zK:seXbuFaTcAS/0m/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725848, "uuid": "7cff85bb-39f3-46a3-bb81-9b9b6a6e5083", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725848, "uuid": "801e1a42-8f9c-485f-8226-7e1fa61cbca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725848, "uuid": "a2e5c803-cce8-4e75-9e48-6a68191248d4", "value": "25f2ed357ce7ed928f291e6e81ddc17ac0f8f2e4cf0a57fb76e20e501b61da91_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51ef484-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776665972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665972, "uuid": "f572af9e-dcc9-423e-9340-6d4df3ced348", "comment": "Malware payload (Vidar)", "value": "43eab818abb870afb3e4ddabf94ce76c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665972, "uuid": "198e84fc-8250-42b4-ab28-3bbf667924bf", "comment": "Malware payload (Vidar)", "value": "26131e8e944cafee0519477aca24c48145c7ed3c7beed25e7c6e1a72d0f318a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665972, "uuid": "20efe999-c7ec-4da3-a6e4-1afa74cfb7de", "comment": "Malware payload (Vidar)", "value": "749f8cf77227568c9866cc85c738e97522e6cace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665972, "uuid": "f0e0ac90-d711-4eb3-bdb6-4416861c1130", "comment": "Malware payload (Vidar)", "value": "532d12c047be74b92570f655eca1b2162718f945850172a0003f47e76b4388cabfc2cba5edcfaae579b9880f3a0ccc15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665972, "uuid": "cde6e547-ecb2-4d86-8351-30c9feef27d1", "value": "T140A58C1ABCD109B6D0AAD33289F262957B31F8194B3223E72F516BB83F767D05A34744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665972, "uuid": "463a0a6e-2e62-4858-a78c-53185a8cf9d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665972, "uuid": "982a6885-ad99-4aef-aa05-93226ccde88e", "value": "24576:4G1ZOf3aTYu+NnxXeur4sNR9li3UAenI9Aa5eE6fgoIh0sMqcdDt6o9GizPtJQvZ:4GSf3e+NVVt0n9AaWfQHMqkp6oLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665972, "uuid": "bc373434-5016-4535-a6b1-b8de4648d8c6", "value": 2119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665972, "uuid": "278922fa-01af-424b-83db-889c48addeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665972, "uuid": "cba7e03e-cca4-4aba-b1ac-e4be060d8f1d", "value": "tstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67daee33-3d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720737, "uuid": "de25aec1-b258-45c0-812d-801f436dbc0e", "comment": "Malware payload", "value": "64bcdc17c5a8bf0dfc53054830a7eb52", "object_relation": "md5", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720737, "uuid": "e4b3be92-458b-4a64-b9b0-bf2f8b9f438f", "comment": "Malware payload", "value": "261a8983d690ee71c37ea2433b59d3070665f9f156e33ed07be9b8baaf32eeb2", "object_relation": "sha256", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720737, "uuid": "4fa3dc3e-f907-43f1-ab0d-5352ad9739ff", "comment": "Malware payload", "value": "15b04ea0955aab9e58d1136a22849224fed2edd6", "object_relation": "sha1", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720737, "uuid": "36354cbf-5a9c-4663-ab89-52c9606eb96f", "comment": "Malware payload", "value": "74c819707287e135a05193bd73594d00a255dab453df3ca04754ca980b900c283ea9fb2ee9f97fc1c9d2f71f930c654a", "object_relation": "sha3-384", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720737, "uuid": "02620f01-55a6-4657-b6bf-3a3a1f36bc57", "value": "T188545C16FB9A5C79E586C0748305A673AA3674C52F22BDFF42D442393E19BF13B39608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720737, "uuid": "335d2796-9907-4762-8b38-945a66472898", "value": "0cb3d7f00665db129f3ca7ed8740e413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720737, "uuid": "f675c05f-95ab-4fb2-a7cd-5f165340d811", "value": "6144:JSgslWpc1WgkIj1r2ju/KPwDzkNJbzWq8x/u4C:JSitgV6jmANJbz0x/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720737, "uuid": "e686f962-7b9b-4e54-9e69-4f7300fc65c0", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720737, "uuid": "9e91d60d-442b-45b5-95e0-b9a651e64963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720737, "uuid": "970dacac-30c4-4eca-9091-8c7b8b5c9958", "value": "libcares-2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1def1b-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725333, "uuid": "62f767f6-9712-4dc1-ab4e-ad784410615c", "comment": "Malware payload", "value": "3cf74e2f68917650452b3558a40ec218", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725333, "uuid": "37250888-77bb-4b49-a1b8-e688908a479d", "comment": "Malware payload", "value": "263e1cb15db9746dcbc7a2a032633a61ce6a23ff1246e9f96bf62e0eb153c76d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725333, "uuid": "a3102dc8-b06e-4ad1-874f-88edab4c0fa7", "comment": "Malware payload", "value": "dd94a11e0d2f28d53976c49ce345a2d943b76c6b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725333, "uuid": "80f7fd7f-6224-4b32-bd18-ad514be6172c", "comment": "Malware payload", "value": "7392fa5e18c438256180736a3f1207745d2b503bbfdca7fe118fa5c0aee31b657338d6a525869585239983382763d9ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725333, "uuid": "2f45d015-9cf3-4c1d-9f73-7773ff606507", "value": "T181A34A1BB2B600BBE1B79638C4530A49D772B8454761AFEF43A4426A1F273E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725333, "uuid": "a52bdf66-4c03-4422-8b41-f10139c51664", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725333, "uuid": "52d9e9e0-5f4c-455a-9411-1204fff56751", "value": "3072:mR+Rn4RwPUciuNGC9QbfQ1/+DA4/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWD:mIXPriY3MfQ1/4Mxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725333, "uuid": "37e469c6-778e-4c46-850c-cb15969f6b51", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725333, "uuid": "7b0cc0a7-ca10-43f7-a47b-0e0a80f4af66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725333, "uuid": "330f9c83-3e00-4f93-8314-914ccb891a7c", "value": "263e1cb15db9746dcbc7a2a032633a61ce6a23ff1246e9f96bf62e0eb153c76d_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c56691f-3cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776695700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776695700, "uuid": "d7ba11f9-adfd-49ec-8306-66b70b0a3012", "comment": "Malware payload (RemcosRAT)", "value": "c0bbfa4ff828c0432850a8a050e1af36", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776695700, "uuid": "bb4818f4-76e0-4f60-86d1-ead4acdf7d86", "comment": "Malware payload (RemcosRAT)", "value": "269ef9fd26667dfcae57ae29f559a327de0327e37c2dd5887ed7a453f7a04a07", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776695700, "uuid": "02784cf8-e979-4457-9e13-f45365996254", "comment": "Malware payload (RemcosRAT)", "value": "8174aec65f8d23532b3d7f9eded15e1fe6b53ac2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776695700, "uuid": "ed556951-4eba-4cf4-be8f-efb58db5ba8b", "comment": "Malware payload (RemcosRAT)", "value": "0fa68b9b34e340ac88055132237e08e5e87b913baed922c4c416d0a728e9af9714e03074f722f2aa1ea3a2838afc749e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776695700, "uuid": "64da1389-872a-4d35-9f73-b24bc2714443", "value": "T141649F5EB69621DC8A38F9D267E8FCE73262034F0D37497F18915B04593023A1BFE969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776695700, "uuid": "c4124c9e-54fc-4d70-8d7b-b3aa0152519d", "value": "192:9p20mG5OkGmMThBVXnqfV9sIWHmXIWHPEPCB83/az:9zV9sIWuIWvEOOaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776695700, "uuid": "d98e1801-64de-4a05-8d22-90b622af2c2e", "value": 309442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776695700, "uuid": "9c9a42af-9817-4078-b6da-26fb1b2041b5", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776695700, "uuid": "6fc05385-006a-4a65-866c-af720bd60148", "value": "verycleaneffectivethingscoming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4965d0d-3cce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776699472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776699472, "uuid": "2fd0b603-e028-48c8-a0d8-31bb5eb08fd4", "comment": "Malware payload (Formbook)", "value": "c67c00ec2571c34cfc388c2dce624b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776699472, "uuid": "b89f0472-8606-4717-968a-576d17fe59f3", "comment": "Malware payload (Formbook)", "value": "274137298b71f344350d914dd6034e3d3857be280ef929c7fe71f5bca813c5ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776699472, "uuid": "83b0365f-3528-4421-b721-6ad258966b87", "comment": "Malware payload (Formbook)", "value": "5518d5ac21bb79f1efab3858f8ef411b2211df0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776699472, "uuid": "6057ed6a-74e5-4895-9e55-64c6ae4da722", "comment": "Malware payload (Formbook)", "value": "c17ad25eba43bb6d727e0eab030cc9ef8a7aecbb2dea5d272cb47cdefe766bb5636ca57294aa5e0d9be3bcc999bf6822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776699472, "uuid": "35f5fec2-ba19-43aa-a29a-cd8d65e00083", "value": "T14235DF181E4A6F94E6FDCBB8C16218D4F7F8D6038392D61F7EEC00F806A3B95C529965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776699472, "uuid": "77ff7636-0f5f-498d-bb13-b52607383fc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776699472, "uuid": "65800743-0bc0-406a-8dc7-b0f244898155", "value": "24576:1ENtONBujN5eQYQO5xvOfuIFlpZn1StLjtZ:1EvqYDMQJf9Pn1Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776699472, "uuid": "527f26af-8422-40a1-9f21-26fac76659a7", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776699472, "uuid": "5fff47ac-f925-4a6e-bba7-1115a342d998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776699472, "uuid": "6f79954e-6ae7-446d-b8b7-5686fc3fbfcd", "value": "SecuriteInfo.com.Trojan.MSILZilla.243739.32783286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6645a246-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697542, "uuid": "ec74b51e-02c3-401b-8dfb-bde414694c2d", "comment": "Malware payload (AgentTesla)", "value": "d97faf76ff5e66c2617f4c16459b751e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697542, "uuid": "52a8f8d2-e564-4820-91cb-246ef1311efd", "comment": "Malware payload (AgentTesla)", "value": "274ae9b8a6371aae623af3d37a4c11c9c15083998f3f6d958cc8efc717866244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697542, "uuid": "4d7db9af-9e3e-44de-87a6-fd6fdeadbb42", "comment": "Malware payload (AgentTesla)", "value": "1ed48925fcbab1395fe1817588c3113ebce830cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697542, "uuid": "a09454d1-e329-413a-839c-31d45146970f", "comment": "Malware payload (AgentTesla)", "value": "11b296842b5a781fcbab831b1940c93bf6917d3a3955d7c75a128950d56a05376362e60942c51470077a92e721f2f65a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697542, "uuid": "fc0e6674-69b8-402c-b0c6-8ae0219e771b", "value": "T1A6568248E0E5B4197DD3CF5AE963D0B04CAF786A2E0D89A3A41FA17C1C56F97DA1018F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697542, "uuid": "642dc24c-43c3-4168-b31d-3c4dcfcf51f2", "value": "98304:YQu0qqDf66lk+UH4oldjwh2XS1uisnspCyppy1kDj1NxdW5yPI4awxAsvN3AVQue:YgDf6AkD4obqMissp9oSZNxTI4JvOQSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697542, "uuid": "0b90ce35-5b69-4dd2-9bea-1390e435e43e", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697542, "uuid": "d7c2a4ad-a5b1-4d03-ba73-01bffa4d352b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697542, "uuid": "8ebff9ac-2040-4a20-ab61-07223d5dc614", "value": "TT COPY.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36baf9f2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724950, "uuid": "e260f1cb-6e05-4448-aef0-e3d5514d7239", "comment": "Malware payload", "value": "966bbf007a2dfecf0b4344b672ff506e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724950, "uuid": "6d8dac4b-45df-4690-a129-723e33ca1b1a", "comment": "Malware payload", "value": "277fa6975eb8f65738d6c81d5788ea0181a23933b861fefcffa6a72f2923faad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724950, "uuid": "2d80ba67-93cf-4677-91ca-051666c81a7c", "comment": "Malware payload", "value": "2c7db503a5b5c47aa04af213986a6243dea35206", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724950, "uuid": "20c70498-0744-48d2-9c90-4aecd949c20a", "comment": "Malware payload", "value": "08035fd9631dd7cf4791fc518715f49472957c6d8ec4dc0a8fd325526444b5cb442da83a6a11bdbfa98a903b5cb4f5a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724950, "uuid": "9968de34-bba1-45ce-ad94-9b502edbe6b8", "value": "T11392190EEB8BA4BDC816E2B849FF1B33B476793215756F2E1364DAF94F40940527EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724950, "uuid": "7d3237e7-2ee9-4ab0-884e-2981d5c4476c", "value": "b363afacecba727a8297cb88b97804b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724950, "uuid": "b89ad3b7-9463-4205-9450-f44144b8a5be", "value": "384:TTm19V3T5PlIqpHGYuwvA6Uh1mckVPxIiThpMMMqWLXNf0:Ti19V99H5zuEEmckVPxIiT/MMMBF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724950, "uuid": "a0833f30-8682-438f-9d9a-3252a061a5ff", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724950, "uuid": "26d6fada-002d-432d-a1d5-008f5ed175c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724950, "uuid": "db159618-9356-4496-946a-9b06de2934c7", "value": "277fa6975eb8f65738d6c81d5788ea0181a23933b861fefcffa6a72f2923faad_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e10889-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725463, "uuid": "b79c69e0-27e0-4a44-89fb-1b9a17530ac0", "comment": "Malware payload", "value": "a29e7ab0d1e5d279dfee0e979c14eab4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725463, "uuid": "2c33bb8e-06a9-4dce-96a0-f612252e3ada", "comment": "Malware payload", "value": "282f2ae2036c043814e82ce447883f17fc130d92f2679a1099753c9b5cad5873", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725463, "uuid": "f9f753e5-a71f-45d3-9c03-59e5eb14b7e1", "comment": "Malware payload", "value": "c2956ae664c26baa3c701391a5ea5a66d902d624", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725463, "uuid": "1f99a219-fad8-4a36-804b-4d62011c03d0", "comment": "Malware payload", "value": "8c8e0c3359ce57c23f9c629e8de4602cb5dd1fd8bf985407ca7bea521f2f21d42978af126e48f7f609d79400415c736f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725463, "uuid": "7492426d-1a43-478e-bb5e-cdad8843272e", "value": "T179B35B4BB3A500BBE17B9679C5630A49E7B2B86117609FEF03A0461A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725463, "uuid": "b9933e78-a261-42ac-a2b3-8e5ae84e6b7b", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725463, "uuid": "def7b5c8-7bd8-46c7-8736-05b0364fdcb0", "value": "1536:Ixk1TQHWVxYekVYL6rXp/THnS3i2usEUrN+F6JxE+gsWRJdL9dlrfDr1QIU+9:Y8UHW0N9XprHEuXoNtJxSjjNDr1Qny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725463, "uuid": "4e052c8b-4a1a-478c-8ad6-30932c0cabf2", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725463, "uuid": "c6f8e01a-c397-4476-8db6-27d89676f027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725463, "uuid": "7ed8e907-c09a-48d6-a0c2-f61a8cb9e5f2", "value": "282f2ae2036c043814e82ce447883f17fc130d92f2679a1099753c9b5cad5873_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b1c0e9-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674178, "uuid": "3c02f47f-34ee-4632-a8ef-59461505f44a", "comment": "Malware payload (ConnectWise)", "value": "cd6e48330a2fb3a624a86bec06fce9a8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674178, "uuid": "6a08a889-195f-4528-b5ab-39d125886fdd", "comment": "Malware payload (ConnectWise)", "value": "28952296d47843fd34bd985a8e63f36a3271035207e1f24af27d4687a06a935c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674178, "uuid": "ac0189dd-f87b-4d9a-884c-6be505c26f5a", "comment": "Malware payload (ConnectWise)", "value": "d3cb19783a99ae8998cccd4cd345afd9aa642263", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674178, "uuid": "084aac58-d67f-4b80-a43b-a62fd55a2365", "comment": "Malware payload (ConnectWise)", "value": "a7957c2e138c5f2d4512525fb80c07369d8ed3a3e8a5d710106506b370d81dd7a6390dabdc7156e00de554879f6de624", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674178, "uuid": "f6affa87-0f57-4a7f-9b9d-67ddd3523c0c", "value": "T138750110B6E9883DEAF62B32FF7A92605E39FD251E20C15E9394351D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674178, "uuid": "49a78e1e-02ea-4483-a7f2-49969a4a2d94", "value": "24576:aZPlmF0uwTKh56Z5vePu/DVeL1pVjeOmnUUGGu/aYmQurhwQUv:Qmh69eWbVypVCxgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674178, "uuid": "feaee9d4-4c24-4ca7-8c68-b4d574d5135d", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674178, "uuid": "a8240d58-0883-4537-b22c-4f0307b40619", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674178, "uuid": "b77671cd-41a9-4d21-ac13-b2270a8c686d", "value": "28952296d47843fd34bd985a8e63f36a3271035207e1f24af27d4687a06a935c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928055cd-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776665833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665833, "uuid": "b3964af1-5734-462d-8979-9ecf90bcec7c", "comment": "Malware payload (PureHVNC)", "value": "c011bb7bffb008d463382864e56bbdc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665833, "uuid": "b1099903-4b5e-4663-903a-620f4843a17b", "comment": "Malware payload (PureHVNC)", "value": "28b74e0919f0e8f08ca698f7d4c897ce345f0ad1f2752e29450d0ef4fe1eaeff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665833, "uuid": "669425ed-6e32-41d2-8eaa-7c4eb73f9103", "comment": "Malware payload (PureHVNC)", "value": "446e5b3fb46d13a6cb030591fe9e309566d4ddc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665833, "uuid": "9267347c-0d13-4c16-ad23-58fe94f02031", "comment": "Malware payload (PureHVNC)", "value": "15426af54d10ad88eae965a7c9c170cef44a8ad30dee3e9a718cc1bac2198650e884c00bb2b2ba286cb0387d44466e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665833, "uuid": "2734caaf-ae4d-4eb1-b24d-37fee2360366", "value": "T1FCA402413797D59BE82D0A70247705B62AB0BE79869D469FF7E8BB5F0C723C18E0E121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665833, "uuid": "0c610bf7-dd04-4054-8750-8d4a50a53baa", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665833, "uuid": "a1a86870-ba54-4598-9009-b2e1dba54ef9", "value": "12288:oX4TjXxy7GOynE4CxaVqrJxDfOgDkpA2pTHrViM:a4TjXxwkfCxa2fzipTBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665833, "uuid": "b16ccd1f-5d55-4f0c-8072-cb488f6dc226", "value": 481554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665833, "uuid": "a2eacf60-45eb-4eac-be69-fb6c35941a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665833, "uuid": "178bd627-cbe7-4451-b781-5c12509c9903", "value": "order list for confirmation.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50176d16-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687197, "uuid": "35983be5-c176-43eb-89b7-f63398544937", "comment": "Malware payload (SpankRAT)", "value": "5bbe41fcee1df3328cd2b457a16bc138", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687197, "uuid": "f42e4715-9241-46ec-93a4-320be53acfa2", "comment": "Malware payload (SpankRAT)", "value": "2901753d56c2ae1432944ba92b2cb787279916aea0293c15e01c8e0f1d8a1eb2", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687197, "uuid": "f467dc3f-aef0-4db6-816d-5c982dc9d66c", "comment": "Malware payload (SpankRAT)", "value": "b27369fe39f7a9256e41b5bfe16490ae6ca40f7e", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687197, "uuid": "333d313c-3ec2-48e3-9eb0-52ecff0656b2", "comment": "Malware payload (SpankRAT)", "value": "e5a5c2c0ee6ccc225445356c67fab4babe969489ace5412e365eaf201b19c46e3775e589f9cd530c176c22dbf3cad8fd", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687197, "uuid": "e34e2c76-aed6-479d-90ea-487aa5bf067d", "value": "T1C0E49E43F946C5FADA4F00BD582EA23E5B37A5294734CAD3F7943E4CB96BB91181C212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687197, "uuid": "eede237e-2a6e-4049-a87e-f0167d8fcb2e", "value": "965ba7c0c4b2d8a7deecb650d3842b77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687197, "uuid": "244436da-65ac-4093-b67a-38d39a42236d", "value": "12288:7tc8c9uw2euWF0uowOB1Rd/NcEYHP+oyIgNSHb1w:xc8cA7K0JwedzYCIgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687197, "uuid": "895c6989-6142-4e59-8d8f-aa5fe5c9db0c", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687197, "uuid": "0a12c5ca-a03a-472b-bfc9-3c341d00cf2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687197, "uuid": "1f6ccb2f-6a86-4f1b-8d34-b80a4b370828", "value": "2901753d56c2ae1432944ba92b2cb787279916aea0293c15e01c8e0f1d8a1eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91776ee2-3c7d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776664543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664543, "uuid": "294659e8-a7c0-419d-a391-7cf791ffd3f1", "comment": "Malware payload (XWorm)", "value": "b4bc2a0e31dd47950ee7360304e5e100", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664543, "uuid": "e2094930-cdcc-4b58-a6f4-464eccf2e018", "comment": "Malware payload (XWorm)", "value": "2906e4ef64b589ac3046975b912bba36cd6643ad8940387d05d9c558638057e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664543, "uuid": "6cb2a138-d094-4fd8-81d0-a53b5e198d14", "comment": "Malware payload (XWorm)", "value": "39658aa35996b582f82fd2dbe7cc6f8e1fa3f518", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664543, "uuid": "516bf171-7621-4bf7-be51-44f42d0dbdd1", "comment": "Malware payload (XWorm)", "value": "5a465b65a8fb1fa953fb597c0aed2a2fa37405236dbb2c3324ca51f9aaccf2716a272604048638535cc66eac77b0554a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664543, "uuid": "1e486169-20b1-48cf-a147-b1d6563d7cf8", "value": "T13207DF02F2F901E8E5BBC178C6635517E7B27855172097EF16648AA92F33BE06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664543, "uuid": "425cc9df-6791-42c1-a6b5-e83541b30363", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664543, "uuid": "bf344a53-8bf6-4788-b2ce-5794ce2e5e80", "value": "196608:rdvIyQs3CY9eO8OwcPFGUepZIk6GCr5ZExSmxZUQn3NzwQt3JrI1dkOW2JsQ6Ta:rdrz7whrLIk6GC7EQmAYBdJgdJJsFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776664543, "uuid": "7e3a9c55-0f53-4481-a0dd-b29ad2d8501c", "value": 17858100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776664543, "uuid": "8b1df5f1-390a-43a7-b4c9-e67547f70edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664543, "uuid": "68ed5d26-f7d1-47a7-bb4d-b0756c0b2941", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba11c27b-3cff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720446, "uuid": "9d4d4d0d-56b0-41be-aacb-5d6bf3a59eaa", "comment": "Malware payload", "value": "e18a95f8353daf67457557ee84053ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720446, "uuid": "73ea391a-5625-4ca6-b693-94ba1c6f7fb7", "comment": "Malware payload", "value": "296d4b69d837bd47e2fe91f72a51dc8310f30cc09298f36110fc0e648f3e37ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720446, "uuid": "da12f66e-6620-4328-84cd-40b2495bf0f4", "comment": "Malware payload", "value": "0fbdbc23e6ff2c776eb2308b23040d47eea4311e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720446, "uuid": "6bf3b993-065f-4187-9d07-b802996a5546", "comment": "Malware payload", "value": "8bd6dd2f777df557228d1661ae02957dc0dc1ceca8eb7384cb7874b064320b8ff5eed5a3219088de523c6cd376acef4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720446, "uuid": "4659ab82-3e85-4f4d-a9b3-ff50d046cca2", "value": "T1B8357C83E7A385D8C116D9B5534BF137F9627C8E4B153197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720446, "uuid": "0dcaeac7-2112-485c-ae2a-51e75285deb4", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720446, "uuid": "c0ec0f4b-d4de-43e4-916b-a2114aff4e89", "value": "12288:Nbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDqdvfqItNqdg:NbOVE5ifGPRZwedvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720446, "uuid": "8e86c90e-9cba-4cbd-845a-8106dea97a42", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720446, "uuid": "c1d1380f-fba9-4270-a1a2-67de9e6feb0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720446, "uuid": "10d6e420-0ca2-4842-8a9b-dc0f68c8ae93", "value": "c1dd75655_Vexaim-fortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc97ac0-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676720, "uuid": "ba93be89-a1f1-45d0-9216-5cdbcad1cd44", "comment": "Malware payload (ConnectWise)", "value": "a8dad65a3e3b30929b5996961343cfec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676720, "uuid": "edec708f-5aa2-4c20-bde7-f0958e6843e7", "comment": "Malware payload (ConnectWise)", "value": "2984887eed624d19dfd1685a90b9724151945a823e6c3623dc1c9e3554997a44", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676720, "uuid": "1dbcf52a-44b1-46a8-b82a-c2edf0059059", "comment": "Malware payload (ConnectWise)", "value": "9632efa7f8318549ebf8c1e50d0056d8724f4776", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676720, "uuid": "78750701-a501-4990-932f-fda21142dec0", "comment": "Malware payload (ConnectWise)", "value": "49920ee3e2045db97a9510c953ff2cb0769ece269c67de5dfdc2cfcaaa15dcdffac39ada15d7c3eb7d69418a55381a62", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676720, "uuid": "ce13cac8-3487-4877-945d-2ef3a48618e7", "value": "T103646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676720, "uuid": "8f2fb06f-035f-40db-9df1-2f65889fa374", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676720, "uuid": "86f47c25-c233-4346-86f0-5ab3152699cf", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9q9:51iw7gryNkSV1hy1Z1u2JLI9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676720, "uuid": "9307d045-6bba-4bdb-9bae-56cf7595e072", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676720, "uuid": "c1f084ca-5abb-48ee-910d-41a0d4434d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676720, "uuid": "01c45f44-bd82-4ace-85b3-f96c1084844d", "value": "2984887eed624d19dfd1685a90b9724151945a823e6c3623dc1c9e3554997a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b51968-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725940, "uuid": "df6c31a3-23ac-4366-9613-32e6f41fee8c", "comment": "Malware payload", "value": "2fe43985f8b05475c1f8db9bb0f27598", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725940, "uuid": "9c6e07e0-96f7-46d6-9ddf-fa679c060449", "comment": "Malware payload", "value": "29a3ebc7824653ca026d5d0ca36d6dec82eea416c5774a13dcce5b780402e116", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725940, "uuid": "32d1229d-06a4-4657-a4c7-ee01cfad07fe", "comment": "Malware payload", "value": "7ea5524dca232075a48dd736c8dd445a7d990a0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725940, "uuid": "432f6082-07cf-490e-8bb8-1cc9ec514843", "comment": "Malware payload", "value": "86d49b523897bfe1bdf42aa56f91a8d22e82810a1d4ff9d0bfb976f60221f869382d87e95e660ce5b6e5bfd590ffd877", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725940, "uuid": "7aab9764-3485-4894-897f-357266efaa70", "value": "T144A3495B63EA50BBE277867888530A49D7B2B8014760AFEF43A4465E1F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725940, "uuid": "d292f717-ea4e-46c6-803d-1302690a73ef", "value": "f48fee4e1343da73af56273872d2bc4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725940, "uuid": "62e90ffa-0650-44c8-99c7-4052466c2706", "value": "3072:qd/2Rw6hIsGSSQbUA8dnf7vrXT/7nM4L3zm2Q9ZVbZacTVhsrfaDvPK0:qcR9hbEMUA8dfj6PK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725940, "uuid": "22bd3ca9-4b65-4c73-bb15-d7f829428aff", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725940, "uuid": "03e8c2e7-5d82-46fe-b450-08cb3ced0a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725940, "uuid": "d43bd1cd-27a7-45f7-a56c-8a0f824f419f", "value": "29a3ebc7824653ca026d5d0ca36d6dec82eea416c5774a13dcce5b780402e116_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2187d83e-3cd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776703439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703439, "uuid": "ef588bd6-4df1-4aca-93fb-f3a19304a619", "comment": "Malware payload (Mirai)", "value": "8ec2259ef461da9d547ada8f701c9030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703439, "uuid": "032734cc-b622-4e42-aa8f-495f9c24c759", "comment": "Malware payload (Mirai)", "value": "2a664ec4645062cc78df3047e33e00dd28b6fbb986d036517c339010ec9bbbe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703439, "uuid": "b7972952-2c5c-44b6-a528-d4418ef1b598", "comment": "Malware payload (Mirai)", "value": "eb5051dba1cb20be2e399bcdfb6007bbcb8bceb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703439, "uuid": "b24b4da2-352f-4f76-aa58-928c220ed0fe", "comment": "Malware payload (Mirai)", "value": "091a30e082018fe6350d713f892fb64c6ba1269dcdcf7dfe13f454e39a9669188c32c627593c7a4c90640e00a31064d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703439, "uuid": "9b40f843-05c9-4b3f-8511-badf0a3127f7", "value": "T16683199AF800DD7EF80FD67B4453490EB930E3910A931A3777A7BDA3AC721B54816E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703439, "uuid": "621a58e9-191b-4c90-97b5-2d56f868954a", "value": "1536:9UnHTxwGNZg9CPjFXQbs3rIgDPrD0qVy7g8B4IQnHhON+h1HQohu1xgZq2PspVV:9UlgkgGlwqVy70ZOchpGgZqBpVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776703439, "uuid": "f50842a0-c46b-4790-be79-81f7853fb213", "value": 85108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776703439, "uuid": "aa978b2f-d955-43f0-9a6b-ee27e3b92043", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703439, "uuid": "0349a555-a403-4067-8676-138ea13df06a", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2ccec7-3c84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776667385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667385, "uuid": "2ad58f74-f71d-4ffc-b8b5-1214c4134e79", "comment": "Malware payload", "value": "4a33fa90bc8af10af93bc39c2244a5cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667385, "uuid": "02bb4e55-3067-4b52-81a5-10ace68799ef", "comment": "Malware payload", "value": "2aeddc9eb48e13e8cf36199a5292a5e4d724c8eb1be5df92c9cf72b964203e6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667385, "uuid": "0cde039c-f84f-406b-891c-7d9c3abe80e2", "comment": "Malware payload", "value": "4241d7c38cfdd8a973dc8bd3c7d59459e2dee1e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667385, "uuid": "3f44bd1f-29bd-464f-82da-a7fa286cf4d2", "comment": "Malware payload", "value": "12d40b055e3d4feb48e5acac11f5c45d82e0cc31d7c0229e274be0c297ec3cb6099110ab27a0c477fe394d4f51eb0fac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667385, "uuid": "0f7dd485-bb1f-4749-be81-3a4a6fb7c52e", "value": "T105137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C09ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667385, "uuid": "4f65f6af-0f97-4bca-8f63-0c5982eadaf5", "value": "768:bA+49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bA+lco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776667385, "uuid": "cc63a0be-00b2-4931-aaa9-9289ed40acb8", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776667385, "uuid": "0f6aefa6-ab74-4add-a7a8-8924fced06cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667385, "uuid": "1bcf5f52-f2e4-434f-8e5b-3a3274a7b6c8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd4690c-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725958, "uuid": "287ff9b5-367c-4137-9293-12abb77d055c", "comment": "Malware payload (AsyncRAT)", "value": "ccfc074c7411a1690e79af150682bb8c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725958, "uuid": "3db1e94d-468c-4dd2-b28c-3c5fd67086b5", "comment": "Malware payload (AsyncRAT)", "value": "2d22856022fe1009ac1abcc65d63048ccb58590a41a5cbd00c90fef21135bc8d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725958, "uuid": "dd10adfc-5ffe-46c4-a146-767735035921", "comment": "Malware payload (AsyncRAT)", "value": "e907c13a1530739991f4cc736186abd18d7f90a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725958, "uuid": "4ef895ef-b050-4d0d-9ef3-51034b90846e", "comment": "Malware payload (AsyncRAT)", "value": "2bed7031c4ec0d81ca754b8c0458d9a3fd31a30fa1b6a8f9b36364416ef20ae580b700093b49d0860ada82ec0a60f5d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725958, "uuid": "52480b18-042b-4d16-bb86-700b1b8b30eb", "value": "T1C6B34A6772A900BBE177873884A74A46D772B85147A0AFFF03A4465A1F633D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725958, "uuid": "fd1ed6be-6843-4f0c-b584-41ffb6cd8711", "value": "f5eb1d3bbd238d7f14a80742e651ccaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725958, "uuid": "1a602e32-7410-4cfc-a12c-e80f55d7d8be", "value": "1536:LkfjEIf3LlY8ktFlEEsWJp2TH4SDmQc0cp9b6EsEovsWy9hdi9dlx7sErD:wXf3irLrXJpuYmc0m9/svE9byf7sKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725958, "uuid": "8a6d3c01-b509-4c49-b719-b9752c6ab8ca", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725958, "uuid": "192d4729-2a6c-41fe-889f-8389d35362ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725958, "uuid": "57f4f6df-2879-48b7-aae1-6f1fa87d8e7c", "value": "2d22856022fe1009ac1abcc65d63048ccb58590a41a5cbd00c90fef21135bc8d_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924fb2de-3ce7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776710071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710071, "uuid": "3fa7ee0d-1a70-4277-8d17-6c5a9fb33718", "comment": "Malware payload (Mirai)", "value": "9962570a8cafbe61713e291257ecb31b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710071, "uuid": "d2512b34-cb91-468b-a93d-0a21cb7eea7e", "comment": "Malware payload (Mirai)", "value": "2e0f705a3ce36fc2faf33287957ce294ca9a2b5439094ebc0fc91c72c43a2358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710071, "uuid": "a51fee2f-dc8b-48fe-9c21-adc185e967b6", "comment": "Malware payload (Mirai)", "value": "8d9adf77dc68b982fedc011392872626cc579925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710071, "uuid": "6d4c2170-1936-43cb-9230-7393e809a851", "comment": "Malware payload (Mirai)", "value": "fce7080a08bdfdb6bc324e4f0aff728919089ac2f65bc4a68e8dbc7282c3fe575c9ebc283477ee6eac9bf75d57794dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710071, "uuid": "6b5946c8-2d0f-4c71-a294-b54eb78d1c80", "value": "T17543971E2E619FFCFBAD863587F39E219648339216E1C684E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710071, "uuid": "9f029d78-7adf-440a-a7fc-6cdab711207e", "value": "768:RaT+l5PNxAGJYmzrEIPfEIXwKE5jNxAjACOFym6OCLdc34pAOreBAWslnk/zw2:Rn5FxAGJtzh6H5jN2ZLdc3EzCw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776710071, "uuid": "6d1a2f8e-ca7b-49eb-a088-4dd0837356e1", "value": 57108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776710071, "uuid": "1d9a2f29-390e-4a01-aad2-4093eafea362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710071, "uuid": "27b1f27a-6a6f-4032-bc2d-c6f0aefede9e", "value": "00okmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf39c0-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726040, "uuid": "7b194306-4936-47ac-b2f6-9be57b4cd567", "comment": "Malware payload", "value": "d28299eb39c650d022eababe083c9371", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726040, "uuid": "5e8a1713-a805-4676-bbea-4d46887cc8be", "comment": "Malware payload", "value": "2ea66b021040e3ced5627a1f29021c8c7bad3835f01838ee697beabf37a3563f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726040, "uuid": "b29699d0-a5fd-43e5-b291-129a0a36e50b", "comment": "Malware payload", "value": "e4ffb591a7bb3b703aa8157c6a1606c8e767f8e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726040, "uuid": "ec6bdf52-fe5d-4708-9590-cf4088e120c9", "comment": "Malware payload", "value": "963a55f8053ec9317e120b09db5152d28d92bdeeee96762d4e67e379257596d0a5d418afbc69ed1c4f8fd4f45f220369", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726040, "uuid": "80e966c9-85c6-45e4-bf0c-9669d53d82cb", "value": "T191B34A5B72AA10BBE177C238C4674A45E7B2B8514760AFEF43A4429A1F273D09D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726040, "uuid": "2280625d-ba72-4595-a99f-d05049aa26ea", "value": "7f4cbc4178b6801188a15b4d1db85460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726040, "uuid": "edb7d8eb-7dbb-4ece-9458-1db28b425271", "value": "3072:vfY7KjldW8rx5mGpJQb05G3JbLXNVQezDZ4Cv2GWwsOdJSlOLds:vfFddrxQwM05G3RLLP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726040, "uuid": "9fe99623-8156-4063-9067-8b8aa34bf6d3", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726040, "uuid": "c1f6b972-34c1-43c1-b5dd-2c67c36985ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726040, "uuid": "bdf3ad5e-9bd2-4698-838c-26b36e76817f", "value": "2ea66b021040e3ced5627a1f29021c8c7bad3835f01838ee697beabf37a3563f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dad78e3-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674415, "uuid": "dfe925ce-3ba8-480a-b23f-33c8fcc10604", "comment": "Malware payload (ConnectWise)", "value": "70089850991a9bdbe1e400d41edafbde", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674415, "uuid": "2dd26acb-9675-4615-bef0-827526ea7204", "comment": "Malware payload (ConnectWise)", "value": "2f0c3525cd9535ae897c8e6113754b577a13789571279d54b2c9fafd1d37b3e7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674415, "uuid": "b75043a5-434d-456e-8e3e-0ad72b3ae66a", "comment": "Malware payload (ConnectWise)", "value": "5d90c5a54a6d55f9239f66e21ba6222122eb30c3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674415, "uuid": "cf23fa10-dec0-43c9-b919-c1b372b05c56", "comment": "Malware payload (ConnectWise)", "value": "8207d51a3d57fdc484a820051e4799781e277c32a1ac1880832c9d5a7de9587ef8b66f0587ada81ecd854034cbb4d048", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674415, "uuid": "48e6dce3-228f-4b27-b896-4c9a671974f2", "value": "T11FD6232267FD0918E1F36778FD3A91E291367C658F12C09F2654786E6871E8097A333B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674415, "uuid": "f45f7415-e7f0-430a-b3a9-2d9551eff6dc", "value": "196608:mrnLYG3zDhukOCrnLYG3ztrnLYG3zGrnLYG3zLrnLYG3zkrnLYG3zornLYG3zV:mbDDDgvCbDDtbDDGbDDLbDDkbDDobDDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674415, "uuid": "ab7016ab-7730-4a24-b1d7-76653efacdab", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674415, "uuid": "f36c9d49-fb71-457f-8727-f3038480db36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674415, "uuid": "77797884-9fd5-4d61-9b29-4d86b0c79d0a", "value": "2f0c3525cd9535ae897c8e6113754b577a13789571279d54b2c9fafd1d37b3e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef8704d-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697691, "uuid": "52a58ba9-1646-425e-95f3-947e66669159", "comment": "Malware payload", "value": "ccd51588b27ab8918d1d92f444b5e924", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697691, "uuid": "be97a74b-4217-4bb4-9755-31d6655472c7", "comment": "Malware payload", "value": "2f9e3722ed0d84800c5194052c41dd8fb030912c354cc91e7b3eff15746f02e5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697691, "uuid": "c168e7f8-93af-49d2-84d3-6842af9c2571", "comment": "Malware payload", "value": "b917720506007cb94fa075fe0941cb48429cf2b6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697691, "uuid": "a78fa13c-3168-459e-9c06-ba7b5ddf24a6", "comment": "Malware payload", "value": "20527dcc5648bb80b0fc6de9a65eaec0d1ea4a1bb0b1a876c3b800be0cca3f29653391f954e97a2cdee07e8464505c27", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697691, "uuid": "10f3bcda-3b8d-450d-bb85-1879fca0154c", "value": "T13C1623314AE529770B90062670AF0A2D7E7C9827C249D9F5C488B1513C9EF8ADEEF57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697691, "uuid": "545e632b-f098-4dd7-963f-b3bc9bd93048", "value": "49152:5CFRy6arFXgiRAA1gpG5BwgETInkIOpofIu6xX9kQhZezLAHSn:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697691, "uuid": "336f690b-b79b-4bae-b822-71a34f3e6ca8", "value": 4136149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697691, "uuid": "0ee6239b-15b0-414f-836a-1ae255152f05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697691, "uuid": "b39efc2d-a70e-4fb4-8c37-02f4d7b2ab60", "value": "090661ONIIUU5J8UrvknDivsn_1988RXU11ANUPL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ab2e2a-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687181, "uuid": "5d945be1-545c-4516-bf7a-608351767e3d", "comment": "Malware payload (SpankRAT)", "value": "0df7456b0be82385a19641c6ea199201", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687181, "uuid": "84f14c42-2679-4c20-a497-1c5526633307", "comment": "Malware payload (SpankRAT)", "value": "30347e8072c2aea0606c77d7afd1845bca1a2e24362f726428a6985996d64355", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687181, "uuid": "ec83ec53-8c09-4029-b59c-faaddad8976c", "comment": "Malware payload (SpankRAT)", "value": "10be6c72a6a23cc36426d1312ec8fc6b2258daad", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687181, "uuid": "b915a4f4-42fb-401c-9d9a-12b6d9e52e99", "comment": "Malware payload (SpankRAT)", "value": "d314b231dc61e7aa5f0b923033532ddae48bda55e46959aa7be29b6bc2a9f4aead1236d9550fc83e6126606b03835acd", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687181, "uuid": "307d4d5f-3f23-4c7e-9941-7b0655929228", "value": "T1FA253C137F4A89E9C58AC8788357CA624E2334DB0A35F5DF50C6662C3F6AAF52F1D214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687181, "uuid": "8be86de7-0c2c-4d88-9222-9509885f4e9e", "value": "1181b52ebdb3f4718d81e1aeb12d2881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687181, "uuid": "f162bd07-57ba-420e-a92c-97a313b460c3", "value": "12288:DwdqvQmbjOTK9krmgF9QF3RaTU6IIkCvFtUNZmaHZmM1d/KRq:DwdqFMK9qmgF4gnI2UZv/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687181, "uuid": "f640040e-c122-44fb-9a00-bb9934a25767", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687181, "uuid": "fd7dd5c9-5b6c-430e-9ffc-a58be0b8e8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687181, "uuid": "58f5b384-cbdf-46b7-bfb6-2a8a0af8bfeb", "value": "30347e8072c2aea0606c77d7afd1845bca1a2e24362f726428a6985996d64355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3a637-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725738, "uuid": "50b4412b-86c0-4233-b669-181424b271fd", "comment": "Malware payload", "value": "423ffb6b6f0ad2ea2a02236e6cbedeb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725738, "uuid": "ce833be6-8f10-49fb-9914-b192d2af3f5c", "comment": "Malware payload", "value": "3038962c429342d52261e92d9804d3aa3446c981e79d204cd7b8cadf61aea512", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725738, "uuid": "8c58c9d6-f8f1-4dc0-8b09-f771b6bfffdc", "comment": "Malware payload", "value": "759c0c2ec4d738957ba36c69e906efddccbed268", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725738, "uuid": "5368522e-1714-4750-9c1c-7a75aeb13de1", "comment": "Malware payload", "value": "d0a1ef5e0cb714ac6d7e7aa27747ca23d4c284b28214fdacf8466a6bc0d9ba0948299993aa974918e546b34d321b3361", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725738, "uuid": "1cb2d379-cc7d-44d0-9467-a4274db217e8", "value": "T186A3494B72EA00BBE1BB8638C8530A099772B8554761AFEF43A4465A1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725738, "uuid": "1392d1a4-9cb4-4545-9e69-92248fa655cc", "value": "48e98c355628f448dab3e04f3fea7bd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725738, "uuid": "391a1862-f8e0-4110-9835-c1bea674b20d", "value": "3072:LSbNhbCdHdaLyAiWQ4wXhJLiwAtpFrpqpqpvvkTiGLh7:GCRUumFwXhJmW37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725738, "uuid": "d1fb19ad-6055-404f-9658-2cc66cba74f1", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725738, "uuid": "cc24a9dc-e3c5-49e1-a46e-5767d951156c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725738, "uuid": "6b23bcc7-6555-49b0-9873-8015d72dcc8d", "value": "3038962c429342d52261e92d9804d3aa3446c981e79d204cd7b8cadf61aea512_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd69953-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725039, "uuid": "5efb876b-e9f6-4fff-8cb5-063d5340ea4e", "comment": "Malware payload", "value": "a45edda2b0af47c18596c9b63295978d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725039, "uuid": "7f049003-5650-4efb-b906-e9b968bc7756", "comment": "Malware payload", "value": "3043002f6751736c0a1a5e4be51ebf5ab5a6169e8d3d7fcd4a2718774e7842ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725039, "uuid": "1190eca9-2cce-48f9-a6b3-c54ace7ee8d3", "comment": "Malware payload", "value": "3c25e6a35b0c3e49fa18abb1475f8c3248c5f6d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725039, "uuid": "9ccf86bf-347d-4ee1-9445-003d4d20d4eb", "comment": "Malware payload", "value": "a69169fade9695ae1156d9d0f9fd3a983286ea5255ce038824735951e460f41b042b5074646f4523dbf7be0ce4a731da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725039, "uuid": "ff31fdb6-7b25-4ff3-853c-41b2b87443f2", "value": "T160B34A5BB2B600BBE1B78239C8570A45D772B8454761AFEF43A0429A1F233E19D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725039, "uuid": "f397981d-9ff6-4dfa-ba62-718f705ea31f", "value": "963ec97d19b0330bd0955a806abbebe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725039, "uuid": "09c6ba02-515a-4655-8a34-3c43359bb53a", "value": "3072:jgBVDGq12ZGdQbKOT5HzM/I1w+Tj5YiPWm2QjcqEsV8M88DvF:uDT1XMKOT5TM/gewv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725039, "uuid": "f25231d5-4620-43d4-ae59-3f0f5ff21c4f", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725039, "uuid": "ebac2d25-8b6c-44aa-a7fa-ba7ac313e079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725039, "uuid": "d58a429d-e45a-469d-aefb-7be9133ee766", "value": "3043002f6751736c0a1a5e4be51ebf5ab5a6169e8d3d7fcd4a2718774e7842ca_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420969c6-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687173, "uuid": "d92227a1-444c-434a-967e-0cc683e84085", "comment": "Malware payload (SpankRAT)", "value": "b153ee0b1b46502ea08a8f3b529f5eaf", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687173, "uuid": "1f62d160-a18b-4d3e-bbe5-72ed519b4013", "comment": "Malware payload (SpankRAT)", "value": "307387f5c0f3e4a2a725a6d81e81fc018e9020aef8418dd6a426f1ad7708e017", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687173, "uuid": "4beecf82-5ef7-4451-83e4-723f1095f697", "comment": "Malware payload (SpankRAT)", "value": "8ceba3cf7b1d0433ffb69deb44487cbc9ee1b004", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687173, "uuid": "503212cd-73e7-4119-8622-77f6200f3c56", "comment": "Malware payload (SpankRAT)", "value": "b2b5762c88dd013043c426820433200dacaca7f7976b291df51277b510f69ac6e240fdc8653231935e048bcb6cde4d04", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687173, "uuid": "88285f79-7ae4-4cf5-b384-876861ac873c", "value": "T19B253C137F4A89E9C58AC8788357CA624E2374DB0A35F9DF50C5662C3F6AAF52F1C214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687173, "uuid": "c212328f-ce85-48d9-8762-e7ad1d493e03", "value": "1181b52ebdb3f4718d81e1aeb12d2881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687173, "uuid": "0be01d9c-4ca2-4074-8362-ec8604c5ddd3", "value": "12288:rwNScQmWGgUX6c4T+TD6YlQKDspCAOlCv1tcdY9SHJ2v1v/KRq:rwNSugi6cK+TDcKDAjcY8S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687173, "uuid": "44700c2e-b3b0-4d46-80db-af61b9037254", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687173, "uuid": "1ef71754-5e1c-47ec-8e77-3e6daefbcbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687173, "uuid": "b2a40ac9-33d9-4790-826d-0c0181957a02", "value": "307387f5c0f3e4a2a725a6d81e81fc018e9020aef8418dd6a426f1ad7708e017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283cc89a-3d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726643, "uuid": "394fb8c5-33a5-4ac7-b54e-65ea6d623363", "comment": "Malware payload", "value": "8019c3fe9682a4c13b11950262bb87a5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726643, "uuid": "61302bfd-63f0-4a2d-9e50-c7545dba26f5", "comment": "Malware payload", "value": "319c653b08a275d921b18d3f8d44fd8476262428871ef1690875a577a3185264", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726643, "uuid": "0dbd033a-8e3f-428f-9158-5efcb265dc13", "comment": "Malware payload", "value": "1f6291abbda7ee37da591085ef72a21fc8f0f536", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726643, "uuid": "375fb21a-59f1-4801-99e4-660cf1e53c5e", "comment": "Malware payload", "value": "ba888de04f583f1f94376d0de9a8d070cd93c23a1763f96a5256dd43129ca1e8094cf2827e40c2183209bb14dabc7f08", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726643, "uuid": "205a7782-fe2b-4ba4-9d85-6090ad7eddd8", "value": "T1C1D332CFCAAED8EC871F6069064F2C0BC68F9523192DC5907AEDAD593F35D643069AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726643, "uuid": "80c070ca-9862-465d-9f0e-79110f65ae2b", "value": "768:HcywGUqNK8uDNveoYD6mOI6/xBhy3SU+E1W8kcT74yHKGi/sdYeN9igdqBrlvYZA:BwvBib11xIW+6Spre9uDAJDBYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726643, "uuid": "dd985e9e-27a1-4002-bfdc-464e84be0bd4", "value": 130159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726643, "uuid": "0be3e935-34ad-46cb-b7b7-9d881a7ff69d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726643, "uuid": "a62d6d03-5a4d-4a17-b97d-a6651efe3c3e", "value": "Images_USA__97.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb511d2-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776689204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689204, "uuid": "4be16f5a-a5e6-4897-81aa-13e8ccf21014", "comment": "Malware payload (Gafgyt)", "value": "67900b5f2dc240264c2f9daa276695e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689204, "uuid": "3ca0fec8-1f2d-4114-ae90-672c35a3deec", "comment": "Malware payload (Gafgyt)", "value": "3292e176098ebb83f6602382b36304ae41c4bfeba68cfab62a374d01ff7ef1fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689204, "uuid": "4e98ed76-1495-484b-817d-6e681979018a", "comment": "Malware payload (Gafgyt)", "value": "d540cb6c9c01b0cbbb0a96d5709510f001638a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689204, "uuid": "17982002-8109-4c64-aa49-503b39ce64a7", "comment": "Malware payload (Gafgyt)", "value": "b7f77fb8aa97940e06c3884fa31a1c75408421679c1487b2d30fe4a1476c419402e33c81825c7d00f70338a97ad5be5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689204, "uuid": "60abedf0-716e-4f00-aa26-2a0ee0e8a24c", "value": "T10C43F1C026BE4AF9C4779A7035D32806FD395E5251864FDE14DBB1B6CE66B808E307A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689204, "uuid": "c1b4aa78-2b9d-496c-bcd4-f2f49f29a596", "value": "1536:QOS92Np00AdZhKVTL4ZPITRhpFVfVh4QJyZ8m4iOqRVFuuo:Qb92NphgILwYRh9fVqQJdsxuuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689204, "uuid": "cf389cbc-5989-4290-bbac-437e3ee910fd", "value": 57608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689204, "uuid": "5b43a9a0-c1c7-4531-8b94-3917c0af770b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689204, "uuid": "97d0628b-119d-4be2-9408-1ab52636fa97", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d67ebf-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704849, "uuid": "18f59f43-d790-45f3-96f0-0ceb68a82e29", "comment": "Malware payload (Mirai)", "value": "ee37858efe33ff9646224cb1bcaeff08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704849, "uuid": "feca361f-1898-4d87-aba2-dfdf2ce2e173", "comment": "Malware payload (Mirai)", "value": "33d339adf59b7e7d0e5d93cddbac2f6fcf8e6d945c029690a3ccf5c0c6b6e61d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704849, "uuid": "0b0ca08a-d465-4e56-829f-38829a9678d2", "comment": "Malware payload (Mirai)", "value": "ff15d29b783db56ad30ba6bb495c96cc4635fda7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704849, "uuid": "466bc854-e708-4748-979e-cfc1fb6c594d", "comment": "Malware payload (Mirai)", "value": "b537c63725d3c4d72cf5bf71d6819e86d574769e46f582cdb34a20987680ca2398b922ab1bd9770f429cb1568b444260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704849, "uuid": "f8242b8a-4fe2-48ef-aa86-f50c2c826900", "value": "T1F9F2E0ADFA8E0C6AED6B3E340E75F5D763D10317B3017D6AA112751013674AAE32C6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704849, "uuid": "10fac9a9-7afe-40d3-83b9-b8d6f512f760", "value": "768:fyjNvPJ2AUfcd5jEPz6RbBrtNQ8ACzXQ4inYQvMKthBj4uVcqgw09O:fQNPkAucd53BBrtaF2XdinLvXfBj4u+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704849, "uuid": "5d9c247b-0311-4ebc-a98b-d78fd0876a0e", "value": 35252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704849, "uuid": "8fbced6e-48f8-4e52-b3be-92b3cae63383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704849, "uuid": "b41666c6-121e-4a7f-9192-56fcd470ff0d", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c548dd5a-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776689541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689541, "uuid": "7f06a706-c11b-46d6-b328-cdc769394c1d", "comment": "Malware payload (ScarfaceStealer)", "value": "be46beb52bcd98cb9e917fa857b6dcc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689541, "uuid": "a63f11b5-147b-4d07-ac7b-96229acf3ac7", "comment": "Malware payload (ScarfaceStealer)", "value": "343bad63464965f0e01c668da2ef9d4e60587594a5d5ae9e5778c3c56ad1471c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689541, "uuid": "00ce54fb-1c35-48f0-b2b3-a5e2d62eb053", "comment": "Malware payload (ScarfaceStealer)", "value": "81f2549b0e32fa6c75590a893f68cc8341f4a6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689541, "uuid": "306d764a-5a65-4f52-8b0f-735ed13a7c5b", "comment": "Malware payload (ScarfaceStealer)", "value": "0e4c598f964399b11cb668fa2be4d73b0900f12a2e7d70395f3b295171c9577b9559f9513277d0edc64f324afcab5923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689541, "uuid": "95159fd3-8a04-420e-bd98-308fd581aa88", "value": "T189E623FA94D522E4CDD74B80524F9BCE70E2E11E46A9AC2D3BC71C426632F978149E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689541, "uuid": "8d513754-318b-4270-893d-b524af9263c8", "value": "8fbeda4c540732bf20dd67e9a33d57a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689541, "uuid": "fa9e88a9-0142-411a-92fe-15d0c850c4f2", "value": "393216:eINpxwxmXOz9qhACNH894aM74E3f56SD7:eoppjAh94aAvYc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689541, "uuid": "fbefed7e-d3af-4c2f-8e00-a0f05c86c23b", "value": 15017472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689541, "uuid": "7c279e05-fb38-4c0a-928a-3b33ab35d470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689541, "uuid": "afb03eb1-7bbf-40da-b2dd-6dad18e8be3b", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bda19fb-3cbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776692746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776692746, "uuid": "b52b8a33-d32c-4bb7-895f-43610a4526e6", "comment": "Malware payload (Tofsee)", "value": "d74cb7763d0f1101da4f18f1226451dc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776692746, "uuid": "91cb9b92-8de1-4662-8f02-82b8e73a5c64", "comment": "Malware payload (Tofsee)", "value": "345567816147141c9bb71b498cc183cc8bbd33787eec27c83579cc0598348f14", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776692746, "uuid": "e4656508-0c51-49b1-af58-706af5cca17b", "comment": "Malware payload (Tofsee)", "value": "6a5330e35480b8b688044bf2225f2b1dd0ae47d9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776692746, "uuid": "d8648357-5982-4d5d-a67b-e4e521971473", "comment": "Malware payload (Tofsee)", "value": "b048c8896b45bf56abe0b597bfa636ebfdc13dede7cb9b2ee402056175404eb778da9c9e810b68a2482f30339bae4e86", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776692746, "uuid": "6341a5f0-54c7-4786-ac4e-b11872b7a231", "value": "T197D60237B38A653EE07E5A365AB2E210543B7621AD138D1BD7F4085CCF261A03E3B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776692746, "uuid": "35a61bda-7b12-4721-a552-ae99fe380fee", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776692746, "uuid": "da15b101-53c7-45d3-b5bd-bb2cdc30218a", "value": "98304:jL8NckK2/XPeI9EWkWHcv+yjn/lufOe5:yDfPevPW8myz/lu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776692746, "uuid": "f1d2a885-e6f2-44a0-b0ff-3dbc470a81c8", "value": 12667278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776692746, "uuid": "a990afcd-07e3-4525-9be0-76164df87ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776692746, "uuid": "154c7539-abae-432a-95bc-4b03f86ab004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bd8317-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725599, "uuid": "b8fc6e49-d7ba-4610-bdaf-83d1917ee25d", "comment": "Malware payload (AsyncRAT)", "value": "cf81fb35088ac48044c4c09d32a328db", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725599, "uuid": "1cff3457-4b80-4ffc-a4ec-d31858142808", "comment": "Malware payload (AsyncRAT)", "value": "346edde3c594d4af0f607951ae38f21c8e5ad611419cc7c9e7a2e0c913896581", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725599, "uuid": "27ab3ad9-701d-4c25-973f-b038f1ff7720", "comment": "Malware payload (AsyncRAT)", "value": "662339d56e86857a0ba59f007e4c94f731155bbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725599, "uuid": "1aefa7db-2508-4878-9adf-ad06e198976c", "comment": "Malware payload (AsyncRAT)", "value": "cd2ea37871c5dcc664f2865e2105ab40091a13548fe9225c158d609d5997ef58db6b7135d6bd67e0a6f5c4019a88ef8e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725599, "uuid": "146dbcba-26e2-4301-a20d-6357d339005b", "value": "T12D036D487BD44215DAEEBFF629B361060770E5078D13EB9E4CD485AA2F33BC446067EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725599, "uuid": "886a9697-f349-45ba-9609-55ccf18c1927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725599, "uuid": "369ee443-b801-42c1-a2f8-f3ace8497bdd", "value": "768:Iip/WpIabzG8kcWXj0mtSzFWPm9W/OMhDief:Iiwa8zG8kc80m8Fx9W/OMxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725599, "uuid": "9de8b4f6-f3f9-48bf-a437-c726271838d9", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725599, "uuid": "01bfba7e-f2fa-4a9e-8b74-4aae960849fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725599, "uuid": "f048bd5c-3ebb-423c-adaa-84fb9c377931", "value": "346edde3c594d4af0f607951ae38f21c8e5ad611419cc7c9e7a2e0c913896581_cc16352f-e737-4d5e-b40a-4bb4b8350625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd9afae-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725925, "uuid": "8c975d3a-b71c-40a0-aeaa-dea4d858e266", "comment": "Malware payload", "value": "8c4668996541098b36a9eadbb4130436", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725925, "uuid": "88d95a7d-9db3-464b-9564-bdf11984f31f", "comment": "Malware payload", "value": "34b09c16f347ecda5b4e40ec00d19c10917c3151fa55b0294d7987fdc5baf950", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725925, "uuid": "24d6f52a-2144-44b3-880c-14d9a27ae779", "comment": "Malware payload", "value": "bb883ba3d9dfb3233785c96da9c03dea5175c656", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725925, "uuid": "e89a00a3-9c1b-4088-b83a-17b1dd1802c1", "comment": "Malware payload", "value": "2dff7f7ce25b18d8a9c407685ff4b7a7db183e52afb28cb940c27d1f2747df23d4c27fddb1cc11d5910c9cb7839cd7b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725925, "uuid": "725ded6a-a50b-4b83-8c58-31f03c9cc267", "value": "T1CAB35A5762F500BBE1B7923885A34A06DBB2B81557609FEF07A4464B5F233E18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725925, "uuid": "99d20629-cd7b-4a17-8d14-aafea0e8e890", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725925, "uuid": "88bd18b9-1262-4b58-86f0-943218251c23", "value": "3072:2loll4YSI2bdOASdo5XjxZsIV1dqj5NEWax:xlLeAdoZbVm5GHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725925, "uuid": "ad9c12b2-7bd1-4b7b-a2ca-c34fa790773c", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725925, "uuid": "27724cda-47de-4cbd-8d84-f131cd436062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725925, "uuid": "ce4790eb-8e5f-453b-9677-6d0908a93aed", "value": "34b09c16f347ecda5b4e40ec00d19c10917c3151fa55b0294d7987fdc5baf950_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfa1959-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687512, "uuid": "71d7de28-89f8-406d-8a03-7b257fc6e339", "comment": "Malware payload (Mirai)", "value": "9f61d2bfa3e837f49aa9422cd1e3e901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687512, "uuid": "c8bb5f61-07af-40c4-b867-2bf6a367de9a", "comment": "Malware payload (Mirai)", "value": "34faac1fc6180ffbd8a2b71e15835ecfe0e6e3a842653e3d1496b112158a9907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687512, "uuid": "d27149e3-5d32-4da5-9602-f3d48692d57a", "comment": "Malware payload (Mirai)", "value": "fd115ac9792d817eb9cfb547548c3352a702ede0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687512, "uuid": "b968c35f-c2f8-44ea-ab7d-6fa7776f52f5", "comment": "Malware payload (Mirai)", "value": "4b23cd490665a617326fd4a0a1fc8baa098bfb5b1d197952dcc6f830f8e94f4fbebab305a239ffcd4fba709977e4fde2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687512, "uuid": "2a6f4bc5-edc8-4c8f-8ad6-3c5af6bf691e", "value": "T186237CC0A543D9F8EC150AF43173EB329B7AF07A2129EED7D795A432D841702E54729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687512, "uuid": "21586cc0-360b-42f8-92a3-65d72811749c", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLxD9NnbZrYMbJoSlO+Meb4ah:gWBsux3TUiG9qbBYSWV9N1Y8JoSlO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687512, "uuid": "a457a48b-a02f-4ecf-8821-b3a6fdb6b2e9", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687512, "uuid": "2953eba1-8b8a-4bd8-b46b-7e4ff223db5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687512, "uuid": "0522659e-ca92-42ff-8f9e-a7d2cd0711f0", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416ae1a9-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724968, "uuid": "0b15bed3-17bb-44d2-b62c-bbf287a0763c", "comment": "Malware payload", "value": "de784b74c6bc426acbafe61711d397b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724968, "uuid": "f3c13e01-3c05-49ca-8d55-0e1bbcc003c3", "comment": "Malware payload", "value": "3535ba5d6ee2950062b9142ccbd3b947a73a620a1d621a5c4434dc66adf25b7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724968, "uuid": "42e17de8-8fa3-4bf2-be82-721e261cdf02", "comment": "Malware payload", "value": "fd491feeaa6c88cfd3bf2a52cb3bb50bdf20026e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724968, "uuid": "4eeea971-b258-41c6-bf3a-d9081261baeb", "comment": "Malware payload", "value": "b76c925572561bbcafe493800d9343344cdae97406bd757263f9f0305dd8349264485bf784fbdc5f6597e63fa31f3c11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724968, "uuid": "eeb04e20-0e68-4b20-b60c-b6d09bb7b691", "value": "T11EA34A47A2AA00BBE2BB8678C4530A49D772B8551750AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724968, "uuid": "d7e6133d-517b-49db-908c-08a408b232b8", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724968, "uuid": "836b94ee-b6bf-4323-b976-0175a8a3588a", "value": "3072:wRTeXQwDasaAmiTQhAS/xYN0551756565rnIryHk/CXDK:IeXbuFaTcAS/0/C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724968, "uuid": "99fc1713-af9e-463b-bebc-904ff2bb815d", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724968, "uuid": "8efa0298-cfd5-454b-81a5-6e107629828d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724968, "uuid": "c267f9cc-523d-4ca2-b10e-f0681f7d001f", "value": "3535ba5d6ee2950062b9142ccbd3b947a73a620a1d621a5c4434dc66adf25b7e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ab5ca5-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676702, "uuid": "327d8d43-863d-4108-8f4e-798d9d696a65", "comment": "Malware payload (ConnectWise)", "value": "346055d790a1b04216d5e5d3ce477fe9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676702, "uuid": "da6525a7-b5d2-4d9b-909e-73ac04a54fd1", "comment": "Malware payload (ConnectWise)", "value": "3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676702, "uuid": "795164c1-4df3-45c3-9a17-cafbb0d3e770", "comment": "Malware payload (ConnectWise)", "value": "270dffd2dd57860602194915efe1982147d72985", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676702, "uuid": "6edb2472-05b9-4871-b8d3-4dfd6f793b8a", "comment": "Malware payload (ConnectWise)", "value": "c6c141e49a9a4099abea6f4e806d389794fadde9812047132dbbeb4301bfc2b26ae93bf006ee2bc29399ac1ed1e3247f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676702, "uuid": "af1a9294-e8d7-4797-8e84-0b8e33974f1e", "value": "T1FA646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676702, "uuid": "1994000d-b259-4b89-b8a2-50a42a3ee170", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676702, "uuid": "b6859d6d-8a80-47ef-acbb-847c22dc0597", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676702, "uuid": "3c9c94b2-d9bb-4a73-bafe-313d595756d6", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676702, "uuid": "92d0e05b-2ef4-42f6-b507-bd03ab9bd2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676702, "uuid": "fb633a5a-f444-4cf4-a2dd-e01cc7e772bf", "value": "3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac501b0-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725064, "uuid": "4577f296-3b47-4867-a58e-423e74685d92", "comment": "Malware payload (RemcosRAT)", "value": "37b14e5e799323b44977e1f142ad6783", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725064, "uuid": "032312c0-7dee-42ab-85d6-2d40c10a78ca", "comment": "Malware payload (RemcosRAT)", "value": "35ffbcf51dba119a8e567fca0652f799c058749f500b8ba6c5f6b5d9b3c05608", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725064, "uuid": "30ff240d-d75c-4a86-b75c-79523fc04dd2", "comment": "Malware payload (RemcosRAT)", "value": "763d833bb88da0cd24312a3d4e40b9574769c2ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725064, "uuid": "d17b335c-f8e2-403d-a86a-22b36cc25482", "comment": "Malware payload (RemcosRAT)", "value": "d46658bb38ebf41697db72771c3fcd1e194d1377f794e114e8f934a4c7a2e6a9cbc1cc1c4bfe6f4ffaf6c2f268577c0f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725064, "uuid": "3ba0663d-f081-4de6-93ca-c505971d3c36", "value": "T1AEB35B4B62EA00FBE5778278C5670E46E7B6B85107609FEF03A4461A1F237D18D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725064, "uuid": "c48cf299-14c9-4b70-bd70-5ce96545c095", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725064, "uuid": "b71742a7-6fa1-4162-b0f3-0f8226eef5fe", "value": "1536:92wkTwPMFZYQ46x6Fu3DpGTHASUVjLLJBqQ5tEJsWTrdj9dl7j86QQT:9pXPMsoF3Dp+g9LLrqItqB7dY6QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725064, "uuid": "9c91863d-e576-480b-9b1f-52fce28104d3", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725064, "uuid": "546ac22d-5b1f-496a-8b7e-2564e0c49a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725064, "uuid": "f6c026f5-c5a1-47fb-aae6-485c55b94a67", "value": "35ffbcf51dba119a8e567fca0652f799c058749f500b8ba6c5f6b5d9b3c05608_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a638d80-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689254, "uuid": "d3e533bb-a5fb-4716-8cdc-829c17e6ba7f", "comment": "Malware payload", "value": "cdd515caf69c6e7793dd75cddc63ba10", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689254, "uuid": "dfa3e4ff-c52f-4b87-afe5-9d033d2db472", "comment": "Malware payload", "value": "36d22778dda953d192e7fd910faab2f4012421efbb35360ec7fe3e1c5109f1aa", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689254, "uuid": "40d7c9ab-f7e9-428f-a16f-7a905ba60b4b", "comment": "Malware payload", "value": "fd1b8fef0ccdf03729c5807cce1e1d3511f8fff5", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689254, "uuid": "64808bf2-7816-4014-892f-fa301dba20ae", "comment": "Malware payload", "value": "12e0bb4005a44f6395bfe8f7ee4b6c59df7276b110f12fc165b06752412549b3f3ec30dbfb5d3dc1b42de65de470a604", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689254, "uuid": "648ef40f-9ab4-471f-b718-538c3261e421", "value": "T10CE27C55676C8713DA6F9E3CBCE156134BB2E345C942F7CA28CC91D64AE23408B8179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689254, "uuid": "117d4d7b-3c7a-4a6a-a97c-daf15ee4ec9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689254, "uuid": "8c2b3798-2c84-4c43-969d-b7b5f1470237", "value": "768:8dplK7U6tY6LIqMXTfr3l61iIFXRhESSfQslZx5ALw:IpcY69In7r3l6ZlRqBfBlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689254, "uuid": "cb3a5cbd-28c9-4d33-9ebb-79483d44dbe1", "value": 34064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689254, "uuid": "c20ac09f-4c4e-4fcc-a3b3-9bd84335c17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689254, "uuid": "8d0d9ed1-84dc-451a-927e-29d49014ebd0", "value": "36d22778dda953d192e7fd910faab2f4012421efbb35360ec7fe3e1c5109f1aa(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f82ec7e-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727085, "uuid": "f1e6f7b3-bc60-42a9-8266-d8b356a0dff7", "comment": "Malware payload (Mirai)", "value": "e3595c193f5b64ef12a7d750371037e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727085, "uuid": "5bf32fec-87c0-47da-9cdc-ce8bffec856a", "comment": "Malware payload (Mirai)", "value": "379f3b1c18ff8f390f2112899f710eb5e751378ebeed27748d92c0b43deb1629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727085, "uuid": "a4a192f8-acad-43f7-bab1-d1a409e90ddb", "comment": "Malware payload (Mirai)", "value": "a451af7f2c64f9ac9803f8816933f6a886f9e3a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727085, "uuid": "08f1a16a-3a65-4f2c-beac-a17b2d83ff97", "comment": "Malware payload (Mirai)", "value": "f172b502ecaf2a9b838000583aebd0d49cf023cd01e2332ef6c4d791561f41b415dfe4eeca66fac0f4d725a5f2b6d8bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727085, "uuid": "3c53d958-c919-4a1f-a656-721ef2210231", "value": "T1745172D7021147792D67FFABFEBA8E0CB58250E158D23FD469EC35A5628CD883184B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727085, "uuid": "26d40731-ea37-4a73-9ccc-4016a79f0794", "value": "48:ineOehmlneEenElnefeCXlne7eePlneaweazvZlneaCeaFvjlne9Nqe9z4gelneC:inVgmlnLuEln2pXlnuBPlnfwfzvZlnf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727085, "uuid": "0b0e5798-1a2d-4bba-a903-34fe37008710", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727085, "uuid": "05939af5-61b8-408d-aa6d-9873b8d6d5be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727085, "uuid": "57de24c0-513b-4cb2-9c25-55f33e6ccf40", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82299e1e-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725506, "uuid": "ca70c12d-d1d0-4fd3-9e7a-58ab3b03b77b", "comment": "Malware payload", "value": "96f955a1e420d003854c2e55e4491959", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725506, "uuid": "f77118ec-f760-499f-b5f8-fb9abc2a8d07", "comment": "Malware payload", "value": "37be0edf4f3874331fa44e4697af059d27693fa4a51f42b80828df928115f409", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725506, "uuid": "f595a781-8276-48c2-a5e6-1f28f169310f", "comment": "Malware payload", "value": "b4f64778176756188b1a55a1558396d923cedda6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725506, "uuid": "ad6e8936-5346-4c93-af09-c83643b89cc9", "comment": "Malware payload", "value": "59522c57f8e20105f5fc1ba915d4457a64bf48171e6f322f7b253dc225dd62217dea002606c884f2ccd22817ad23e944", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725506, "uuid": "12588996-719f-442a-9513-283888a48da7", "value": "T1BFB35A4BA3A500BBE17B8679C5630E49D7B2B85117609FEF07A0461A1F273D28D3DFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725506, "uuid": "94760372-0f88-4d27-88fa-73da45ca9aeb", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725506, "uuid": "dd1c59c6-495a-4991-8f61-9d5cd754dcf7", "value": "1536:H0xck1TQHWVxYekVYL6rXp/THnS3i2usEUrN3F6JxE+gsWRJdL9dl5dDv1QgU+9:Kc8UHW0N9XprHEuXoN8JxSjjBDv1QPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725506, "uuid": "b62f0cea-63a8-4d1c-ad04-b800112c927b", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725506, "uuid": "24ff199b-154d-488b-82fc-fabdcc12b027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725506, "uuid": "532cf650-ed0a-4303-9210-425b3cacfff7", "value": "37be0edf4f3874331fa44e4697af059d27693fa4a51f42b80828df928115f409_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b243d8-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676782, "uuid": "58d5e5a8-9de8-4e7f-bd74-417739dad573", "comment": "Malware payload (ConnectWise)", "value": "154e0b182ff59fa077bfe89589abb5d2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676782, "uuid": "83caac52-0275-47a1-9774-9ca7a4cfe5de", "comment": "Malware payload (ConnectWise)", "value": "37d509069edf53cb2b606695f4128c684b668e105d5f36683f119d850b888402", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676782, "uuid": "8a685753-675c-4016-b54c-49ea5738893d", "comment": "Malware payload (ConnectWise)", "value": "e895b8ea4d1536772dfc2ff48cbaec767c52e5dd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676782, "uuid": "8c80ea8b-88d5-406b-87cf-6acf83134d20", "comment": "Malware payload (ConnectWise)", "value": "dc78cd0f1accf7a62493dc4d53c0d45786f46cc8023f838181d288643f12bdf23e66c2512a31e90c3223e05676fe48a4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676782, "uuid": "5e06223c-f915-4bfa-be7e-15a68b250a5b", "value": "T1E9836C53B5D18876E9720E3118B1D9B4593FBE110E648EAF3398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676782, "uuid": "1c782e62-411d-40c8-8302-5b93ee56b30e", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676782, "uuid": "c1dc8b45-f2b8-47f5-9f61-8d6254737c96", "value": "1536:RoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY77BJ9:LenkyfPAwiMq0RqRfbaWZJYY7T9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676782, "uuid": "c8b2426f-4aed-4290-9e0d-fe017bbf0750", "value": 83344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676782, "uuid": "e4f050be-3de1-4ac2-ad1b-e15bc6a5c68d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676782, "uuid": "d9f4b28d-d2c0-4d98-b460-de7a7019320f", "value": "37d509069edf53cb2b606695f4128c684b668e105d5f36683f119d850b888402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2145403-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725694, "uuid": "a7c00944-2669-47f5-a533-ae513b3f8c88", "comment": "Malware payload (EvelynStealer)", "value": "b215e2ef9d939d56e3054ed235a28bab", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725694, "uuid": "576cb016-36a6-423e-9c6b-aec9e993df8e", "comment": "Malware payload (EvelynStealer)", "value": "37e340f144e894e813c9a30612696e86dad22495ac59013db5317167ffbe7c0d", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725694, "uuid": "89d9377c-8239-4b39-9077-d04c84987992", "comment": "Malware payload (EvelynStealer)", "value": "e4ffbd89b910d06f7706544ab92cc2e84148dd58", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725694, "uuid": "fc41ee2a-ab89-4d84-a23c-d769f6a5935e", "comment": "Malware payload (EvelynStealer)", "value": "46d092eef726b21b7945bde10f0d9e8ac72d4717cd086595f1b7178a6f98db0229b1c365865ba4a2eb1046ea70152182", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725694, "uuid": "b989f462-02f4-4e56-b7af-99574e956773", "value": "T155F30906B3D720ACE577D1349ABBE173BA33BC264630BD5E65548A382E11F50B938F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725694, "uuid": "97ee095d-38e9-4f80-9beb-7210eaa2acc4", "value": "95e7d34416b53e889ee2c3f9fdf091f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725694, "uuid": "aba2a859-fa0c-41d2-a285-0a473c00ae66", "value": "3072:MKmOMURgcHsllLoWhb4Kw78ip8wnZw/giCN:MKmdURgQ0oMEKKGwnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725694, "uuid": "2ba8d353-6733-4a57-abc5-8260ad27ebfa", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725694, "uuid": "603942ec-7e52-4fe6-9b39-773c9e59637d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725694, "uuid": "4eacce4c-14a6-461d-ab77-0d46b8dee686", "value": "37e340f144e894e813c9a30612696e86dad22495ac59013db5317167ffbe7c0d_d8206436-d33d-43d5-a6ee-643af9b7af0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60abc0f9-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689372, "uuid": "96bb5f65-b32a-4ea4-be90-1fa0f1326cfc", "comment": "Malware payload", "value": "13a372c926525789c9b72b4389f0ca97", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689372, "uuid": "e8b6839f-6866-4517-aca6-e06004c0532d", "comment": "Malware payload", "value": "37fcfe5600dcbe84119c39b2b0096de5876e1d4ee7f262ad6ff9a34fc6552d60", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689372, "uuid": "ae80b1ad-d60c-476b-a9b4-ba2c76bb092a", "comment": "Malware payload", "value": "5cc2f345a3e53fd15666caaced118dd5c07b8179", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689372, "uuid": "e444111c-ad9e-4d70-9f64-b2704d22f9bb", "comment": "Malware payload", "value": "0a462eca7fea879f4d7e0e22ca9d8836d8d42d3de972915545da8058cacc51f7244b440f27c454abd4581f5bac695530", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689372, "uuid": "ab3fd5e3-32d1-4c36-990e-317daa521c25", "value": "T123A4231787106089CFED2B043A165BF6CACA51EDE52881D3AD7096313D30FEE9666B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689372, "uuid": "92732189-01a3-41ca-883e-b95f0a144fc4", "value": "12288:xbpdKYtarA9UbsbdGhV2ASW4IITvHQooO+nzpfp:UYoA9bGXpSc0AO+nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689372, "uuid": "4353bf35-a57a-4b52-8edb-f747d8059b62", "value": 487112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689372, "uuid": "55332fdf-3243-4908-9905-43c390eaf6d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689372, "uuid": "200cac3e-45ea-4170-86aa-e8c4f7ece487", "value": "37fcfe5600dcbe84119c39b2b0096de5876e1d4ee7f262ad6ff9a34fc6552d60.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116c3eaf-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725746, "uuid": "1dcc7452-7495-4a6f-91ff-7aa235ccd7ea", "comment": "Malware payload", "value": "3940ced328fb743573e03e2ed43c39be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725746, "uuid": "178ddc00-8ca4-4ae8-97d8-ff5faeaa566e", "comment": "Malware payload", "value": "3814491ae90559ef24d7d4c8fbb35870c0594fa7b877b92c93306d0c25b65b7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725746, "uuid": "6ebe0049-642f-4c48-ad96-48a202832a4c", "comment": "Malware payload", "value": "345432f3be1f8f7e2da61b85c398e910b7860742", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725746, "uuid": "ba34740b-a2f1-4e01-9736-aca8cc22660f", "comment": "Malware payload", "value": "9adc70c0f3f41899306093beaa41da884632fae1b30c44439c97fbb3a71dd9fe9efd47e56b20024a316e47a840778591", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725746, "uuid": "2df77fdf-fa91-4c9c-973d-3a24b336f39a", "value": "T16CC35A4772E500BBE5778678C9534A01E7B2B8110B60AFEF47A4425A6F377E09D39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725746, "uuid": "621f47b7-d2bb-46e6-8f5d-6c8ca6909a41", "value": "b4e7a0bfff950e00d188e81796a83b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725746, "uuid": "c469c5d8-fa07-4a14-8620-44111af8f40e", "value": "3072:F/Tl7aPY9s/laeUa9xqQ8oBVgPe6boo/lK:T7aPd/l/tqQVL5Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725746, "uuid": "24e5bb4f-0bbd-4bab-8f23-612e8d37c487", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725746, "uuid": "eae163b4-cc81-44a7-af46-0face8b4666a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725746, "uuid": "3edc79d8-3b65-432f-9f06-0f4f5fc51880", "value": "3814491ae90559ef24d7d4c8fbb35870c0594fa7b877b92c93306d0c25b65b7a_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cbc544-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688327, "uuid": "1431c96e-0d9d-4972-917a-5720ff1cf46a", "comment": "Malware payload (ACRStealer)", "value": "dd0c3638fd75bf70f5f915ac76ee28cc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688327, "uuid": "34c3088c-a024-4556-ada6-c3ac949192b8", "comment": "Malware payload (ACRStealer)", "value": "38193bfb9a38cce2351e1f3ebe6127a5470cca97abf392ee08bfc1c612e94ba2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688327, "uuid": "dba90137-01cb-40d3-8bcd-175f93c30ce6", "comment": "Malware payload (ACRStealer)", "value": "8fb555a5a7bf90666775879e1f7d9cd0fba6f54d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688327, "uuid": "889cc8a3-aec4-4982-a7a7-7014414cca08", "comment": "Malware payload (ACRStealer)", "value": "f975cec89860b10c1b2796c19419f8f71048a3b05b6576fbfedb68f56143586e948d67be5b8eb3ff59c3e60a2eb27ce4", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688327, "uuid": "1f2a763b-4186-4037-995a-047e2ba64a24", "value": "T11B169E1BFCB91C5DC09AB13484736506F975B8046B2267C72AA0B6A42F7B7E04FBDB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688327, "uuid": "444d85f1-36e1-4542-aa9d-380d5684fb4a", "value": "2cbb1ed688f6524621907ef7e95a96dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688327, "uuid": "13655393-d1de-4fae-8fc4-61f9e70c2f98", "value": "49152:1Il3RsGzr1K0x721JJVy9Fr5hQj9IBzNb8fRrlW9f70JuRCaj1FQcWeAgOyspn:1o1Pwz1priDYuuKAgvspn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688327, "uuid": "7ee87947-5138-41e9-969c-bf459343c5e3", "value": 4337152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688327, "uuid": "cda1f19c-87fa-4318-9d72-4a03405d7ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688327, "uuid": "61a193b2-486b-488e-a826-31a094d0b4e8", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ded4d1-3cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776689696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689696, "uuid": "b7f5158b-82e6-44d3-b3be-b45025f90c9b", "comment": "Malware payload (Vidar)", "value": "9b110e6ef3cb15675a2950c0f8f7a276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689696, "uuid": "b33435b9-d3fa-44bb-881b-c3d2f5defc0b", "comment": "Malware payload (Vidar)", "value": "386f875d57baf3300ec753304d2dd09b4cb68278f21640dffea631796ccf558b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689696, "uuid": "234d100d-8235-46da-9b3a-90a6adffec64", "comment": "Malware payload (Vidar)", "value": "e3fb4edf7cc4192f354539f7b4a0474ea9818550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689696, "uuid": "4ba22a7d-2294-4d80-8ccd-5975fb24b41c", "comment": "Malware payload (Vidar)", "value": "32fda1e41eb1020b1aada51630b7815cfd3a71eb01b90982b1d8845aa8b5ca678b826f65f27906244cbaae5491ec2637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689696, "uuid": "30aa661b-108d-4799-b010-5416049e3551", "value": "T1FDA58D1B7CD118B6C46AA3338CA662A17B31F8190B3273D32F516B782F7A7D05A79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689696, "uuid": "8875df26-d8d8-4bea-b4a8-a5854184bd7a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689696, "uuid": "06ec960e-5b06-4e9c-b178-39d6c78461a6", "value": "24576:Jcq17HFltD0PBv+y/gsTpzr7K6LEM8pShMXH1hass5J3G9GizstVVWoU9:JcqxHFCBv+y/n97MpXXy3So7VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689696, "uuid": "84eaeeb0-78e9-4332-8a75-eebb20d245a0", "value": 2132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689696, "uuid": "da5c4047-b7c7-41a3-b94a-6ae1f54870a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689696, "uuid": "2a254c9b-6ab2-481b-ba65-aced67af28d0", "value": "\u0412\u043e\u043et\u0430\u0440\u0440\u0435\u0433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173d9849-3c83-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776666915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666915, "uuid": "53ac78d2-7234-4682-bcf8-79a75046d0f3", "comment": "Malware payload (ACRStealer)", "value": "42954d188d8ed2cf8c9e1f20c36baffd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666915, "uuid": "00ff2c51-cb31-480a-aa49-f908fdbf5795", "comment": "Malware payload (ACRStealer)", "value": "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666915, "uuid": "b4cb090d-5e73-4792-9c9a-6d725357809b", "comment": "Malware payload (ACRStealer)", "value": "7e65f7901aa4586c24bde6fe7bda5ce85418adca", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666915, "uuid": "5921b187-0328-4ac3-81b0-f976f04bc191", "comment": "Malware payload (ACRStealer)", "value": "7581f5e851506479f037a0d0417955d450db38804cddc2dc77d9f85e313489c5d9003d0760a7f19703262133e6cbd72a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666915, "uuid": "05db2d3f-e349-403e-b23c-308fa45c3773", "value": "T127168D1BBCB91C69C09AF13484737605F665B8445B2327C71AB0F2682F3A7F25AF9B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666915, "uuid": "0a80d86a-bd0c-4850-a909-0f3482d9bb2e", "value": "22e59ac5cab9839fda1ed6b8c9f8e6bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666915, "uuid": "c8725286-35c6-4045-918b-6fe84bea7635", "value": "49152:k2i6oxMcTe5mFjZQzJs7mOukEr69AriPp7qCuu39p+jPJjYQcQ7s7:k2o7EggPjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666915, "uuid": "d45dd777-76d3-4a10-89ba-a39cc7e76a04", "value": 4276752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666915, "uuid": "f81d95d5-e9fb-4028-b1f6-d93c246d2128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666915, "uuid": "d480366b-9d35-4755-ad79-7545d1572ebb", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9232ac7-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725705, "uuid": "c1e13e10-a42a-49b5-a36a-f30c8a5121f6", "comment": "Malware payload", "value": "7d833e6598f5c6b38e419ee2c78193b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725705, "uuid": "b3092bd3-656c-4f4d-9b9c-66843a0d2ad5", "comment": "Malware payload", "value": "38b4d80cb2b985600d98485b0329beb8d93601cf0358ecdca3fd55e4c307af27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725705, "uuid": "b6bf8d92-093f-4b08-a5fb-9a188f90aac7", "comment": "Malware payload", "value": "7c9da73f823923a3d0f956165de9697059e74a71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725705, "uuid": "e85be5d0-f27e-43df-9207-16793e41f099", "comment": "Malware payload", "value": "f0124d0dc7bc5ddd3881cc09150ea3309c1e70524e75b8c7b06369b1514acf557e34dbc43de896166fb4df1ae6e333ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725705, "uuid": "4223f412-913c-4212-bd6a-5ea39af38eee", "value": "T15CF57C22B282D837C03727788D17D7E86829BF206E7459477BF43E4C6F796913929293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725705, "uuid": "bdb1332d-b1a4-4e1c-bfde-c5c2a0354e2b", "value": "f1a1c0c54747443b150efbfe9e19bb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725705, "uuid": "13aa7a96-a956-4659-808f-9a622d476d4c", "value": "98304:/c//////d+YTlVUzlFxr8/yS/t7W5TMuKF7Z/:oHl2p3A/ySs54H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725705, "uuid": "897b99a9-a2f9-45af-96b7-62ce7695f293", "value": 3442688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725705, "uuid": "a36baa1a-09b5-46dc-a987-0cd38f964646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725705, "uuid": "4c426a69-2865-4007-9923-2157e0161d07", "value": "38b4d80cb2b985600d98485b0329beb8d93601cf0358ecdca3fd55e4c307af27_adab16f6-41ec-46d4-9831-82687924db3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139e96dd-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687525, "uuid": "ef9c12b7-e8b9-43cd-9c19-8607166720c8", "comment": "Malware payload (Mirai)", "value": "60a42b59cb302901d4e8d7ba6028513b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687525, "uuid": "274955b5-fe14-4fde-a3d2-86771027f473", "comment": "Malware payload (Mirai)", "value": "38dcf933f2c42327138226367ca334e098e0500ddae0319ead11b2a92cae4c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687525, "uuid": "14f3a79e-f651-493c-81ba-d11a60f5d731", "comment": "Malware payload (Mirai)", "value": "3620be48ffecb56df67b37a083805bbdb28a58f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687525, "uuid": "426a8f37-01df-454b-8d49-c6b9c8ba1264", "comment": "Malware payload (Mirai)", "value": "c12ba87d6c0b2c55809060c0caa8559fa8cb52c3c5e4d64d56c850198146ed53e1f5cdd772b58b1d710cf08d5aba0694", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687525, "uuid": "ae70f83a-6e45-4bd9-b091-94a75c26e682", "value": "T1BA430852BC818A05C5D412BAFE2E11CE33136768E2DF72139D106F247BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687525, "uuid": "9dc79895-0ab6-4aa3-a8bc-38759b5c05c1", "value": "1536:ZVnsP+SiPuXJEbiaNV82/rKGpoSEpLWIxibJgwKWFR:6kPcmi2V8M3pZJgwKWFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687525, "uuid": "3b14b175-468f-423f-8df7-738d9b536f36", "value": 59680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687525, "uuid": "6d174816-2361-4b9b-9488-e083355ce09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687525, "uuid": "cde1a6ec-6614-4c82-8a7a-ab20d6a0180b", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40545490-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724536, "uuid": "aa3bfd0d-38c0-4c54-b896-c23fdf97646b", "comment": "Malware payload", "value": "512c1dd0e7496be9202abe08f4c38b20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724536, "uuid": "e4387157-08f9-4095-92f0-b21f4c63df2c", "comment": "Malware payload", "value": "3908d551858e61ee945c8b070022cae282a3fa377e08ae7b0d94916183756c0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724536, "uuid": "f6974eb0-a5da-412a-b0db-58ed9433eab5", "comment": "Malware payload", "value": "f8c9979851294a7db33cfb9b57b48d1f82bb1fa5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724536, "uuid": "3bcc1ccd-00b7-4e21-b6b3-466e4ea95dd4", "comment": "Malware payload", "value": "f342544ba1b95e5ba5b1c28cc9430a8ac53049d2b7083a666a64852b7526aaa20bcdbcfdd8c9bda28957dc94ba112fe4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724536, "uuid": "c8a53a9c-4b69-410e-a065-cb5dc4f0132a", "value": "T128B35B4B63E900BBE1778678C8670A06E7B2B84107619FEF47A0865A1F237D58D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724536, "uuid": "b705bd58-c0ee-4b8f-a994-5aceea24f334", "value": "0e598da1f6960a365cb8ec24b056e82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724536, "uuid": "6a77ef95-5054-49c1-94d9-23d7a3dd87d2", "value": "3072:qFNnYhU3TJqneiGecQbh5dn9QntSVQq1niT:cTon3SMh5Z9CsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724536, "uuid": "c465842e-e8fa-4d19-80ad-47f6217f1c7b", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724536, "uuid": "c825e4bc-6162-4690-918a-f56c5a6abec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724536, "uuid": "c1db13e4-cb4d-40ae-aef3-55abdf270b33", "value": "3908d551858e61ee945c8b070022cae282a3fa377e08ae7b0d94916183756c0e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15095ec5-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689245, "uuid": "25b50164-611c-4ee2-99a2-61baeca5a496", "comment": "Malware payload", "value": "16027a8c74216f95e605e76efecd8f7d", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689245, "uuid": "772b027e-8aef-47ac-9741-cfaebb3b30de", "comment": "Malware payload", "value": "39781b4480850b78d8e644e53c581081d40c2a2761cafe3c670e0b06fcd16a7a", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689245, "uuid": "a1d04dc7-cf46-44e7-9439-1c0b75bcd5f9", "comment": "Malware payload", "value": "3b4e77bcb96b44eaacef5ab9437876705ca6276a", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689245, "uuid": "d266058d-c299-41ca-b524-7be93ab31466", "comment": "Malware payload", "value": "397d04b9425e67ef14e4b7b00bc2245eaee1d7712f61562994be477ba07b633b2f159892ddec3af0cf39887898f8581d", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689245, "uuid": "31a368e3-c725-4b23-91a1-87690dce2159", "value": "T16025A68926DA05BECBAFE33A8602305FF62037E1532047A7165A4F4A3B7797D663D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689245, "uuid": "15dd2864-80aa-4cdc-bb50-c48167544e3e", "value": "bdc67eca7b3fa4969a9e1c93c5f30b62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689245, "uuid": "e23f99d2-6b37-41fa-81b7-8230be20563b", "value": "12288:Z9EoGZhMnhfai1FQO7sqr4ExuzbOBpeTgLp:Z9EhMlfFJsqZuzbQpeTg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689245, "uuid": "cbc307ec-c43a-4e44-84b6-e8c52b62d074", "value": 965392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689245, "uuid": "f6adb596-2a25-42e1-b95e-d49cc839b470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689245, "uuid": "6ad4ad20-655b-44d7-9fe3-b84e1d9ee8e9", "value": "39781b4480850b78d8e644e53c581081d40c2a2761cafe3c670e0b06fcd16a7a(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8d94be-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725069, "uuid": "53717d7b-b92b-4e2f-82a3-7e3c6e4a52be", "comment": "Malware payload", "value": "5167a184f1ed22b89872070e6ead7d89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725069, "uuid": "992e7e3d-4454-4584-86ce-062b5aafbc76", "comment": "Malware payload", "value": "39825ec2d64d0187c76ac8ed8f177ddff0bd1e50f6b95b630beaf897def57bf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725069, "uuid": "ead2fc9b-536b-45a2-92cf-7941fd7d0777", "comment": "Malware payload", "value": "4eec4c94fa468e2450fa3030b446865033be6d0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725069, "uuid": "deab0f59-9971-4ed3-8189-b613bb02c12d", "comment": "Malware payload", "value": "b7dd1e6fb3ffbd675805705f8085c67f49b9288e7f9182e4dbec42249d0337ea517be66fa4a098eef08574fbff59c1ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725069, "uuid": "13792ceb-ac7b-4ce0-813d-aa4b3c3fc625", "value": "T1E5A34A5BB3BA40BBE1B68238C8670A45D776B8455761AFEF43A0425A1F233D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725069, "uuid": "4aa4f96f-b2c7-4f79-8e0e-cceb56a02415", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725069, "uuid": "efb4e6f7-0014-4e40-8bc2-1a926b60e838", "value": "3072:iMU5V3RNUOiGyAQbnA8i9tvoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHXvGO4:xe3bUT+MnA8i7vqTVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725069, "uuid": "58171c23-d9d6-41de-9762-da426836b927", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725069, "uuid": "a1261fc8-8bcf-41ea-b265-b14b7a108b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725069, "uuid": "dcc91412-9576-412b-914f-f0ee9d43df53", "value": "39825ec2d64d0187c76ac8ed8f177ddff0bd1e50f6b95b630beaf897def57bf5_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fc29f2-3cc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697278, "uuid": "f37042b1-d4f0-4c1c-a210-9e9a0fde7a20", "comment": "Malware payload", "value": "1308aa6ec0692e5f5ca38fd062b2048b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697278, "uuid": "8bebe91e-0eaa-4fa0-918d-40a4fe946298", "comment": "Malware payload", "value": "39ee98cf2d59f364b061c80fdf3b8f63686cd9769fcd1426d576ee6087f13dde", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697278, "uuid": "529f5b5c-0e73-476c-b5ee-5c50b9b53e0e", "comment": "Malware payload", "value": "bba1924750578e7ba9d92951227c3b2ff47ae260", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697278, "uuid": "a08f74fa-3367-4992-84f7-c5486c9fcb60", "comment": "Malware payload", "value": "8f789d1b8aeb68e2830135fb516e11c8c1547b3588cc2bfbcb3ec0da9086b3f3cc9bc57d710b75a0c4aa0083d347d0c1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697278, "uuid": "48550138-bee5-40d1-acab-3a12e61a0038", "value": "T11544AF5D58D26AAC9060C1118EE1F878ABC38FEB4BD90DC6E560D0A6BA94C337DD173D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697278, "uuid": "9503e971-efa0-4df0-9381-516cdf823d0a", "value": "768:KuIy5fVTHaeB2y5fVT0lMqeeB/PAQ2PsLmYIVsSW61yetlMqTPGmPZlMq2Q2PsLr:KJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697278, "uuid": "e8f40c26-1ac3-4f6e-8206-7a6d399ecc44", "value": 253835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697278, "uuid": "4bab2413-108a-40ef-a3bb-d811d9172c71", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697278, "uuid": "df3a90d0-905e-4b00-9b70-73ebe196d690", "value": "newgoodthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba336002-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725170, "uuid": "1977f1ce-0c19-4cc6-816a-0588adace360", "comment": "Malware payload", "value": "bd3885b094be1ed937b5ce132bcd31e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725170, "uuid": "a91de40f-7462-40cc-b9c6-fe60a4d2c2a3", "comment": "Malware payload", "value": "3a4eaeac7fed3f87f58ca0eeade43079b3426b5f1b0f1f16490103179ac69fb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725170, "uuid": "29a62fef-fa5a-4433-aacc-9c1f8041231a", "comment": "Malware payload", "value": "8d2bcac77c856a278a12509f8cc9cb5d12dc5f27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725170, "uuid": "f9843d6d-c929-4c32-97a3-d4a310b6e129", "comment": "Malware payload", "value": "eab615ecafb5f049b43b4663b1893bc88673e8a2c2867d22fd89511e4b14f86a3371a8e6c4dbf1f1809069fb5b1a0389", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725170, "uuid": "2493ded6-0c4c-493d-89f7-bc3e3cb0c6c6", "value": "T19A340990B681FDB6EC998FB821D25309E3B6F0819719EB2B6720FE3C025EB54D473645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725170, "uuid": "517e1439-5c47-4e35-b5c3-cab1e94529a7", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725170, "uuid": "6f6356af-bc47-4ce1-b678-ab7d8dc9b41d", "value": "6144:LNZ7CagDS+zKnk42YKVu8HyAiZw2juruWyA:vC9G1kzvY/hNNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725170, "uuid": "8a456d2b-0819-4536-ba06-c88b0c588d9b", "value": 236050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725170, "uuid": "78641ebe-52ea-49b3-890d-6d96ae3ecd4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725170, "uuid": "f5909c18-fdd5-466d-bbb4-df3098c46fc3", "value": "3a4eaeac7fed3f87f58ca0eeade43079b3426b5f1b0f1f16490103179ac69fb9_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72961bb-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725192, "uuid": "9d04d421-b9d5-4f45-af1c-e52d14ec5c29", "comment": "Malware payload", "value": "95f4b8fda73c514b635f6054e47bf31f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725192, "uuid": "cf2b9f8b-2f6c-4263-8dfa-c071de26a7b3", "comment": "Malware payload", "value": "3a528fa0e2a459a527ff0261ffa696ee22fcab358c0bd4ed0e73f6cfb1994489", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725192, "uuid": "2eb55a86-32d6-47f1-8f2c-8ca310821023", "comment": "Malware payload", "value": "58f9b3c9945f23c6ec998bdda811feb7821c8888", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725192, "uuid": "c3018caf-61f3-4c15-8d35-f3e396f27ec8", "comment": "Malware payload", "value": "188aa2aa8d41b7b9b1d0f07b48d0f1a0e465caff8601faa4020a7a6c7034a4f7bfd22db537fb36f6cb3895191ecabfb8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725192, "uuid": "908aa53f-4c86-496e-97d9-97b8a8ef1861", "value": "T1E5A3395BB2B600BBE1B7823984670A45A772B8514760AFFF43A4469A1F273D18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725192, "uuid": "5e86a24c-c39b-4744-be57-1f5c799f51fd", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725192, "uuid": "46b524c2-386e-438b-b1bb-790db5ab3523", "value": "3072:PbDfBxo+I/gQVOogRGsGm6TpIS/GWmATME5JAST/2njLhbC3G1XSzoQsruGdQC:vzoMMOogsszPduvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725192, "uuid": "72d95a22-57a4-4c0c-85ec-b47bf7618410", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725192, "uuid": "51ef315d-85a2-4a54-a973-3fdb94e1cbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725192, "uuid": "25a43db1-5ef1-4559-b2f7-49ab46378db1", "value": "3a528fa0e2a459a527ff0261ffa696ee22fcab358c0bd4ed0e73f6cfb1994489_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73aea52-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725675, "uuid": "37e64494-30a5-4831-8d19-fe1e2f62e241", "comment": "Malware payload", "value": "ffc6a102f2bc94786d2aee273a1ed53b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725675, "uuid": "8711ca24-0ead-49b2-a165-d03b8db9e709", "comment": "Malware payload", "value": "3ae04e79172b744d8f56b3b9256a1427c404afb0621c3436a3e8d42178825d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725675, "uuid": "c107f86b-a3f5-43b6-8f80-e46e2e090654", "comment": "Malware payload", "value": "f8a2e0a5dc0ea6e72ec1a2fa7a552347f24262ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725675, "uuid": "081694f1-3bb1-4fe9-960f-c731fedb985a", "comment": "Malware payload", "value": "d201ed1b84adebf18c84eede6f147791d1968ea9530dda7de57a1235ee55b86b2ab243820441e23ccdd6113a4483197d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725675, "uuid": "3ec12c17-1ff4-4592-adcc-dd1a68ccfeab", "value": "T1E0667C13B2CC613AE0BB1A37597BD744683F7A602A19CC8E7BE40D4C4E39A416D2775B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725675, "uuid": "33c4e403-dec0-4b3f-bf75-994b1eb18ac5", "value": "fbb3e5796026f55ddc3acedfbc1a61af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725675, "uuid": "5805c54f-d16e-4eb5-accd-2034f5dd3817", "value": "49152:+r/GPTFnajrsL+p9Ssnk0BVhZI8V/I9OOqjoyfyHFXHbVIUt5PxRChagvHzA3WfN:+r/kFacnehZI8iYmyfAXmED//S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725675, "uuid": "03d7a1dc-d5b5-493e-8110-b8fdf8ce4c43", "value": 6536704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725675, "uuid": "150fd349-7f0a-4169-b5d4-3e83f38a27f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725675, "uuid": "3ef6bf37-eecc-45a4-bdaa-780625d2279d", "value": "3ae04e79172b744d8f56b3b9256a1427c404afb0621c3436a3e8d42178825d25_c0d05127-8067-461f-9f1f-928fc9bc243f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b35606-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725777, "uuid": "ef46afd7-5eec-4316-8dde-2803ef66761b", "comment": "Malware payload (AsyncRAT)", "value": "91954b41a5ed42fa60573967fd1bd29a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725777, "uuid": "302bf6fb-68a8-457a-9cfe-984358d72ded", "comment": "Malware payload (AsyncRAT)", "value": "3af1da74264645a07ba3647eed9f7641cf90e3abbc1df83fbbeffbdf157e7c2c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725777, "uuid": "c5e9822e-0447-4c90-8e72-4388b725ad55", "comment": "Malware payload (AsyncRAT)", "value": "28e316589c921af93bda3059f64b9d2d0ce00ee2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725777, "uuid": "acac7791-fdb2-4020-8ec9-c12a2f9ef838", "comment": "Malware payload (AsyncRAT)", "value": "706ace4f9c4de1e928e2af4c63a7f8f7599496e8b637d03e2f52466e64f0e4335a1b222c9b68fadd57029776198671bb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725777, "uuid": "6b3dbb95-9f18-49e4-87fb-25468ce42167", "value": "T1F9A34A5BA2B600BBE2B78638C4574A49D772B8414760AFEF43A4425A2F237D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725777, "uuid": "530a7f23-54a2-4556-ac36-344665c46bd8", "value": "75bd77cb82e3a8826ea92f57fb3fc322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725777, "uuid": "0308712d-b3f7-48bd-bb05-20c99197bd9d", "value": "3072:OT/LmfnOFGEtQbCQHvV1atdTj5YiPWm2QjcUJZQijPG3zbHTvk1pHMoFKPy:cL6ncVMCQPV4hDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725777, "uuid": "20fc408b-d9be-4da1-b591-3ff4be98024d", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725777, "uuid": "5c6eeb99-76fc-446b-bcdb-4ebb990b5ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725777, "uuid": "6b036d01-521e-4797-bada-d42724f9c3d2", "value": "3af1da74264645a07ba3647eed9f7641cf90e3abbc1df83fbbeffbdf157e7c2c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cd74db-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776697759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697759, "uuid": "e22a3ca3-054f-417c-801e-f85a8987adf6", "comment": "Malware payload (PhantomStealer)", "value": "d7052ed3e3800840f721258e37300972", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697759, "uuid": "de0024b6-21ca-4b82-8657-2a2ec015abc9", "comment": "Malware payload (PhantomStealer)", "value": "3b54c796eef85bde16c8f7f4f9d00946358f919084f4652239adc894fef09cd4", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697759, "uuid": "5d7bb5a8-2ade-42ad-8715-f746ccf38358", "comment": "Malware payload (PhantomStealer)", "value": "e01c152cc6ac47f649eaad239217fe78e066f076", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697759, "uuid": "93bbc3d8-3c09-4493-ae14-52d87c46643c", "comment": "Malware payload (PhantomStealer)", "value": "978e3c15c281677d1a160b175b8e141db8bedde899773d296eafd9b5049b5d9740ca46238eaee6318bfdb7036ca5dbb6", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697759, "uuid": "85134988-0294-43b9-9871-6a7597c84bd6", "value": "T1A1D52D10D63CE3C0143B54E6D80D2EADD4A293678DB09751AB2DA6CCD0B6C62F5B5ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697759, "uuid": "0770e218-77ab-409b-85c1-0fd8ee339f11", "value": "192:c0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0:Yg0aCcuiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697759, "uuid": "41399c9d-9106-46fc-ad19-08a2375b88fe", "value": 2776591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697759, "uuid": "287e8f45-cc55-4851-b02a-4eb2b52fb2ca", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697759, "uuid": "e01762d3-2f27-406d-88c2-b2d40cdca6ca", "value": "TransferCopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0085f590-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725718, "uuid": "2ec5c160-0a9c-42ae-9580-329001a389d0", "comment": "Malware payload", "value": "dc76d20568ea56e8b9d9738258ecb484", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725718, "uuid": "3389c83f-4ae7-4e82-ba8f-cbbe4352998e", "comment": "Malware payload", "value": "3b95e76c37a72eda5493f659f21ef23a507ccaae946ece142356d326771c2fff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725718, "uuid": "c8a9f7be-7995-40c0-ada5-33f11a86d85a", "comment": "Malware payload", "value": "f6bb6ceb4f9adce06fddb0205f8679b03b37b23a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725718, "uuid": "fec58a92-2e1f-4479-a5db-c22bfdef622e", "comment": "Malware payload", "value": "f4f4d0f59e74361206eb950a33514022dc872f360db1e58e4648ed6a26860009ef4c029c32f292cf3b61802d3e81cb85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725718, "uuid": "21293888-9c7a-4e3b-bfb4-6aa2061e427d", "value": "T1E7A34B5BB2B600BBE177863884570A49DB72B8454761AFEF03A0465E1F273E19D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725718, "uuid": "1f81e869-6378-4cdb-b128-216ddc28c544", "value": "1db8242845956bba39a653cbe367a0dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725718, "uuid": "5fb1c8e5-1703-44bb-ad16-73a827810fae", "value": "3072:rwT2rozS/j+GGuEQbhAD7GWFnATME5JAC/T/2njLhbCDvmSOo2iePG3ufWC+vrX2:pou/jLyMhAD7dU+Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725718, "uuid": "a6f24031-0d3a-4b82-9397-9729ee914164", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725718, "uuid": "d78aa114-97dd-43b9-9780-f9805c1f31f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725718, "uuid": "897434f7-cdd1-43c2-9f94-d2459c1422d9", "value": "3b95e76c37a72eda5493f659f21ef23a507ccaae946ece142356d326771c2fff_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4568832a-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725833, "uuid": "441bf298-0e5f-4397-bfee-88da92b26a7b", "comment": "Malware payload", "value": "8346343cd04025a4ac05649c0de8eb2d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725833, "uuid": "c262faf5-2423-4d74-8cab-9efda87c3cb3", "comment": "Malware payload", "value": "3c6863139e2679a5f53f0c43f7d74cde593dd8aa0349f38e6939849f02fcf7fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725833, "uuid": "be14dc9b-49f1-425a-8100-1520695d23cf", "comment": "Malware payload", "value": "59f4f0cef9dab8af59661c61e6243fcd09c03249", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725833, "uuid": "c575fc5a-7231-4cfb-9577-928f88b91ad4", "comment": "Malware payload", "value": "89e9eb013b300f2cbdaa40f55e4dce18d3c3b1fb6752792bb85ae9d2daf70795ac186ee91e97222c4f3fb3fcc5b6262b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725833, "uuid": "f28f3cf2-4127-4383-b370-55c37391e352", "value": "T143A34A47A2EA00BBE2BA8678C4530A4AD772B8551751AFEF43A4425E1F273D08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725833, "uuid": "a163662c-e697-4c10-9dec-8567bb7e7045", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725833, "uuid": "c4679267-be4b-4226-853c-6ccfa29f3e56", "value": "3072:7iTeXQwDasaAmiTQhAS/xYN0n51756565rnIryHb/C1jK:QeXbuFaTcAS/0JHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725833, "uuid": "323a08f2-ce36-4104-bd38-f1dedeb5e615", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725833, "uuid": "a6fcaf5f-fd5b-4aeb-8b17-3109cdd3e310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725833, "uuid": "97da2204-0ec7-4c30-abfa-8fd1136604aa", "value": "3c6863139e2679a5f53f0c43f7d74cde593dd8aa0349f38e6939849f02fcf7fe_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5826d0-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776665662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665662, "uuid": "57d09f0f-692f-4499-8e7d-d463e2de637e", "comment": "Malware payload (Vidar)", "value": "5a82c8bfd42c73b6681bf86cdd2a2b34", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665662, "uuid": "763dc9b4-7257-4753-83f6-d3c5c3181db9", "comment": "Malware payload (Vidar)", "value": "3ca8c4b0ef312b54887a08e695a784671117af62549d25a8424fb3977495b2cf", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665662, "uuid": "8262482e-eb11-42f5-9dc2-e37a33dddcb3", "comment": "Malware payload (Vidar)", "value": "5fec8a8db3cd19b32e85726a35044ce1b98d9105", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665662, "uuid": "79a2b080-58f2-4c91-b509-33bf1d2053cf", "comment": "Malware payload (Vidar)", "value": "e7a1aa64b3409f6f5029386aa761d52e400582922997eae5e625f1bec6db6ceba80392d5d80bc0a40784d4958acec49a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665662, "uuid": "bf0e5ccc-72ad-4d91-a0c6-42e1a6bc3781", "value": "T174B60237B28A673EE06E5A3B59B691105D3B7A21A41E8C16DBE44C4CCF2E0601E7F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665662, "uuid": "28771c92-d22f-4d68-8ee3-c81bb733da3a", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665662, "uuid": "41a0adc7-2361-4864-949a-0dfc268a4c30", "value": "98304:3N66F2deAsfGAoAtxQqBLJ1uZ/wdR/+UDeluQ0O5+czRcO6X7:PQdT1F0QqdUI/+U6u4yX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665662, "uuid": "4c7e09c9-4879-421d-9c0f-626fb92c604c", "value": 11377230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665662, "uuid": "41a8045a-92cc-446b-8b63-aa93e7ac766a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665662, "uuid": "bdf4e752-5e0f-48c3-8188-819e4d4000c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa2ef02-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724929, "uuid": "94164593-6256-4acc-91a1-7f9911413323", "comment": "Malware payload", "value": "30cb81dde3bf852c181f070e3151478d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724929, "uuid": "f20a6c05-4e52-41e3-8224-a94cadc2cc8c", "comment": "Malware payload", "value": "3cdb760342bc041252efe74188ba8b106b10484a3638b0a2d33830016611a2c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724929, "uuid": "f4f6f5a9-66d7-45d3-a86a-1669feff9f8d", "comment": "Malware payload", "value": "29f48866e8e48783b65066c85f59f49a90d3eb89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724929, "uuid": "33d060b9-ac50-4863-b9a2-6646dab57401", "comment": "Malware payload", "value": "96127e43d2ca941f15c0498b186c2e9415216c92ca3a5ebac5faa87a11bd479234412d2a2587c9a0b298ac321ee6844a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724929, "uuid": "79832cdd-fb45-4d68-8e46-3e0e972966b1", "value": "T1BDB3495B62A900FBE5778278C4630E46E7B2B85217619FFF03A4421A1F277D18D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724929, "uuid": "3ba3c786-91e6-49b9-81ac-0acc856cf7cd", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724929, "uuid": "0e30776e-caee-4d4b-9944-40acd344acd0", "value": "3072:9dgy+H5TrW9XplYiRXx/ANtqBzU23TBiMrWQ:1+ZXWJZRh/ldDB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724929, "uuid": "d582d529-09b7-429b-b82a-607a7fd36bd9", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724929, "uuid": "39c828f9-86ed-4ae8-8979-7f18729c7f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724929, "uuid": "f48dfc9a-d260-400f-a0cd-d4e2ffd8e92a", "value": "3cdb760342bc041252efe74188ba8b106b10484a3638b0a2d33830016611a2c8_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50399f33-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725422, "uuid": "b1d85103-722b-45a8-9190-5be355c88225", "comment": "Malware payload (AsyncRAT)", "value": "2bbe036639a5aa6227327080de0f7c1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725422, "uuid": "7dbb215d-52e9-4046-ab3a-4f550703c3af", "comment": "Malware payload (AsyncRAT)", "value": "3d011472e7158040f92acf77ca3fcd4ad0ca7491b9211c912b9db6aab6568540", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725422, "uuid": "b2d1b62a-80c2-46b2-8e30-a308f60f20ed", "comment": "Malware payload (AsyncRAT)", "value": "d9a279038682721a07224a3f524f616f38fb0761", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725422, "uuid": "e2ac7ec0-b3fd-4f42-a095-33fd8cb180c8", "comment": "Malware payload (AsyncRAT)", "value": "9eb9cf9bb4090c94b638264d29e8a485e1b3e00912a3cc16af76eda27fb54cf5b69c105b2d397ced36b7a7b1c9887144", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725422, "uuid": "2dfad908-de69-442f-bd6c-47796f614751", "value": "T129035C487B908211D6FD6BF51AB366430730F6078E13DB5E0CE496AA1F577C4CE417A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725422, "uuid": "17f995e2-b084-48d5-9706-796ce842347e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725422, "uuid": "93921cda-3535-49c7-b48a-ac3f7b8023c5", "value": "768:6q7IMhBA/S/0B50guqZI9x7FWPr9QZ9OwhoanHFS:F/Myc50gWFS9QTOwaGHFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725422, "uuid": "0771419f-bd0e-42d8-bf4b-78125c2d787f", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725422, "uuid": "7ce351de-0905-40cb-9b74-57060332b0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725422, "uuid": "c2c0ea08-098f-43a0-9e82-da682ee4605a", "value": "3d011472e7158040f92acf77ca3fcd4ad0ca7491b9211c912b9db6aab6568540_7cba213a-4c92-469f-9c80-5331c68fa660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16ba434-3cdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776705426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705426, "uuid": "61a71d79-337b-4233-b7b6-f2cb09c48f27", "comment": "Malware payload (Mirai)", "value": "43b2034ab55790cf5f96f98a68fd3557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705426, "uuid": "2703ca01-b5a1-4b7d-8973-e06ea84c53c6", "comment": "Malware payload (Mirai)", "value": "3d0bbe57017f5aa681436d8b8da92ab8f2bfadf41b2204ded49a8d2b4e5483a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705426, "uuid": "a00faeca-ca5a-457a-9084-effd669729a8", "comment": "Malware payload (Mirai)", "value": "06b13024bef606078ee5f28e7bc018d669f0bbbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705426, "uuid": "20a7994e-9da1-479c-9aba-bbb7c701061c", "comment": "Malware payload (Mirai)", "value": "e6fc423b5dfaea5e5d44d257d812e8936ab8453061dcea2792f31875fda864c9fddb9d78a6d166ba9298f7a69dca941c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705426, "uuid": "9fa6cf42-4a06-49f0-998f-96823a48c296", "value": "T16403E0E87750458CF09890B99B280FA09F3665B191039D5A112FEDE23CE62D23AD7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705426, "uuid": "6ccff6ac-2e88-4c4f-9896-f8c0d5b9d3d5", "value": "768:f9ONCCY3T7yDdWD3eBIo7kF3i/MyEbkP/7cyK8kZjxo7x47GJgGlzDpbuR1JG:A3Dd2R3eAbkP/7cyK/jZyVJu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705426, "uuid": "c0df4b21-0028-47cb-b448-a1b6b3de63e9", "value": 38240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705426, "uuid": "bfccdfbe-1021-42bb-8cde-26cba7e97cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705426, "uuid": "fbfae670-9cf4-40d5-8844-f77c01e7050d", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899f139b-3c5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776649927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776649927, "uuid": "256aa580-1a2a-4d32-8026-bd8a6c0f0a00", "comment": "Malware payload", "value": "c2967c4127792a50c478ec4fac55aaa0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776649927, "uuid": "4d6a12a3-21a2-4953-83b5-7e657f22c10a", "comment": "Malware payload", "value": "3d8798a988ea07195da2b3c1d465c198159d2aa33a19ac005a7b9e6797659426", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776649927, "uuid": "161df00d-c974-491c-a159-1abdc84f2e22", "comment": "Malware payload", "value": "e21696461aa21b51f4d8c066c94b8912043e2eee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776649927, "uuid": "4e960f5f-8bba-4409-914d-8731ea487e22", "comment": "Malware payload", "value": "2701907e8c60a3f3c099bfed27ac9f3acbab34e416a8367b2b8b385d776eb7b3b0a43032dc549bb1f0b21c6a9b321581", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776649927, "uuid": "5cd98d40-71fb-46c5-9642-3aaf192d2abe", "value": "T114137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776649927, "uuid": "f5b85adf-5999-45a5-9b52-c8f519eb0182", "value": "768:br+39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:br+Aco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776649927, "uuid": "2585c78d-2f02-4058-ad75-f1d7579f3672", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776649927, "uuid": "ca8d9f76-38be-4654-a75d-a41652d74459", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776649927, "uuid": "6409d2b3-b955-46df-8853-17624f39e43b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1ce1f9-3ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776710925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710925, "uuid": "37504d8e-8f03-4f53-b033-89c8297a0f65", "comment": "Malware payload (Vidar)", "value": "e982520e380991d0717088c052f3e69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710925, "uuid": "d7058ca6-5c83-447e-a9bf-2c0a051955e2", "comment": "Malware payload (Vidar)", "value": "3ddd8f09dc777f42558989e0e32631982ecdb93300dfbd7f9bbfb8f462c14022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710925, "uuid": "9209689e-7a24-4e08-8a73-6ede5f1072c8", "comment": "Malware payload (Vidar)", "value": "1e1b3f9f9234821bd72719f31cb43639c501dcac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710925, "uuid": "b39a3a79-7e12-4c23-a0fa-46210a4ba9d0", "comment": "Malware payload (Vidar)", "value": "a8891667fec2882e481625d906f5d5ed0e22835a0978635d9fb783667a93364781327229f68886ca64683f67e5c0acf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710925, "uuid": "f2e8da6e-fa24-469e-964c-dc8baf5846f8", "value": "T13EB58C0BACD518F6C46A97328DB352927B70FC480B3223D32E45AA792FB6BD19D75314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710925, "uuid": "9ac295db-2d11-4725-aef6-dcc66cd366b2", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710925, "uuid": "f65dc0b1-0c22-44f3-9369-981366fcb615", "value": "49152:AHs5EcYTPMuNsogz4nkq2PUuR5bsBTKqDN:AHsOBjt/nAUuTYBTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776710925, "uuid": "c2102be9-4c9c-4f61-a7a1-e3ef0a1662d4", "value": 2339032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776710925, "uuid": "2f0c5f6d-e793-4981-8732-d9cf48bf47da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710925, "uuid": "8e0a43e6-7c1e-4b24-ae50-c6187409ec41", "value": "out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce474d08-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726063, "uuid": "a75888c4-7fc6-4276-9907-892343199440", "comment": "Malware payload", "value": "0ea492234b8a9873dc732934e4909f83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726063, "uuid": "f32b2c15-fc1c-4700-95ef-9eac55dc7872", "comment": "Malware payload", "value": "3df7e9107ea51e1067cdfe337c026b2bd0c4395c00fdd394365f24da50489ab5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726063, "uuid": "9bf8b0db-bffd-4e96-af5b-b286852eafce", "comment": "Malware payload", "value": "6b5ce4e142741f1efe85f17560c19d426b90aee5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726063, "uuid": "635c3d3a-8df8-4cfc-8429-e4ba229c7fac", "comment": "Malware payload", "value": "f716c8f665347397f8c94bdb78f6fa3a47968feeea7c0c6f825e5c66041a3545af94888595162944037fff84234980c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726063, "uuid": "72a52d13-09d9-4b96-83fb-eea28e0a545a", "value": "T1C8B35A4B62AA00FBE5778278C5670E46E7B6B85107609FEF03A4461A1F237D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726063, "uuid": "613693ae-82d0-4040-8cab-83507508994e", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726063, "uuid": "8167d758-ee38-4c89-a1c3-ee7e9445c71e", "value": "1536:96YakTwPMFZYQ46x6Fu3DpGTHASUVjLLJBqd5tEJsWTrdj9dl7h8GQVI:9yXPMsoF3Dp+g9LLrqLtqB7duGQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726063, "uuid": "6ba97e21-dae9-44ef-b596-43315b34b283", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726063, "uuid": "89f66fcd-db20-4f17-9f04-94083a1c495f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726063, "uuid": "d975f1d6-d86e-4581-9f8f-025d0e63b327", "value": "3df7e9107ea51e1067cdfe337c026b2bd0c4395c00fdd394365f24da50489ab5_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10c3fac-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725155, "uuid": "aaf5c465-f866-43a1-ba4a-902bce5a9511", "comment": "Malware payload", "value": "ab3e8aabd7132a1016425a2819082ec8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725155, "uuid": "002a7cbb-20cf-47f6-a99a-6975990cfb66", "comment": "Malware payload", "value": "3e28c0e009b791fae78e118e3b78ee7d10e82f0cfc568e470f0d617501de3802", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725155, "uuid": "95768f80-4d6f-4a68-a6bc-8a704175deb1", "comment": "Malware payload", "value": "a1253c1fd8bf4eb80094b963172f5fa3766711b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725155, "uuid": "c3d4e9eb-bc43-4b82-b0e1-1f3a02ac88c1", "comment": "Malware payload", "value": "f0f8da6852231bd9053f27540858a5fec075187b8489d03c60f999c6c55cb0053d633c4d328337d09be70207a151c294", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725155, "uuid": "8476e5ea-b738-4c5c-8aa6-7d01158919c0", "value": "T11CB35A47A2E500BBE1779239C9A70A46D7B2B81157609FEF03A4464A5F237E28D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725155, "uuid": "69e284ac-8dbb-4db7-9fb5-4f6779785a6d", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725155, "uuid": "89c301b7-b516-4b14-a8f9-e6a8f0e8b9ae", "value": "3072:s1yE3qvz68dA1Fd4Yu46T/MnxmNkVEPLA5zvB:bzVwy46rP7M5zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725155, "uuid": "a0b08ed8-fad9-4def-92a2-65b5af15421a", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725155, "uuid": "45cf847e-4cb5-4add-bc4e-542705744948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725155, "uuid": "1059019b-d733-4c3c-a54f-4c18e37289c4", "value": "3e28c0e009b791fae78e118e3b78ee7d10e82f0cfc568e470f0d617501de3802_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66db3751-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687235, "uuid": "b0afa239-5137-49ed-8679-d8be01ce1f75", "comment": "Malware payload (SpankRAT)", "value": "02f354c1ce2f8dad96d9159219829f88", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687235, "uuid": "6b36d2b9-7917-452f-85eb-0aaf9be81513", "comment": "Malware payload (SpankRAT)", "value": "3ea140ef8b9b07102d1ab2ec52a2d83c45a5e45d5beefba720758896a0107737", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687235, "uuid": "c1c64007-d594-40bd-88e1-185168c99946", "comment": "Malware payload (SpankRAT)", "value": "70afd6b844f902f01ec6fe9040423a965ec1d8bd", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687235, "uuid": "44019ed8-4251-44ca-9653-1a9c94b91ba3", "comment": "Malware payload (SpankRAT)", "value": "9b5cc9b563f2ecfa9a9b4c07273953e6cc71942153421ad5e381c8a1accbc7d13307174b158fcd4e7f96988dc9537b37", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687235, "uuid": "4336ef2d-1681-4c43-924f-e48bb581a47a", "value": "T12C253C137F4689E9C5CAC8788357CA664E2330DB0B35F9DF11C626283F6AAB56F1D214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687235, "uuid": "3ea3da38-0698-4b30-9c2b-7e276ca9e367", "value": "74de2a662a72eb067ba749bd00ee0b92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687235, "uuid": "4171e9cb-8c7f-4eee-ae97-f25a20d4083d", "value": "12288:92TEZwLf+maCT1v7WJFqdMz8cCQ85G3CwWHmfFDhHIEDVIlr:92Z+mdT1zWJFbH05vsFRhul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687235, "uuid": "9a2efcbb-6690-46f1-b49e-72cba9e61e90", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687235, "uuid": "147feb43-b7dc-47d2-a04a-600c9a0731b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687235, "uuid": "e0c545bc-6ba9-44bd-839a-87d1bb64cd96", "value": "3ea140ef8b9b07102d1ab2ec52a2d83c45a5e45d5beefba720758896a0107737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca1c232-3c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776667998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667998, "uuid": "eee4a4a4-60b3-4db7-973d-db3503f7f6c0", "comment": "Malware payload", "value": "c8ee2b44332a79be2ff9d2d907faa00b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667998, "uuid": "3996c27a-6743-4d1c-8701-08f20757a5d0", "comment": "Malware payload", "value": "3ef2c9262b73a3a8a808ce0d083d83c112ab07ef39a1371d3efea1acbfe83b2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667998, "uuid": "4440c416-4122-4b2d-a61c-250ee037cdc5", "comment": "Malware payload", "value": "d747562d2c67fd8bb13187065d630f72afc891c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667998, "uuid": "5e2d8b41-1aa1-45af-afa0-56e89a7a392c", "comment": "Malware payload", "value": "990a70da0420a075cc4cc1d54c84b17f71ebc188ca9279f2b3c29f40229e2684e42e9e363fb3ee2f6e7f24a0bf0d4d4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667998, "uuid": "16869158-0523-4576-9eca-63c52e5cada3", "value": "T126561897B9D25953C4E83677A8BE80C833630EB99B8B52565D04FE387EBE1D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667998, "uuid": "f2f0584c-3496-4699-9d01-40db82078e2a", "value": "49152:Gllg+mHK0W7ZdGQZu3lHUsCi5vBRhGGDPSJ7nNrj/65Eb:eg+0NW7ZW3l0sCijRh9y7NvoEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776667998, "uuid": "f20a1e78-40bf-43e0-a757-f371b6af292c", "value": 6357154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776667998, "uuid": "6eac4a87-467f-486f-8e37-87de399da054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667998, "uuid": "8f1baa9b-d615-4d78-b36f-a984f57bb738", "value": "krane_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed119e-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697677, "uuid": "40c53865-ce64-4d8d-8a2c-0cbd6c7a9e02", "comment": "Malware payload", "value": "2e54e2a8deee695bd854598d7ddfca59", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697677, "uuid": "ce002f95-0e1b-4d16-a37b-ee492f6b4b61", "comment": "Malware payload", "value": "3f778ac0b03cafe02f933ba4f25299de0313975645d3c1f81720be06b2f5c23b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697677, "uuid": "7cb2fe72-28fb-4727-b547-6acf8183a7ee", "comment": "Malware payload", "value": "18f4bc70cdfc78dcabdcbae37d99396e6b68e661", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697677, "uuid": "076794b8-080c-4c2a-86f0-d57f442c9436", "comment": "Malware payload", "value": "b8b5dca0852f8909758e81fc920dbf3ed00a18602173e8d178ed20755f15c8e88dfe4c572b5ecdbac068a910a71a6c4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697677, "uuid": "d224cd6e-4641-4ea4-a79e-165f9b91f86d", "value": "T106E4ABBBD5DB2590B41BE4EB769A838052E104474F243D48B88FF93C9F85AD98CB1F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697677, "uuid": "811c2784-72d9-4450-87d3-546e1c188878", "value": "6144:YdmufUkGz+tIFCxeUA1/3CcsqSoRPVs0i:gP8WBeIcsT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697677, "uuid": "d0e3dbc6-b7bb-4cab-b87c-03460709462a", "value": 702927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697677, "uuid": "c35b9cdb-5c9f-4a44-9326-bf5e3a6eaea6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697677, "uuid": "3bc93749-99b9-4383-bec2-a096fa4a452f", "value": "Purchase order20042026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bad429-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725624, "uuid": "075d36bc-dde9-4692-b46b-2f50e33b0a25", "comment": "Malware payload", "value": "2d6a9d1bdce0aa69bd8061836613c073", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725624, "uuid": "3200f26c-b13d-4366-bb24-d03f4f1e400f", "comment": "Malware payload", "value": "3f8815f54611bedb73c6f8a36cc4dc0c138bae9b9e0f013d47746acc9ccd30bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725624, "uuid": "ababfb0d-c4d1-4710-b513-6e45234d22ae", "comment": "Malware payload", "value": "0300a1678ab4560cdd3d3b8cb396671629471bbe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725624, "uuid": "4fd7f5ff-f0da-450d-ab87-55950cb69851", "comment": "Malware payload", "value": "f0e1b1c88d25daa23c759b3d43b81584f231b61abe0ebb5fa2329fe1a4f0e898fd74886a7459dcdb869d241606bf63f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725624, "uuid": "015abfe3-eacd-4c79-93e3-f3ecdd527423", "value": "T173340C90B281FDF6EC998FB820D2631993BAF0819719EB2B6620FE3C035AB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725624, "uuid": "53fd8580-65fb-46b3-a2bf-39f3b86666ac", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725624, "uuid": "045153ea-f7b3-4b92-b756-f868839976e1", "value": "3072:MBDVl7xAa4Z0S+0tKnkdsT2dq3KVuVHyFOiZPPxU2j0+iqkM:K7Ca46S+sKnk22dQKVuVHysiZG2j0+yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725624, "uuid": "88177d17-7b3e-4c46-83d5-19ea36ce4f5b", "value": 241097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725624, "uuid": "f9b638bd-e484-4fbc-b934-070a5671d3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725624, "uuid": "23b5ce6f-2935-48d4-85d0-b1b58ec4cc2f", "value": "3f8815f54611bedb73c6f8a36cc4dc0c138bae9b9e0f013d47746acc9ccd30bf_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7977fc-3c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676295, "uuid": "cb5fa618-9168-4988-ae1c-70e68c4b915a", "comment": "Malware payload (ConnectWise)", "value": "389497273639c1a359f7c62a241dab5f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676295, "uuid": "f5f13b63-4ac5-4e42-8527-78af0a6ef3ba", "comment": "Malware payload (ConnectWise)", "value": "3f9ffd6a65395569b51d663d535d64dcabdb312a6f5a20d3fbace3ccf8d69296", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676295, "uuid": "b0db1bb5-7709-43fc-aef0-8eec16a1bd55", "comment": "Malware payload (ConnectWise)", "value": "10a7538f921b3b734cf326985d6c720027ae5d3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676295, "uuid": "daa1bf4d-f236-4986-b7f0-7ca6a6f808ab", "comment": "Malware payload (ConnectWise)", "value": "e98d39cb3092a25c53ebd6913707abed9e798356d2f1d03b1bd22cfc070c915b53b7dc0b2897b5ae2f7dda3ab09ea8cd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676295, "uuid": "8f9116ab-66d3-4df5-9210-8dd56f56963d", "value": "T195D6232267FD0918E1F36778FD3A91E291367C658F12C09F2614786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676295, "uuid": "322d0313-4f1d-4597-8e58-7eca0e010aa0", "value": "196608:3rnLYG3zDhukOfrnLYG3z4rnLYG3zBrnLYG3z+rnLYG3zCrnLYG3zernLYG3zU:3bDDDgvfbDD4bDDBbDD+bDDCbDDebDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676295, "uuid": "748ee919-5cd8-44f2-b455-1bb20e83466a", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676295, "uuid": "a85bd8dc-48b0-46e3-9a09-6923359b8087", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676295, "uuid": "6ffc90de-e012-41f8-9428-2a4e31852916", "value": "3f9ffd6a65395569b51d663d535d64dcabdb312a6f5a20d3fbace3ccf8d69296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04150faa-3cd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776702960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702960, "uuid": "19f3aa2e-f0f8-416a-a588-1a9c6e2d3eaf", "comment": "Malware payload", "value": "6f46a41d22ddac977a11649287741bc5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702960, "uuid": "09fbc498-ee1a-4d40-bead-c9d71ee039ce", "comment": "Malware payload", "value": "3fc0f329b734a04a976f6890f3d43bf64195e5c8d99eb6cdccedc945ffceba78", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702960, "uuid": "868d3df9-05bd-437a-a19b-f9bc5f493601", "comment": "Malware payload", "value": "ff11e67d8bc3cc2209029bce374b654040b65819", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702960, "uuid": "cab588c8-c849-435c-b4b5-4b12c3f2ce5c", "comment": "Malware payload", "value": "a57bea06bc619a5c10fd6064bfad3782b20f46cd252346453d32af254f8637510c7408bfc143bb2c30b00d2ba63f4387", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702960, "uuid": "24927bfd-8d88-49e6-b6f6-695d235e8dc5", "value": "T16933A6CE8D3AB79562CB960805B6DC4BFA8AE6ED7F711CCA48730C1AD3781309393559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702960, "uuid": "d304a734-6b62-4a7c-919b-67aae46be80a", "value": "1536:sOvCV2Sf9jUwXma61mNLErGchWAiVh70BkT4Ad:sOvCV2SfRUF16NqWAoj9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776702960, "uuid": "5c633777-38b0-49c1-a0d9-430d25fb90d7", "value": 52883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776702960, "uuid": "451f24f4-e03f-4680-bfd6-0410a2ffd77a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702960, "uuid": "e00c4f55-909b-4173-b85e-d62d49fbbc89", "value": "3fc0f329b734a04a976f6890f3d43bf64195e5c8d99eb6cdccedc945ffceba78.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d4379b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725007, "uuid": "65ad9916-8286-47d9-af06-356ef164e269", "comment": "Malware payload (RemcosRAT)", "value": "7d538008e2db4e28490b23d1579e4382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725007, "uuid": "25f356a8-0cfe-495e-89f2-d9dd41c9f7f4", "comment": "Malware payload (RemcosRAT)", "value": "4013853381bb2c28ddff061b1a208e886f2b52a31073cea40e4cdb5ec431d58b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725007, "uuid": "e2f479d0-1d3f-4535-abb2-c4414af3ebe2", "comment": "Malware payload (RemcosRAT)", "value": "41db80dbf5211c6d9af6a90b35c527b4a82c4124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725007, "uuid": "036b87dc-a099-4b36-8fd1-654a0c6a8538", "comment": "Malware payload (RemcosRAT)", "value": "f79eb909f5b9a2b3d88c3d5e9dc2b1278fcca44dd742964d5f689b4636ef5a9c03194306fe0315472b3a10d2b4e17f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725007, "uuid": "7ecc617e-e39c-49d6-bd67-b9bf655e842e", "value": "T17DD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725007, "uuid": "13d8bec3-ebf7-4fe1-a1c1-e7b5bee5d81f", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725007, "uuid": "cc1af3ce-e6f2-4eed-aa62-b05bf70201ad", "value": "12288:qSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:/GuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725007, "uuid": "07cb7068-efbe-4a83-b866-cd422f97e6d0", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725007, "uuid": "04977cc6-2e63-4f89-802e-a56612f65f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725007, "uuid": "5dac8afe-739d-4cc8-b4fb-68d40d5cdd6c", "value": "4013853381bb2c28ddff061b1a208e886f2b52a31073cea40e4cdb5ec431d58b_20661cef-aed6-48da-bb31-ca5683597292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73184d7b-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697563, "uuid": "1da43129-3d2a-41a4-b90b-2836e58518b8", "comment": "Malware payload (AgentTesla)", "value": "a76cbbff5e94e7e84dcc3de90ae8dba7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697563, "uuid": "425d732f-1ac1-43d9-ac07-4e5a89ddfbe3", "comment": "Malware payload (AgentTesla)", "value": "401633dcbb2c931a56739faa6e9f61acb5ed46ed8640b15ee3c0232e8d4f7781", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697563, "uuid": "8d4c69f6-0711-4985-8f73-fa89ddbcccff", "comment": "Malware payload (AgentTesla)", "value": "ea2dfb2b1e55e16f7103ea319a5b3d4005464ee2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697563, "uuid": "84f10e3d-3abd-46db-9864-ceb999c4b821", "comment": "Malware payload (AgentTesla)", "value": "2c651cbaf8b03f8e1fcf298254fe3cf651c35d2022e7783951e2965ba70d829e315a7573c57bdf11f11e0964a2a56c5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697563, "uuid": "3757a18b-8b52-422c-8418-eafbd4a5b57e", "value": "T12C569624D0E0B40C58D2CF5BAE63D0B049DF79ABAE0E89A2602FE97D1D55FD3961019F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697563, "uuid": "3a3ea688-b2e1-4136-8db9-30062b85f67b", "value": "98304:5OQgvFSVL4Pi+MPbGGBx8EbDkI6tuAtKGTjEqXxO7VxoNVzVNAfpJtw5whXD8fbu:A4DPbN8E/kIinNjEMO7yRyftUwhzGPB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697563, "uuid": "b1d6e49a-ebc2-4a84-8bb8-be6e8a25d654", "value": 6021692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697563, "uuid": "665a0e7e-81d4-4e04-8e7f-1ea7c42f0687", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697563, "uuid": "06f0c84b-51cb-4b86-ab09-bdd6a84d8297", "value": "Quotation#294198.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3500b749-3d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776726235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726235, "uuid": "fc0aa737-1d0f-467b-a137-31b6f204ae64", "comment": "Malware payload (Mirai)", "value": "67e058517dd4552b0ac01465eeeb251b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726235, "uuid": "3a54f6eb-afc3-4768-9c36-d083b00cc824", "comment": "Malware payload (Mirai)", "value": "40509f68ea541a5c8b266e2375ab9cf21756e3e6026a6c20df44ec79a26153dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726235, "uuid": "37c7b229-0106-487a-a248-27933adfff3a", "comment": "Malware payload (Mirai)", "value": "7770d624e4067b0f0d4cfac15ce67304f98b99e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726235, "uuid": "d4d7ad50-a990-454f-bce0-e0de76a63861", "comment": "Malware payload (Mirai)", "value": "0b02e2971d69b9444dae42684a2be338d58675d6e73487607db4b4d8ed007484fb9d5434ee4eafd6de1157c1655da505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726235, "uuid": "858b8914-2401-4901-9d08-8bb8e67f1d79", "value": "T1AD130807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA12A986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726235, "uuid": "dd99f9fb-61c0-42df-aa50-41ff658f8d3e", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4/Dwg4SAnWAtiTWufBT7oRC:C4jKy5klH5lYFsTbUDwA+JtiTWuF8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726235, "uuid": "6c419ec7-5432-46f1-92bd-d4d911366032", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726235, "uuid": "3de17816-0c7e-48ac-b75b-fc68fe86c937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726235, "uuid": "828d730d-1fb7-461f-afb0-6393ff6f5d02", "value": "00okx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8061f6-3d10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776727538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727538, "uuid": "5fd48dba-d6e9-4f8a-b271-88a6c3fa0069", "comment": "Malware payload", "value": "491b412e29310b09d8e98267e5fe8218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727538, "uuid": "464adf40-9204-466e-a58f-2d57c2ef84b1", "comment": "Malware payload", "value": "40c8b127cd1fbf51625065599c667d39275677c7decb5a5fbadae45894e695c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727538, "uuid": "29238e55-def0-4cf3-8284-02265b0ca356", "comment": "Malware payload", "value": "e4547c3d665d7b86fdf92216ba8d8983bc2b15b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727538, "uuid": "0a55e21a-716c-4ad0-b29d-885b1dba95a0", "comment": "Malware payload", "value": "3d66f905997a1065f0bb9f64af4671f72d64eaaff31926107da4e0df38e4e7e37087d4ff27540c7a97a99b78477af8c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727538, "uuid": "b2983829-3c68-414c-a56e-d5658caa5e57", "value": "T1C2146321984CC783C22622BC6DEE9FBBCE7E72D62645CD013DD4953085E1FAB290BC95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727538, "uuid": "8f642e2e-0fe6-4cbc-9fa0-1113329f5de4", "value": "6144:lpyjZUNQGeyWnpi30zMIE13afwEvPb04gFTp7YR8/p4:SgL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727538, "uuid": "b566b4a7-cc29-4854-8e2a-75f56d637ea4", "value": 202952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727538, "uuid": "94c1b188-9d4c-4419-b0d3-975374b2718e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727538, "uuid": "2d136e53-2825-4c62-847f-9b66ea9ec924", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7e17fb-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727109, "uuid": "221c3537-1bd6-4fa7-a5e3-0a0a5b1447b0", "comment": "Malware payload (Mirai)", "value": "9782a4a1bb184f4a45d7056a19f24fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727109, "uuid": "3fca9fc1-9eb3-4b81-8cd7-b92da86da02e", "comment": "Malware payload (Mirai)", "value": "413e045eacae753559d3cebdda42b1176abeb1e00adf20738cb56eadf13ee57c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727109, "uuid": "54e2b45b-8138-4cf9-afff-08eb6bd3622f", "comment": "Malware payload (Mirai)", "value": "bbeb6878e22774988d10c0a691fac9666c7ed8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727109, "uuid": "ff756935-7121-474f-86bd-e7c7625d5e85", "comment": "Malware payload (Mirai)", "value": "c49248073b2760ec074febb29ce53e9c707271b6189d95bee3fde239f10512028bff65b1b8a86b73573c776d79d30ae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727109, "uuid": "0c167b2a-f0cf-4bbe-91ee-d3f32582c0ed", "value": "T18D03F1BC312ED622D9316C73E9B203C25D544774C1E7A117D9BF49289727384B68938B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727109, "uuid": "1254ae15-3c38-47fa-9d04-57b0a613df04", "value": "768:DGPjXBOTsh1aqh3kosh+IkLpFw71qB7IuszFKwMKBJaNiIoIU9q3UELyy:WLYptVh0whqFIlQ/2fYLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727109, "uuid": "652dcbf4-d6a5-4958-88d9-4e0db13deb52", "value": 40340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727109, "uuid": "f244caa6-0ac4-47b0-aa85-c2f0d54f0d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727109, "uuid": "6a3acfdb-9475-47b2-936c-735e9ea5b6b2", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda6d736-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725686, "uuid": "d74e9299-e2fb-44cb-8af5-174d0c93de8e", "comment": "Malware payload (EvelynStealer)", "value": "7ef877e047de4c6f017e704fe5ec4f51", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725686, "uuid": "cc4b6256-6677-42cc-8bda-0d7fa907124d", "comment": "Malware payload (EvelynStealer)", "value": "418e962e7aa2a3f2a63f71cb37ed8a840f7fbe931a1d82d6d6a46b5a7ea0e48e", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725686, "uuid": "a0aba910-0120-4184-a461-64f4b06af353", "comment": "Malware payload (EvelynStealer)", "value": "37e51f83b9a2656a3ecb73ba87031eb189f97e1a", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725686, "uuid": "b2fda0fb-b04f-4cca-89c2-051e64ca3553", "comment": "Malware payload (EvelynStealer)", "value": "6c915ea74253b48ac06d284e61601a016dd383b30c1f2b72b466f5ec6597d663a0b6e718cd2d2d9fe18571c30aa720f7", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725686, "uuid": "bf2123d7-b336-41de-a65f-d9ec7fd7dc19", "value": "T112141916F39320ECD577D1304ABBA133B971BC5946F0A95EA9448A387E20F50B63DF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725686, "uuid": "d7096798-3fe9-4b35-88ea-5d962572bbc0", "value": "3f01a1ca93205435b4a4028b8d16801f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725686, "uuid": "1d005f46-9e5c-458a-b6ba-0b76259f8849", "value": "3072:MSVcICuMt+4W7RFajC/EDiOYMGVammxA6Yy9SqBKtou+QG/XyWgMhWlnM2d:MdICuqJ2R1jZaRA659iow0tJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725686, "uuid": "0cbd5eae-b39d-4f26-b2f6-dabe2b80fb20", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725686, "uuid": "0e9220e7-8aa5-4bd9-9e12-23f44fd39676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725686, "uuid": "2b1ec677-ec2c-4ff2-a099-cb2bd562858e", "value": "418e962e7aa2a3f2a63f71cb37ed8a840f7fbe931a1d82d6d6a46b5a7ea0e48e_dca33c9f-6db2-4cb2-887f-843c7b2c0dfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ed4521-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687532, "uuid": "8b22d12d-6df6-4e0d-b805-a018b0d60564", "comment": "Malware payload (Mirai)", "value": "7ea74c7174e6547be59ec87a529c5537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687532, "uuid": "579a7067-4919-461f-9eff-40967e5ec609", "comment": "Malware payload (Mirai)", "value": "425df731d811470c8cbb16dcc5593cc7fb27c1ae39a9d302839be848800c2fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687532, "uuid": "d639dd5b-3708-4802-9052-fa157f0c8b23", "comment": "Malware payload (Mirai)", "value": "3ac8c34eff62a407ca16f4b9376886acbe5dbeae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687532, "uuid": "c9a7c5ea-9138-470e-9c24-31be313cd180", "comment": "Malware payload (Mirai)", "value": "f9cbed84056f7938cbe72f05cfd21eecfadd8a0d8c210a04ef71c7f7087facf90280c3bcba71a0251b933dc9af5deff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687532, "uuid": "e4f9a1ea-358a-456b-a079-a54ff9f585f0", "value": "T1EC639409BF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F09E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687532, "uuid": "d06db19e-9b1c-4af5-aa73-e302a9bcfa89", "value": "768:K+xGiJEEYlDIR99LYkLUAJtw6OC5f2eaeyWecfkoN3pkavdE5tXirnM+ufp:K+xGiJxYlkTpJJOCgvjWrfgrAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687532, "uuid": "5c6748d9-5630-4b12-b0b8-9cc826c9cc8d", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687532, "uuid": "40cb768a-e25e-498c-a33a-19607cabf115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687532, "uuid": "878ff285-328d-46eb-a06d-e3ea4c1336f7", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e676a9dd-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676711, "uuid": "d4d63669-3689-453f-b72c-38fe6c49fd0d", "comment": "Malware payload (ConnectWise)", "value": "1a373faaccd4242fb0a3c9d055598155", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676711, "uuid": "73b59022-49bf-4b3d-9a2a-36902a41e4d5", "comment": "Malware payload (ConnectWise)", "value": "429810d37926163435016ab838c911c9513e13745168ccba91d7e5ce283fe4aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676711, "uuid": "8124b818-a575-4c27-b99a-28ef09086417", "comment": "Malware payload (ConnectWise)", "value": "dabb5fe11cf841c8384f1d92d997984875c06fdf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676711, "uuid": "19f27a03-ea1c-491c-a3ee-296bf1a7af93", "comment": "Malware payload (ConnectWise)", "value": "c85203872464bde1d970bfd7f45d0aa010196e3ce4c744eda6987383ab69d347f9990cb780fe4114ca2382bc7bf20796", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676711, "uuid": "d5200e4b-3ce8-41a2-a306-213ca697936b", "value": "T1F8646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676711, "uuid": "5bca384d-1fd6-45c7-9e7f-11f30cfa08c4", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676711, "uuid": "b5affddb-f834-4327-b476-19ca1cc13df8", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676711, "uuid": "4010708f-2291-45cc-be99-23657be3449a", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676711, "uuid": "e154272c-13dc-45da-a1f8-b643bbabe2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676711, "uuid": "bca9efa5-916e-4e93-8e96-afbb3a9ee65b", "value": "429810d37926163435016ab838c911c9513e13745168ccba91d7e5ce283fe4aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e2eb3c-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674187, "uuid": "6f40c0eb-eea5-49bb-ab4e-519c66ed94e8", "comment": "Malware payload (ConnectWise)", "value": "65e397e3d5af63a552ae4ce379653154", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674187, "uuid": "622daf6f-2695-4d2f-9c0b-b4409fd281d2", "comment": "Malware payload (ConnectWise)", "value": "42f24bf7e01b67fb3af6f152065411579fafebe1b3a5ec65f7ea902a1a695d49", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674187, "uuid": "d06c330a-51c8-4795-8c24-6d80b50920d5", "comment": "Malware payload (ConnectWise)", "value": "aa51fcae678839fdf00a0df84c739344c7329beb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674187, "uuid": "5ae1e12d-8a75-4c55-bcad-9a70c42aa41e", "comment": "Malware payload (ConnectWise)", "value": "0fcd21ced067390ac8941d230ac3855fba00f82bfe08e2d6b2c630c9ff252204cffed8b5469ebb46f96af5bded81d223", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674187, "uuid": "fbd0982a-923e-4343-ac86-cd1df90bfb5c", "value": "T1D0750110B6E9883DE6F62B32FF7A92605E39FD251E20C15E9394350D0D70A919BB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674187, "uuid": "72cf43cc-18df-48b4-8428-ce4bde0959be", "value": "24576:cZPlmF0uwTKh56Z5vePu/DVeL1pVjeOHnUUGGu/aYmQurhwQUv:2mh69eWbVypVCkgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674187, "uuid": "ffaa778a-6aa8-495d-9508-3a9d9e5355c3", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674187, "uuid": "1add4708-884b-4cc0-800d-2889106544f8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674187, "uuid": "efb1ca1c-3910-4dac-a5e7-44efe0136802", "value": "42f24bf7e01b67fb3af6f152065411579fafebe1b3a5ec65f7ea902a1a695d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd0686b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724906, "uuid": "0e194b39-0994-42ca-a1b9-7e3b62305738", "comment": "Malware payload", "value": "2634f3c18272adde20506cdd03f95b49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724906, "uuid": "109ceac5-dbef-4383-b27e-a67b9f09295f", "comment": "Malware payload", "value": "43552a00df3c236bb0d5b9483cbf1c1ba8c61762b2ec8373c85c1b20fb4cf7d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724906, "uuid": "09610871-6918-4d3a-abb5-232d6b04aa08", "comment": "Malware payload", "value": "c4ce1b8935b2cee682df353690e0e6dcc6e53deb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724906, "uuid": "d9ba85a3-d8a1-45b6-b3d2-fa7a0309ebcb", "comment": "Malware payload", "value": "907c41e994f902b11ff15bb69747516fde11960e6489d21d8dd7adaab639aded465385df866d7211f9e20303c312f867", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724906, "uuid": "3652775a-2221-4a3d-9da2-3d7d499486cc", "value": "T12682E80EFB4FB8BDC90DE27459EF5732A5B2753206266B2E1314DEF64E10654326E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724906, "uuid": "7099fd65-6d4b-494b-8744-157419503caf", "value": "7e6047e86dfc28c96b06e3621db487ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724906, "uuid": "7d743439-c4b6-4098-874c-d7420ddaccdf", "value": "384:A96Z9cFRSg5FZLx3gowOBdjimckVPxIiTrBX3qWLkN:AQZ9c/j5+o1KmckVPxIiTp3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724906, "uuid": "592ee9da-1323-4007-a9fb-061717e4e177", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724906, "uuid": "fe8677c2-1044-438d-ab2d-a34315727331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724906, "uuid": "884da113-5bb4-43c3-a6cd-4cdd1a4edb9b", "value": "43552a00df3c236bb0d5b9483cbf1c1ba8c61762b2ec8373c85c1b20fb4cf7d5_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27b05ac-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725131, "uuid": "87f83a38-a954-431a-b818-5c9d6ae90154", "comment": "Malware payload", "value": "9af3d4135e84d81b41ab0ba27fca6ffb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725131, "uuid": "67790589-5439-4413-8898-fbcacdc6410f", "comment": "Malware payload", "value": "43da2611a806acc21c55a1a4f58e71ad9cdfe3306a1ad082a018701b023da3a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725131, "uuid": "b6083e72-4e16-4130-a639-d3c30686751c", "comment": "Malware payload", "value": "86217fd04323e86f9b55d9f2cc6c72bf33b9da74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725131, "uuid": "c24a0ae1-e8b0-4dc2-aee8-4880ac9122e3", "comment": "Malware payload", "value": "ca674954df961b5ae3a824df6f3d95b3a0a2a3f12ee0f09508373936657144d673ec94b58ef8ab1872b555013be99877", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725131, "uuid": "44f6a938-ae1d-42a1-ab00-99def533b7f8", "value": "T17EA3594BA2E600BBE2B78678C8930A49D772B85557619FFF03A4421A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725131, "uuid": "1e4ac356-569f-4ece-bd8d-a7f955603661", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725131, "uuid": "4e6dbdbd-fca9-45fb-b64f-f16b2115a2cb", "value": "3072:EvBGrVNNR2AJNQKAfRAtlvrXT/7nM4L3zm2Q9ZVbZacTShsrH7KjdG:gG5HoqXAfRYm65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725131, "uuid": "a2c0147c-3cbd-4dc5-b4af-976096158ef9", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725131, "uuid": "7d6d29eb-3c94-4263-aa58-9553ed7f90fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725131, "uuid": "35200895-d301-4795-91d4-62fd20bb2229", "value": "43da2611a806acc21c55a1a4f58e71ad9cdfe3306a1ad082a018701b023da3a5_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bdb389-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725430, "uuid": "5b149a66-5e52-45cc-96b8-49b9858cab12", "comment": "Malware payload", "value": "030e49320d72821102d9c37c77d6de25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725430, "uuid": "c3b52d91-1767-4160-a5f2-236d714f0ca5", "comment": "Malware payload", "value": "443e9b7be2c3ffc70a0ea6710947e0e9582cdb81626c51d3090767475a183903", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725430, "uuid": "efefd189-2dc6-4eda-a759-8e6c45e531ff", "comment": "Malware payload", "value": "c2d96bb04e1c829bcc7788cdfb8a8caf88dc91bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725430, "uuid": "111049bf-1f2e-4d5c-b301-d9243270dd35", "comment": "Malware payload", "value": "7cc8abd5e6b72c38f69108211e8aa483ae39761de793d2e3ec5506799a47cc255f23a125d890104d7ebade1582756552", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725430, "uuid": "6e5fcadb-1883-4cdc-9ca7-1a331c9e7701", "value": "T12872E90EE78BA87DC40DE1B409FB5B3174B17A36067E6B2D1354DBB70F10684625E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725430, "uuid": "3808719d-fd02-4316-83c3-ef665b6c3df1", "value": "e42678787d5b7aff9b39c41d548b8e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725430, "uuid": "916201fb-e396-43e7-a5e3-bd11544d2677", "value": "384:S0D9puehsFtf58S9ozwrtw8dUk1gmckVPxIiTgALMyD:SA94eYtf+SKzosnmckVPxIiTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725430, "uuid": "21f1eb75-b1de-4fd2-a251-9013ba603843", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725430, "uuid": "237d0a4d-1664-4a3d-b2e5-451aac0e4088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725430, "uuid": "28380913-d479-4695-9941-f36ba7631f95", "value": "443e9b7be2c3ffc70a0ea6710947e0e9582cdb81626c51d3090767475a183903_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682db126-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673923, "uuid": "b197388f-b9ec-4f16-a5b4-c995974b5ea9", "comment": "Malware payload (ConnectWise)", "value": "7c258e42369755594bc0f9e5b603ded8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673923, "uuid": "051a0038-5f4b-48a2-8eb6-e4f7f537a3eb", "comment": "Malware payload (ConnectWise)", "value": "44de178bd97dc6f4585af80d4a1a38926324d04705fa11862cf4f08c294492cb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673923, "uuid": "7e6889fa-d533-473f-97de-0a441b4ed241", "comment": "Malware payload (ConnectWise)", "value": "93adacf0e7f7d3424ad16521ff9ecbc3cede21d6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673923, "uuid": "ed99edb8-6cf7-48a5-a3fd-54e9bfc10b61", "comment": "Malware payload (ConnectWise)", "value": "0225dd7f133845e2d48f4080922d80b3fb5cd06dd4f478cf3421d6646f6b0e68f1568f57f6f894a47bfbcb4d65f008d8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673923, "uuid": "ce6f6e30-0923-4582-bb01-35f6b5dad8c5", "value": "T1D846E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673923, "uuid": "911dc261-fdb7-495a-85aa-17269153b6af", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673923, "uuid": "a6127493-c715-409c-913e-3883896e0838", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlvgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673923, "uuid": "26ec0cbf-e687-4e9f-a4dc-e39b80f5cd1e", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673923, "uuid": "32e7545b-8505-4797-9696-fdcc04e7f529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673923, "uuid": "46c88fef-62ac-45a3-862d-9a570373f79f", "value": "44de178bd97dc6f4585af80d4a1a38926324d04705fa11862cf4f08c294492cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6501d281-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676494, "uuid": "1d1761cb-af71-4d94-b649-9842aa75b54e", "comment": "Malware payload (ConnectWise)", "value": "b9fd70afa2a496b6a8e808da6600be3b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676494, "uuid": "82aa5f56-a5e4-40c0-a1fe-b802776096c3", "comment": "Malware payload (ConnectWise)", "value": "45457aedaba89237cfe298f3c8e6022fc7e6fbecb1259c77eeef33b3aaf7ec6d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676494, "uuid": "4f193f40-e979-4669-a3af-31cb17348eed", "comment": "Malware payload (ConnectWise)", "value": "63b910495b3320b283701d88fb8555c3d8699416", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676494, "uuid": "7e994a54-c03e-4a62-b55c-6148ecf70c91", "comment": "Malware payload (ConnectWise)", "value": "83c64d873c3b901272f9e6943b56f3b3f521c68f0119126a681407060ffc8374d23e31ad02bbecbcd990b1f95f75834f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676494, "uuid": "d71c5aae-64d3-4e94-bfca-6ff65124eb82", "value": "T18D46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676494, "uuid": "043d197b-6ef7-4785-ba4b-982989883bc4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676494, "uuid": "0fca9443-e18f-4904-9af6-b1f78ca7f86d", "value": "49152:MfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:wqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676494, "uuid": "38b82d24-74e1-460a-acac-f8f1820d0df1", "value": 5649200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676494, "uuid": "16b6d468-9e8a-4fa6-a2d2-7b19e4be145c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676494, "uuid": "cf440f32-fbfb-415a-b3ae-3553559971e0", "value": "45457aedaba89237cfe298f3c8e6022fc7e6fbecb1259c77eeef33b3aaf7ec6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fac075b-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686901, "uuid": "77a108fc-2569-45c8-a5d7-a729cb2dabb3", "comment": "Malware payload (SpankRAT)", "value": "2b6609e9df9816992adee4b4ffbe60f3", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686901, "uuid": "fbe77501-edde-4476-be65-0796a42e95ad", "comment": "Malware payload (SpankRAT)", "value": "4570b45b8bb7c777c6464c1fa4f654944d8cddc4eb99fbe2f808854edbd9c654", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686901, "uuid": "01786882-4aff-4896-9fde-44ad04bb1863", "comment": "Malware payload (SpankRAT)", "value": "cae9e10e80732783fac0b647d65974e802eb5716", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686901, "uuid": "39a9e965-da39-4ad7-a195-ff84795159a3", "comment": "Malware payload (SpankRAT)", "value": "eedcef604b03ee810ca5b134d16b86f2ab9399f3ec09b79460ee1081bb748ca18e4e2c1fc0c8552d46065bc90cad5fef", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686901, "uuid": "323a962c-1eeb-4301-b59f-fc7b3c3b0c09", "value": "T106055D03FA5985E9D59EC07C87578536AA33B89D0B3166EF22C42B183E67FE12B1D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686901, "uuid": "fb4e801f-229a-49cc-9831-22ff2507fc53", "value": "10a7cd10633f64d339c794244cc446d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686901, "uuid": "328487d7-d829-4cdb-9ebb-dcd83c5aa9a6", "value": "12288:iBKmdLgAkL8srPwg6VkkxIbzcwmQDx1H+AIH/oK/1:TmdUTLnrPrSxCcDPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686901, "uuid": "a000a9ad-6c9f-42da-812b-a8d09e1dc8d7", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686901, "uuid": "c44b8898-9d1a-4857-8d3a-30ebdb9ea320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686901, "uuid": "81a94827-dc9c-4587-a4a8-06fb919105f8", "value": "4570b45b8bb7c777c6464c1fa4f654944d8cddc4eb99fbe2f808854edbd9c654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aef800d-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776666143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666143, "uuid": "b21d377e-8462-4031-ac77-5ea16ef1fab0", "comment": "Malware payload (AgentTesla)", "value": "510f1b098067c8bb1e3979b46aea64ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666143, "uuid": "ade91c87-e080-4d17-bed5-00e8220c02e8", "comment": "Malware payload (AgentTesla)", "value": "45a39ed57bc351ed2757a9a244b0eb9fa198d876b608d190dca5b7f529593457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666143, "uuid": "409819d2-c6df-41a8-b822-cf820330fd7a", "comment": "Malware payload (AgentTesla)", "value": "56367a2dd012c0ce31d96d53a13b77fe84208b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666143, "uuid": "a8f15c3a-0fa5-4b7c-b1ce-3ad99dfc5fc1", "comment": "Malware payload (AgentTesla)", "value": "419a0a611a87f174dc4ada6a0c047802370a3e3055b66c279d425f269d7ce84785344e6e0a9b275d250e613a187fe7ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666143, "uuid": "f688022b-8c49-4e6a-9dd7-8fc1aac0e38d", "value": "T11256834CD0B8B02958C6CF5EE567D4F0488F79AA7F0D89B2A02F91BC1C56F97982119F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666143, "uuid": "e18131e3-887f-4ba4-aaa1-4247de808b67", "value": "98304:MXbpJacDKJXZ1S6OhLrXwabkqL0KJdipixxcRMMCGu80QA9UvN9s6nVBwe8wT0Cf:MXbNONOhLr7kqYKJdipqMe80QsUl9s+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666143, "uuid": "fea150fb-de62-4f30-8b03-550f3d4b90c6", "value": 6027836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666143, "uuid": "22319e43-9370-484c-b6e7-a5cc7a70c830", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666143, "uuid": "7e6ab77a-f8f3-48c5-87db-03bc3f21d420", "value": "Revised Order..JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80545127-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776725932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725932, "uuid": "fad5041c-f655-4735-a380-2d0df7afa4c3", "comment": "Malware payload (QuasarRAT)", "value": "b9c156d5c80aafc5e04db6871b61078f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725932, "uuid": "c4e54d23-d67c-4ef8-853a-472044f00270", "comment": "Malware payload (QuasarRAT)", "value": "45c735e7733384897b4d15ac2a9bf6014028bbc8c4ed4ff9424330e81302034b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725932, "uuid": "52fb48a2-32b2-49f4-a7ee-e7e494169a9d", "comment": "Malware payload (QuasarRAT)", "value": "3374e100f29a4878469a7bb613eb6c1ca5bb9d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725932, "uuid": "38240ca0-a703-47b8-b17e-c7b990fb8d7d", "comment": "Malware payload (QuasarRAT)", "value": "2a0c877c018fcbe4f3c2a0fdc34eea089711578c35ac71833529b2f36fccfba065335b2f994a8f071223cf979354fa5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725932, "uuid": "ccb2dad8-99ac-48bf-90ef-cfae6c9a5fc0", "value": "T181E55A1537F85E22E16BD3B3D5F0541363F0E86AF3A3EB0B6191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725932, "uuid": "72c3b97d-0f2e-46ae-b86b-979a839b3fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725932, "uuid": "730e6070-41f6-4b66-9636-a29b0347d7ae", "value": "49152:Gvot62XlaSFNWPjljiFa2RoUYIsiLPmzukoGdMTHHB72eh2NT:Gvk62XlaSFNWPjljiFXRoUYIsiLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725932, "uuid": "8d024008-17b3-4e03-aba8-0d94399ad680", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725932, "uuid": "ff32643c-e4ae-407a-9281-5f7cf6f31c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725932, "uuid": "ca6ec3b3-6a36-486c-9150-d58dc03c276b", "value": "45c735e7733384897b4d15ac2a9bf6014028bbc8c4ed4ff9424330e81302034b_4df25285-f871-4f82-9405-8ca0084aed2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05b1bc6-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725583, "uuid": "a450000b-26c6-4347-b4c8-ac0ded6c65c9", "comment": "Malware payload", "value": "133c8a3b80dc9cda4064024cc5ab4700", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725583, "uuid": "07185d8e-d5df-4654-9062-492f1148301c", "comment": "Malware payload", "value": "45e90326a41c0d6099b977becff963ac257bd76527a288e6a93d420072b459d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725583, "uuid": "e8f16143-0c52-4c28-bdac-668df17bcf07", "comment": "Malware payload", "value": "ad345487a2637bc93a4432d8f55100094f682240", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725583, "uuid": "786a753a-c8d7-4845-a163-821f921f2d48", "comment": "Malware payload", "value": "e0ff4f7ae3d554735e9694868c12c3f140c041f5796bc7755eccd7c4ff9fdd555d6271466d2893dee78c33b9bc5d2cb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725583, "uuid": "a674e4af-8b1b-4307-9fab-7c3cea970310", "value": "T10134F990B6C1FDB6EC998FB820D25309A3B6F0819719EB3B6620FE3C025EB58D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725583, "uuid": "58caae03-c790-4477-ac1d-71c554a5b7c0", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725583, "uuid": "8f9957ae-2d72-44d1-8d05-32acdde2c40a", "value": "6144:Bi7CaYhS+XKnk+2JKVu1Hyz8iZT2julvxA:+CFYFk1IzzTk2xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725583, "uuid": "a8a9cd82-4a5f-4d88-a82e-911c0d584fe0", "value": 236053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725583, "uuid": "111db277-9a70-41c1-b15c-d0c41e3b2310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725583, "uuid": "9aaa959e-acf5-47ad-8e30-242a3df1bd0f", "value": "45e90326a41c0d6099b977becff963ac257bd76527a288e6a93d420072b459d6_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7b9786-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725471, "uuid": "05891a2c-cb09-469d-93bb-a6d8c49f78bb", "comment": "Malware payload", "value": "758114f4982ccec3350d5b76778fb03c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725471, "uuid": "f34f77ef-0359-45d5-b3ba-078f9ca84479", "comment": "Malware payload", "value": "45f3274ca472c44e9b903a3ecf2708da97f9c57f5ef939f9348b6642aa6c154a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725471, "uuid": "bc94be71-fc52-414a-9f95-ec56fb0edb2c", "comment": "Malware payload", "value": "d3247caab71d8e21debd371e3530b7fc81e72259", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725471, "uuid": "9604b548-097a-4340-83c9-f1e792d9e622", "comment": "Malware payload", "value": "4c1e408ab31162afacc7a4389a826ded9a6695e4f702576e84741f3a38dbee62323e1f8903c20b2a026f26abeb5684a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725471, "uuid": "3c56c465-2aeb-49c0-8974-e4516b118e35", "value": "T1A143DF1A7206649DD1C49038DBEB2733F736FA6047720B1EA26483792F916F1AF76E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725471, "uuid": "3ecacd7a-1d74-4bbb-9a9e-b1d840a9245b", "value": "ddcc75ec6ffae04a12c67efaca8e537b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725471, "uuid": "e69bbfbb-e5e2-4e60-afed-0c131826a130", "value": "768:Ax9HdIKmYMk4C94CCDJDeyBat21Ci9RbLjnbPKgh69xirFcEta6JqRrpFURSjk/:g3qtknCDJCJt2HvjbS4FcEtgFX0Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725471, "uuid": "a65c4434-54b7-4206-9082-1afa1c00a659", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725471, "uuid": "f23977f3-a69d-4467-ba55-ef12ed413271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725471, "uuid": "1a4e4bb6-7c1b-42b2-b220-5da6e50a5cc4", "value": "45f3274ca472c44e9b903a3ecf2708da97f9c57f5ef939f9348b6642aa6c154a_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57be65e7-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686780, "uuid": "15116e38-8af2-4ce0-b275-bc39a5aa8aba", "comment": "Malware payload (SpankRAT)", "value": "1b6b0ccfa1b6d2dc5395d3eae90f80f6", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686780, "uuid": "5f8b7ff6-7666-4914-8115-68dc41a98838", "comment": "Malware payload (SpankRAT)", "value": "46a63241f7ccc8291771b429ae4558a61d28c289a9c2788cf8e487c5ab2ebfe1", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686780, "uuid": "5bab70b5-9127-4039-b10f-3101cd6f754d", "comment": "Malware payload (SpankRAT)", "value": "796c70d419ded73cd5561c9a0b8e591d3cb2ffd5", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686780, "uuid": "36cb8dd6-271f-4725-a6cf-665c686ed841", "comment": "Malware payload (SpankRAT)", "value": "72d057b1be1ae4ac36c4da212164c0a6c1ec52da8db96e299643f62b2b6dfd13d5a64b098de5ff6e524b55b91143dccb", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686780, "uuid": "ee3653e9-9f35-4d32-b9c5-a541558194d1", "value": "T154B45D13F6884A79D19AC07883479666AA76B8DD0B31B9EF07D416203F79BE17B3D304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686780, "uuid": "5c1e05dd-6361-4473-9f68-f17c01614b9e", "value": "1da08730895df9e1db7b316522a313d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686780, "uuid": "b54c8f96-eb78-4663-80df-f9c77cd77f57", "value": "12288:sH3U29Wuz7/UktW5i9aOwoMl1bybh0lGdnnnzANIv:E313PbW5i9aZnb27z7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686780, "uuid": "3851037e-2183-4ad4-88da-2da37234f38b", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686780, "uuid": "45b565e4-fe39-42a8-84e6-036e6a681f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686780, "uuid": "eb4051b8-20a1-442a-9005-435a2a8bc7ae", "value": "46a63241f7ccc8291771b429ae4558a61d28c289a9c2788cf8e487c5ab2ebfe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6247c079-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727170, "uuid": "087d5504-b65f-4609-bbc9-b6484f745522", "comment": "Malware payload (Mirai)", "value": "293fe4971ea321b5a3c65a2373aba0a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727170, "uuid": "1ed96f50-026a-4e09-9b5d-23c86aacfb8d", "comment": "Malware payload (Mirai)", "value": "4702acaf482cc4f39d6b8cebd999282f359a58c0dde9ec3372b7023a57c61f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727170, "uuid": "c855fcb5-2232-4bc9-bbbb-0a06a6e3f701", "comment": "Malware payload (Mirai)", "value": "879b8b68a6f779e3268c055c5ec8a93ddca6b0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727170, "uuid": "aaa423db-c734-4ef0-9567-c92c7e9515f5", "comment": "Malware payload (Mirai)", "value": "ff314d3472696eb94dc704dc6f8c09cb0abc19cc0ba3e72398515b5a5f17ba655d45d4e194fe963dd8849961b9e501de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727170, "uuid": "fb1969b1-99ff-4c0d-8a5d-83aa960d4c9f", "value": "T15883185AF8814B21D5C512BAFA1E164E331307FCE3DE72239E24AF7137CA51B0E6A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727170, "uuid": "a7a571e5-884c-4f3f-8996-813f8f4d6ba9", "value": "1536:GpnQQmY6CpD2sAKv7isPtBBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtT:4m0D2ym4EZCSHYMactW4Bi9gnS4V0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727170, "uuid": "0ffe0071-5c19-470d-897e-19072ea17dc4", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727170, "uuid": "54add611-3921-4380-882c-3f37da89aec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727170, "uuid": "8d887201-44c5-4e65-b8c8-bce5da8360d0", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83c303c-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776726133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726133, "uuid": "7c3b2d71-19ee-448e-9c5a-6699788398bb", "comment": "Malware payload (AsyncRAT)", "value": "c35f3bb4a6e44e70b8990e1ff607c77d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726133, "uuid": "b0163733-3fa5-4ff6-918a-89d11c75365d", "comment": "Malware payload (AsyncRAT)", "value": "473a9b4a43ddc907399a6ef09e7b95bbcf9aef5affc388716e3f55e284d5bd07", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726133, "uuid": "219675a2-e4f7-4587-99d3-4c3694042513", "comment": "Malware payload (AsyncRAT)", "value": "7dea55f106e87d9a6379915c6b8e7737b5fb1e76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726133, "uuid": "b5ea69c1-20d1-44fe-935b-bb04b2a55af8", "comment": "Malware payload (AsyncRAT)", "value": "25343817f5435138117767de821e718d6d4e3fb0338e41abbd222930104392e3978d81b53f9c7c738019757888236eda", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726133, "uuid": "343ea42f-4229-44f1-afe4-21fe4dbf9a46", "value": "T114F24C083B904225D6FE7FFA69B375021670F9079913EB8D4CD499AA6F27BC0850439A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726133, "uuid": "54140587-806e-446a-a4d3-863f1cd8e174", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726133, "uuid": "2c49b6cf-fe0a-484d-86eb-f6eb9e3a3244", "value": "768:XLJau6SW06XXUxcOMvbFJ9YCOMh135zS:XlautWzXEVMTFJ9YCOMzxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726133, "uuid": "413d5f5f-f8ce-44e7-8262-1a1f89bbebd7", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726133, "uuid": "61779e3e-fbd8-4e90-ad31-14f7132e557a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726133, "uuid": "8d1a1c2d-e717-4e59-8c68-318ce56edd7d", "value": "473a9b4a43ddc907399a6ef09e7b95bbcf9aef5affc388716e3f55e284d5bd07_6bede63d-1f7c-4c1b-9e42-5be5007e0c66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d6420a-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725587, "uuid": "edc09150-0e6c-4b21-b6f5-3b739e4b28af", "comment": "Malware payload", "value": "c006be1e3c96d74e81a8d045413c8ef3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725587, "uuid": "995bfa91-03e9-4574-9049-72e535a2a490", "comment": "Malware payload", "value": "47bed35c272bf9fb9b67937a9c0a2ee7b476d89663ab2bbb4654c27eedf0c7c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725587, "uuid": "e6c0915b-b313-4d8e-bc0b-213763024193", "comment": "Malware payload", "value": "c19c612ae705689e8a07c5c131a346cc310534d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725587, "uuid": "d89df315-1947-48b0-b66c-32c647bb6189", "comment": "Malware payload", "value": "237a278419694f7d882a9ac885f1df3f04b7daea41b03ab8656ba3d9df8b19b431696bd9ddc424535153a05d5368be02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725587, "uuid": "6bca6640-5542-450d-bd12-b1b6bbe1beb3", "value": "T153A34B5776E900BBE1B78638C8974E05D7B2F81507619BEF03A0465A2F633E18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725587, "uuid": "df5d4b69-6151-4341-a3a4-0a417004d5b2", "value": "314abc9e3cbd7befb6945530d77e4a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725587, "uuid": "9e1d4609-fefc-478f-b6b6-0ebd0656c529", "value": "3072:ESfkIgoBL8RG7nQbYApkXr4zMwp3rDEQL:/TgGLKAMYApkbnCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725587, "uuid": "8069241d-08eb-4579-9fb3-9ba729beeaef", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725587, "uuid": "79d62e69-15e4-4eca-99da-0299f88fd434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725587, "uuid": "7f4fde98-34c0-4df1-813f-37ad95e040b6", "value": "47bed35c272bf9fb9b67937a9c0a2ee7b476d89663ab2bbb4654c27eedf0c7c8_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8bbfdd-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674767, "uuid": "9932ab42-ffc5-412e-bbd8-ab0f5bb2df3f", "comment": "Malware payload (SimpleHelp)", "value": "6afe1bc264a882bb9c118b981152b666", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674767, "uuid": "c1f83bc6-5790-46bb-ac75-deeff92095e8", "comment": "Malware payload (SimpleHelp)", "value": "486c713c838bbbe494d9ad40af1e679874ccbabd54b5183ebbc79ec3097cca33", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674767, "uuid": "290c5af8-0126-4066-92bd-4b996f1c18d6", "comment": "Malware payload (SimpleHelp)", "value": "03de61006dedb45475a8d5b3111590862268772e", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674767, "uuid": "43cff7ab-fd32-4c60-a9bc-cfbae658d312", "comment": "Malware payload (SimpleHelp)", "value": "105e48408423503dcc3ace63b280c6e55330cbc988bf4f31d32e098ef15f86661d40e10689de32e401f1c38f52a3ff1a", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674767, "uuid": "7a84c4f9-fc54-4f9b-aac2-8e5925d2c1b1", "value": "T141773324FAA16DBEDF33D5FCC4464147AA5AA4A70389121327F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674767, "uuid": "8fd60f90-8e7d-49ec-a274-39600f467327", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674767, "uuid": "3e9a981b-3a79-461d-b43c-3623cb2cd5fa", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcl:K/jkCgpPUK8PyL7M8aE1VWhroHFcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674767, "uuid": "6a42da4a-9186-476f-82dc-4dd3173d618c", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674767, "uuid": "d48f5e6c-0e1b-4b3d-8423-52c685b3ca88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674767, "uuid": "6abad7fe-e744-43ae-85d3-248058674521", "value": "486c713c838bbbe494d9ad40af1e679874ccbabd54b5183ebbc79ec3097cca33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b88f75c-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674197, "uuid": "8e4ecc3a-ba9f-441a-9d5d-671f57729141", "comment": "Malware payload (ConnectWise)", "value": "eae2b699971166682b92ccdf4cc25031", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674197, "uuid": "ca19b8ff-c4d2-4821-b0c9-0798036b3115", "comment": "Malware payload (ConnectWise)", "value": "487b48cca9cf184112c5c2339a634e3118d86ba8ef325cf7a35a49ea6c05276a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674197, "uuid": "f4926af6-1ffd-4ddb-be9d-2b4d8a45c971", "comment": "Malware payload (ConnectWise)", "value": "aa1666ae1e7484f08995ccb2f8e05c478959a295", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674197, "uuid": "8a8c1e63-8cc1-4167-acbf-d6a84c9166d7", "comment": "Malware payload (ConnectWise)", "value": "75628bc5a1845d86dcf5d141dbe2a98f8a04a8f5322cbaef15dd2e86a533e56dd932f771843d4d2445dbbf663c6634f5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674197, "uuid": "5674b1bd-ad65-49a9-a710-9c355d8458f0", "value": "T106750110B6E9883DE6F62B32FF7A92605E39FD251E20C15E9394351D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674197, "uuid": "96ff05e4-e231-4920-b4ff-e6efda585b6e", "value": "24576:eZPlmF0uwTKh56Z5vePu/DVeL1pVjeOanUUGGu/aYmQurhwQUv:kmh69eWbVypVChgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674197, "uuid": "54a2150b-effb-4c8f-9a07-ec142440ad8f", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674197, "uuid": "b1e73701-edb6-46e7-83fd-4bcb12cb7c48", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674197, "uuid": "a2ca1a17-fd67-45ec-9d1c-d47fe2300043", "value": "487b48cca9cf184112c5c2339a634e3118d86ba8ef325cf7a35a49ea6c05276a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96ed3b4-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725679, "uuid": "98681826-d6de-450a-af81-839470f375fe", "comment": "Malware payload", "value": "bb7bc068abe3e79a1de6b3c56e8746f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725679, "uuid": "b1360898-a9c9-4bb4-adec-07090bbb8543", "comment": "Malware payload", "value": "488e7c2316bfce9144a6598718447709018e084e5c920b5ffb53d428024314ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725679, "uuid": "bb936898-7504-4e90-baa7-7e206a8ce23b", "comment": "Malware payload", "value": "852858d2c829624260c6c972d417c1bf5eda95f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725679, "uuid": "066368bd-ac64-4637-aec1-11aff106d869", "comment": "Malware payload", "value": "d1b293980b933e9346111a825fdf41f242083eb85afa62ed3f78edf261b4c34c2ee39c345226ed59b6802b541982e8f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725679, "uuid": "2d078673-3062-4ff8-9c1d-3ea1150f7838", "value": "T144B35B4BA2A500FBE5778278C5630E46D7B2B8521760AFEF43A4461A1F237D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725679, "uuid": "17728160-a47c-4c5b-8dc5-4ca72bfbc5cd", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725679, "uuid": "41631c82-e934-48fb-bef2-10686cbebf1d", "value": "3072:9FuOrYPZmKGpenRDIxLedtqBzUSckVPxIiTjz0:lYhE4IxP70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725679, "uuid": "f59dae62-72d4-49d0-8f61-1aa3bf01af8b", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725679, "uuid": "c44a7e78-5a62-4e22-abe4-46cf70f542f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725679, "uuid": "0fa97694-3b24-41dd-baa6-c7a9756c6a38", "value": "488e7c2316bfce9144a6598718447709018e084e5c920b5ffb53d428024314ac_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1acec-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776677158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677158, "uuid": "a936f50b-a4b7-49d2-af74-8217caafe1f4", "comment": "Malware payload (Vidar)", "value": "8fc0ba23cf43e81e44c3361da7f790d1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677158, "uuid": "82fc5593-b66e-40d8-88b2-54a62ed86c92", "comment": "Malware payload (Vidar)", "value": "48f3eedc3a151803917d4ea4a975531f2db68ef3f98855bfc95e94e69c3c6ecc", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677158, "uuid": "022fc6e8-0d48-488d-ad76-3018dbce0757", "comment": "Malware payload (Vidar)", "value": "cf3258cac47d4d61659a67bc4f8abcdc71d0e511", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677158, "uuid": "6ef2fbf6-9ac3-4096-a472-b2e1b4623826", "comment": "Malware payload (Vidar)", "value": "c4e7c2d834c84b73d4dc4bac74579b787f6a5612d2e181983123072da93fbfcca6a7b48c8f3110971f55b3af5568ca75", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677158, "uuid": "f396a77e-3629-4aae-883c-bf0a7f0afe52", "value": "T1CED58D12B8B912EDC44A7E3244F26591EB74FC09072A27DB9E957E782D3E3C10C7AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677158, "uuid": "4141e963-4c79-4860-8249-3ddbc153659d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677158, "uuid": "1dcbe119-edc5-4357-bb39-21fd262cc520", "value": "49152:ZMSfVpzZctzVDXD6SEXMdUJ9TdkfEWEBfAQ3G4W:ZMqHmjD6SEXYUJ9TdxWEfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776677158, "uuid": "72aaeb51-caa8-40b0-bdae-24ddc33f1a94", "value": 3008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776677158, "uuid": "f607495d-c812-4c59-8a8f-a8cdf3fbc723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677158, "uuid": "dc956af4-086b-43d5-975d-192b15ec23b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2d96b7-3c97-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675617, "uuid": "4e41056a-ff15-4844-9d03-c6d9d4cf13d8", "comment": "Malware payload (SimpleHelp)", "value": "96626a1492ef8c1e6587df1c6fd0612a", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675617, "uuid": "47af70b0-9a11-4dc0-aaee-ae4b82e9dedd", "comment": "Malware payload (SimpleHelp)", "value": "49809a66a9225b57978bf799f4a62d957b384c6e144729c3a5a56e55404b5412", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675617, "uuid": "41e2b56e-fa1b-4b9d-a525-05265e32aa36", "comment": "Malware payload (SimpleHelp)", "value": "8931ae5933289bccee64b8eb2b70420fac8c3a33", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675617, "uuid": "f304f4a4-9b88-4cd6-87ed-c9e139a19b99", "comment": "Malware payload (SimpleHelp)", "value": "8904810b4937c3ac918919e68cfc6a11ee4065efd8de399d14880dfdbbf78514ad4d9129fd06ee1ab3129d29a98d9446", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675617, "uuid": "a497555a-5bc5-4e5a-8616-77f536c26338", "value": "T1BC873324F6E598BADF27D4BCC146C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675617, "uuid": "223e2b1b-19f3-413c-bb79-6beabdeb2bb6", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675617, "uuid": "a0f6a7e6-953e-443c-846c-8b5a397538c2", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7RmT:pJF2TAmHv5V7Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675617, "uuid": "e5979d0a-dcdd-4379-a5c3-746ec5ac8a25", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675617, "uuid": "30339a79-5306-4dd5-bf9d-bc8371064f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675617, "uuid": "da72dc38-c879-4a84-9cd3-9902e1a8a14c", "value": "49809a66a9225b57978bf799f4a62d957b384c6e144729c3a5a56e55404b5412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbc9cf6-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726141, "uuid": "f95abd3c-dc19-4c9c-9246-39c977603080", "comment": "Malware payload", "value": "4ce5d81cd58b36e5fa5c8313e072548a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726141, "uuid": "fe00a4c0-2d1a-46d6-8391-9d51732374e7", "comment": "Malware payload", "value": "49a87a2d7ca47a0ebef027a9030d5cf2f7bb963e74bccfd3f79e86536277a5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726141, "uuid": "471b3d6d-9c51-4061-a0c2-2c056cdceccc", "comment": "Malware payload", "value": "b3b5955176aa95cbfc3f28cd48d9a7988b87a4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726141, "uuid": "407f4244-3b1d-42cc-bd0c-567fa4245123", "comment": "Malware payload", "value": "6557a3a6847c4decd60b6cd95355edb45b6d0b0ce5606aa053a7404a8e1f8d6b4861c0bfc72a0ad2e38af376f4ac7568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726141, "uuid": "d7d95e6f-81e1-451d-8aec-d2b683922941", "value": "T195F56B47F7BA01E4C4BAD1388A466657FA723869473197DB56A0931B0F23BE1DE3E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726141, "uuid": "504c5f4f-a7cf-4de6-aef4-3229b643260e", "value": "ae3b9c167d6e8b07d696c30e4f732b05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726141, "uuid": "135658c7-d73f-435d-a049-5cf24091072f", "value": "49152:tr0m8hH68CR9hhKS9dltCLFQ842DqJjX/raJQ3/P8vRlTIb1gUkuzrOZLOIaI6Hr:mHW7KYYDorr9HcwzruaI6HMaJTtGbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726141, "uuid": "25d91e98-67ef-4b15-9485-5569094bbb70", "value": 3550240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726141, "uuid": "7a21c672-1ade-44f2-a0e1-f976a3888bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726141, "uuid": "c76b6635-037c-4428-bd46-49f43cdb3922", "value": "49a87a2d7ca47a0ebef027a9030d5cf2f7bb963e74bccfd3f79e86536277a5d8_WebViewHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6def4641-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776666631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666631, "uuid": "fe93da2e-882c-4dfd-bcc0-13ee078bf0c9", "comment": "Malware payload (Vidar)", "value": "9422d3bcf95077bee73e839768ba0a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666631, "uuid": "99e89a74-2d43-46e7-9e82-4fa8b4072c71", "comment": "Malware payload (Vidar)", "value": "4a1f0a85c1bf49cf095fe1d50878187b85ba2e7f72b1380d09cb1d377c2e7212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666631, "uuid": "226bc459-8d1c-4e23-90bb-55261b185474", "comment": "Malware payload (Vidar)", "value": "da9428264c7ee72ad97cfb0592fa465ec4b5e5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666631, "uuid": "cc93df33-d52c-4dbe-a3cd-34a37ebb24a7", "comment": "Malware payload (Vidar)", "value": "12b0866874389702bf9c692631b5adaa982d18d87d92151db220e560afabed474a99963b18ac8d5ac28bf01bad0982db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666631, "uuid": "ae650e46-6d57-4fb0-9e59-f62ee8eef023", "value": "T14BB58C0BACD428F6C86E97328DB625927B71F84D0B3263D71E41AA782FB6BD05C75314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666631, "uuid": "2afead04-71ef-4d85-b7f1-6fc67472a37f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666631, "uuid": "d2e95f5a-68a0-404b-b58d-b3687116d641", "value": "49152:F0WcOvbF9yCpW6+Qd1adHQvxZv3Ya0sZtW4COLs:F0kzbyvQpZvN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666631, "uuid": "7d48fa31-d86a-4b22-a1ab-f2cfec486f2f", "value": 2367152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666631, "uuid": "8676c38a-5e4d-484d-9bcd-a0a6fcafbe1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666631, "uuid": "e81d78f7-64bd-4ec4-bea8-d3a5798a3dd7", "value": "4a1f0a85c1bf49cf095fe1d50878187b85ba2e7f72b1380d09cb1d377c2e7212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfdef4d-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776687245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687245, "uuid": "dd27a0c8-6887-416c-84df-1003f56803ce", "comment": "Malware payload (XWorm)", "value": "9c226d8438963ef8e3b6be62e52cb0b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687245, "uuid": "3a47a169-3250-49f5-ae27-9d298c902937", "comment": "Malware payload (XWorm)", "value": "4af57476bd3e441af39c526e99cd13e1e44b75356c6eb836ff57a80d020a33c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687245, "uuid": "3f8a004e-fb17-4dca-b98b-b14fe7f90a79", "comment": "Malware payload (XWorm)", "value": "ed531f5edef2b5986532e217e02c51aeb9b9944c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687245, "uuid": "2c45f73d-7cfe-4d43-8113-c95e3d001ef3", "comment": "Malware payload (XWorm)", "value": "62ee75e2f63606ea28847b7208f0ba646f231902d02b70406d7820ad16e19c20bd1ba642dc6595be179f24989f5c8e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687245, "uuid": "a8c9117e-d7d7-410c-bc4d-b9aa3aa3590e", "value": "T1D6D4BF17C78A6F01C3BD4B7AC052048C6BF5CA469362E33F2ED854E63E53794AE2715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687245, "uuid": "27d958c9-d13d-4274-b01d-3af522d73175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687245, "uuid": "662ca5ee-2959-465e-aee2-5d9444c97064", "value": "12288:EHNjDKGn6FJL666n5cL6h3Un3w1tzu5v:Et3KG6/Kn6L6h3oAtav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687245, "uuid": "dd8ac312-fffd-4f74-a3ec-2ff022bb915f", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687245, "uuid": "363e37f9-59f2-4fb8-bb88-16b30ac7340d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687245, "uuid": "7e97efa0-3730-4de0-a16b-e51e0cdc2350", "value": "COTIZACION DE HEROS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37378c9a-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688014, "uuid": "e5748081-ffc5-4f34-a077-5bfd25302207", "comment": "Malware payload", "value": "21b0954b10680563bd166ea60589e4d0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688014, "uuid": "6ed4daa5-6f7a-4874-b1b2-7ffe24a6c703", "comment": "Malware payload", "value": "4b29b2c5e1b0ffc1da0102b72da7a98b5cdcc5f452e66c9ea64919a249593acd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688014, "uuid": "56a46947-2a36-456f-ab62-6807be87f0dc", "comment": "Malware payload", "value": "91b21efa1db1e1a389bd2d78afe2c6946d95834c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688014, "uuid": "82ca166f-194e-48cd-9584-248350d187a8", "comment": "Malware payload", "value": "9ee81d8d44e787a76011643bd07e00e90126eb6c0f14d00730edcb338fb640a208b54c6658faadbd114cc1406317cd43", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688014, "uuid": "84171315-d2cb-4464-aaeb-32d40488e5a8", "value": "T185B4D09172E1CB27FA8E5631CFE2C6DD1B52FC278E17460B3256771E5CB2660294332A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688014, "uuid": "3cb563f1-73e1-46a1-8411-0c217f44315f", "value": "12288:tgw1n7EyiHLP/gzIbignpcF0tGuAzgykJ:tgwd7DgD/7bF+dgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688014, "uuid": "dd4de1c3-1235-44c9-a234-41c0e6c438aa", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688014, "uuid": "f655b0ba-00ef-4058-a78d-641ab86d57c3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688014, "uuid": "f7391d99-d9a7-4677-adf9-0d6f4f5ffe6b", "value": "Solicitud de cotizacion.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a44ce8-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674756, "uuid": "9f3ac274-9d76-43b2-81dd-3ffb73a1ea02", "comment": "Malware payload (SimpleHelp)", "value": "38015270f998ff32cd56556efc9bf694", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674756, "uuid": "947d6ffb-1ade-41d4-8184-ce2a84e994ba", "comment": "Malware payload (SimpleHelp)", "value": "4c494c7d16ede4dc5ece9cd3c24cbfb6308275f4b96c578453929183a25c1068", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674756, "uuid": "bd680722-7244-4c57-bad0-a4af21eacc55", "comment": "Malware payload (SimpleHelp)", "value": "b3bbe025fb37871e3176563825ffa4f1ddb3dbcb", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674756, "uuid": "7b2b7021-8796-4d05-9c5a-c2553c36005f", "comment": "Malware payload (SimpleHelp)", "value": "13308c405ee8d8dd0f98848d4ddc451591c871d0e8f151d67412602fe6d1a9597f891457fa987ca90f054141874a448f", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674756, "uuid": "51f73681-1225-4138-ba62-42f950000969", "value": "T199773324FAA16DBEDF33D5FCC0464147AA5AA4A70389121727F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674756, "uuid": "8505d338-4365-4a58-948b-6e81fb444f12", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674756, "uuid": "c3870203-327d-4044-9609-4b77f6fdf158", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcc:K/jkCgpPUK8PyL7M8aE1VWhroHFcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674756, "uuid": "3a20e80f-0fad-4240-a17b-ae1ec8e0cb19", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674756, "uuid": "1d8c4dd8-1c6c-4db3-9abb-efb351fd149a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674756, "uuid": "00d82293-fefb-4e23-9bc7-45de036cc49b", "value": "4c494c7d16ede4dc5ece9cd3c24cbfb6308275f4b96c578453929183a25c1068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93d8ceb-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725276, "uuid": "69913a82-60e7-496e-939e-73230c068b34", "comment": "Malware payload", "value": "6afcfda831eb767f89c2769e479ca0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725276, "uuid": "8053ada7-67ad-46dd-8ebb-8762c5537adb", "comment": "Malware payload", "value": "4ceb6c4ad435d9f6236a90f3659a9939e6375cbd4a1a0573a76d0b7d421eb711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725276, "uuid": "d32026c9-03f9-49bc-9706-c8fa4d7519f1", "comment": "Malware payload", "value": "203c9c6e612d5d3d7ffad48ec950ec503a9468cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725276, "uuid": "17f38124-916a-459f-9615-905cce998927", "comment": "Malware payload", "value": "249db6373fa9157ae61cf9cfb63d43a1ca9813c1a7136d9f144c1f09027e665c5c74b4e32dc5b7a977fea467a0d6ab5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725276, "uuid": "360bc8fb-8f76-49a6-86d7-01dc63f36aad", "value": "T140564A03EC9555E5C0ADE630866A9252BB717C895F3523D33B90F7282F72BD06EB9390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725276, "uuid": "d3df7207-487a-4ff0-a275-752fe0c97b79", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725276, "uuid": "a019c3df-c1ff-43cb-a18f-51f5e06b6db6", "value": "49152:5kwEoG/oP/Ys2ujd+BWwx+GUcepWJUkhCULp2w5//5+xvGT6lzLo1XfKiK9KvYag:5NiVzgNWlQUUwcDvUbYuEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725276, "uuid": "7f2d4b46-056c-4bac-ac97-c4cae00d1eb0", "value": 6432216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725276, "uuid": "c2724d00-92d4-44e6-afef-676d6a524665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725276, "uuid": "4c242e84-ffa7-4a07-a44d-e2830e808e4d", "value": "4ceb6c4ad435d9f6236a90f3659a9939e6375cbd4a1a0573a76d0b7d421eb711_a5193fca-06fd-4510-ae21-a7b643715209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5cca86-3ca9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776683325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683325, "uuid": "80fb6a5e-ad27-4392-b81a-959afed58699", "comment": "Malware payload", "value": "0e3d9ca2414d3ecd677f6fec5ba3091b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683325, "uuid": "c9ea739f-9366-4dbc-bf22-85ac94bdbe58", "comment": "Malware payload", "value": "4d6c0d65d01270a5a816cd6db4bb69652375a178d2d8b9eb25b416f51bea09d7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683325, "uuid": "014caaa3-d77b-4c21-aef6-9348220bc581", "comment": "Malware payload", "value": "1ecbe4f68f5035c2090fe8006af11a5406b0931e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776683325, "uuid": "2f3a03cc-fef5-49ab-8248-591f1b093f9c", "comment": "Malware payload", "value": "e6cba74f0d151020d3a8bae5da2b53c2e75eecfa1d44bd03249524ef78fad8d66f56b8b015acbb7eacc724a188023717", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683325, "uuid": "b9e719b1-012b-45a3-9f0f-440381877241", "value": "T16E245A4114F6902C7877CF50AEECACF6C98DF4142999B2BF0484C96B9FA191DAE17372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683325, "uuid": "61e78a8a-e1f7-4079-829b-ba6bb1fc4eac", "value": "6144:PP5qO/C7aOuejq97HPpm3NH1+SGlxPKH77m5ThB:PP5qOkaTWqlpm9V+SK87uThB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776683325, "uuid": "389382c5-2a3d-4cf6-a526-788044876909", "value": 220352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776683325, "uuid": "b9c9d297-0c76-4134-9014-60f2e4d13992", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776683325, "uuid": "e30cb595-176e-4c25-8d5e-5cee6a7cd2b8", "value": "DR450000000227897.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c32509-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776697408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697408, "uuid": "36b2474d-85dc-462f-bb2c-a66c4ced1ee4", "comment": "Malware payload (DonutLoader)", "value": "609b0898e9639b3556a5e6b090caee9f", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697408, "uuid": "829ff41e-8a32-4e1c-8f81-b04fc7a8c995", "comment": "Malware payload (DonutLoader)", "value": "4df6bdc9a7047fe0d7b5ab84e11effeac7aec15646b5989fc82151c2a9b9291b", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697408, "uuid": "b8555c19-3745-4e5a-9586-91acbec2215d", "comment": "Malware payload (DonutLoader)", "value": "8769f891f0be856211e93ef32975190e5c02e007", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697408, "uuid": "9e14cc07-6a18-401a-8267-8e7e410773f4", "comment": "Malware payload (DonutLoader)", "value": "ffb3c990226ad87796c7678f4cac6eb9bdd666387387c3975719137221df8e28e1a3fb979ca1a242a7f73717e8c12062", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697408, "uuid": "4cd114af-d27f-49fe-8de7-47152daaa015", "value": "T14B86E8A4C0FD7324E9DED71DC0AAE669085E246F6A2CEE9E207F402C2D55F6B09540DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697408, "uuid": "c460e5dc-1921-4ec5-bdde-6566d869f4b9", "value": "196608:m8ZSET1bgtJ107L61HCUxDcS/TwvK5incWA:BM3sLMiUlcWsNni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697408, "uuid": "641c5b4d-d3d3-4747-8d25-542506201f5c", "value": 8103292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697408, "uuid": "8afdb748-4695-4cd7-9f0a-48d428dd001d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697408, "uuid": "83213b5a-e5b5-4da4-a869-9956856c7e68", "value": "MACHINE QUOTATION#00864431.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b08ee9-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644959, "uuid": "29c4b5b0-c4d0-412c-865b-479ba0a2aa85", "comment": "Malware payload (Mirai)", "value": "fe021dec91b2715bbce4d49aecb4b2f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644959, "uuid": "f33eabdd-60dd-4552-8672-82742024eb5d", "comment": "Malware payload (Mirai)", "value": "4e3a95f73f130edb913771611fcd42304ba5a1b0b926b6b47d771a6e720bf47c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644959, "uuid": "f33ed518-fd78-4a1e-9c3b-5081c51da41a", "comment": "Malware payload (Mirai)", "value": "630f1923980bddff5b2186a4c8b7e31d93878c9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644959, "uuid": "f300ed29-545f-4d41-ac03-49f41d3dd0b9", "comment": "Malware payload (Mirai)", "value": "c21391485b69b768e66fa2077e2ca5bda1e6bb1f332951ad5be555e730000f7bbed7b436a2a43a8d05cd772efd5e3e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644959, "uuid": "725bb084-5955-49cf-9366-62271e4e61a7", "value": "T19D130807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA129986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644959, "uuid": "f297880e-2ebd-422f-a582-cfcc8241b1ab", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4/oTgjSAnW4t/TWufBT74h0:C4jKy5klH5lYFsTbUoTB+xt/TWuFsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644959, "uuid": "17502992-8d0d-4e25-bae1-4d6e34750523", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644959, "uuid": "de9929cf-9bd7-4b2c-9aa7-2e68d3564455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644959, "uuid": "a5d6746f-16de-46fc-90fb-d46ed964064e", "value": "00okx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8709d4-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725340, "uuid": "0941ccf4-ce19-462c-aafb-3ff3a3719d4f", "comment": "Malware payload", "value": "20c99d2aeb62c5f7edf8a95fff507379", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725340, "uuid": "8d45a67e-3340-460a-9620-1c2a3a6cd1d8", "comment": "Malware payload", "value": "4e3d454f9915fe65b336607ce0d935e9bd136d1196511793d0652894928206da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725340, "uuid": "79716200-a1cb-4903-9012-497f722164a5", "comment": "Malware payload", "value": "9875d2a6a672e9ab79bfce58db0c738d2da09fcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725340, "uuid": "555d149d-3f87-4da0-8480-657e3bae42e9", "comment": "Malware payload", "value": "0943c4aa04ca844eff7d342c7d8ad10ad9382061f42cf7d5c7a835d809fe36c40ced80ec41653c7d2042d3ee1348691a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725340, "uuid": "267d50a8-6da1-4344-93bb-93fb48dce4db", "value": "T1FAB35A5B62F501BBE1B7923885A34A06D7B2B8155760AFEF03A4464B5F233E18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725340, "uuid": "72a5f837-98d7-4e49-8a27-08c769b4e9e8", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725340, "uuid": "ec889372-67ba-4ffc-9371-5e403e4d04b9", "value": "3072:ogoll4YSI2bdOASdo5XjaZsIV1dqP5NEWhw:olLeAdoZ+VC5G4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725340, "uuid": "34b317f6-d7ce-40cd-a2c4-edfca3a2b2d9", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725340, "uuid": "714be200-f288-4103-a8f7-0b95cca05f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725340, "uuid": "0a29785b-6c63-4947-a9c0-cf2217f5d803", "value": "4e3d454f9915fe65b336607ce0d935e9bd136d1196511793d0652894928206da_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad8fa4-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676467, "uuid": "9d62d8ba-d2a6-4ae0-a657-d1ba1c011c6a", "comment": "Malware payload (ConnectWise)", "value": "9304caa991d6ce64e94ca0731a73a284", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676467, "uuid": "5659db91-8195-4fa5-91d1-0c1b2438c0d9", "comment": "Malware payload (ConnectWise)", "value": "4e4e056980302715b5cc2cc7b479f3bcb1bb43733c16c6751ea7af9246ec08a1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676467, "uuid": "211cd766-fa23-4f07-b2d9-107d498200d4", "comment": "Malware payload (ConnectWise)", "value": "8f46612573a4b85956a2f65be36e21c01434dc01", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676467, "uuid": "a5e4e7eb-d4bc-438d-aa57-576557a9a0a9", "comment": "Malware payload (ConnectWise)", "value": "55cc74bbf4bf60e19475ee9eca54c7d69e8e2398e8e5265f2c604dc4363c9696dcd5d3549b126a0b0baa7a1c9bbc481a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676467, "uuid": "a61d0baf-aa4a-45e0-8ea3-8350a0ed0b6b", "value": "T17346F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676467, "uuid": "85c5a363-2a39-4c24-95ec-16afd103ca05", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676467, "uuid": "ffa31af4-100d-4336-b2f2-757d320ba8b3", "value": "49152:8fRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:gqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676467, "uuid": "da0da2e2-bca0-4016-a1d5-94d84ff0c278", "value": 5649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676467, "uuid": "71865fa5-6df1-4ab7-baec-a00392b8b7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676467, "uuid": "0cf186e3-dfe5-4cb9-ab76-351631f114c9", "value": "4e4e056980302715b5cc2cc7b479f3bcb1bb43733c16c6751ea7af9246ec08a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a671f3-3c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668783, "uuid": "de3cb960-8fe4-4f1b-bdfa-1c5950b56e78", "comment": "Malware payload", "value": "62d92a2748f4da5e29dce94fa32b1625", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668783, "uuid": "3dec96f1-0fa1-4237-9267-ce3e9540be75", "comment": "Malware payload", "value": "4e93764cdb5ecf8db78896be4bf6486d0acdd9b6691aa31b5e0de44a2bbf1692", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668783, "uuid": "5b628835-b284-4d07-9eae-8214ecf85fa0", "comment": "Malware payload", "value": "11080a1ddba34a7ed4b80bffa31a8dd07d57b6f4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668783, "uuid": "c2c2ee48-f9de-4ef4-ad28-97a3981a1932", "comment": "Malware payload", "value": "c353405fa9dcb3e3f6c647d212ca881f811a47561d7b880c4ed33dba38ba32883f81ca8aa4a41b86d1193b8787c0fc91", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668783, "uuid": "d37b7ea6-6ab3-4c28-a7e7-d63b178a0a9d", "value": "T17DB79332CE450D678AF2627C69658AE3FA60AF2F1380591BBDFCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668783, "uuid": "8d15a88f-7a49-43a7-86bf-dc4abdaca592", "value": "98304:KIrvGziPMBUDrfMHPK+97uJXdfSxJ39qg7WlE/ojBnnnn0v1Zv0ml:KSPfMDayRqlE/ojBnnnn+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668783, "uuid": "9a40f40a-52e6-4a87-a6ba-9a4a810016bb", "value": 51347456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668783, "uuid": "ac4bc86b-9f96-4781-9a5a-dc15d1d8b7d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668783, "uuid": "ebd335c7-b723-4f95-a343-4a023e4c4861", "value": "4e93764cdb5ecf8db78896be4bf6486d0acdd9b6691aa31b5e0de44a2bbf1692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56383167-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725003, "uuid": "b70f65ab-d608-41d1-86f4-e5eff1520e66", "comment": "Malware payload (EvelynStealer)", "value": "93bcf85c325621fbe5f60fa3a21b062b", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725003, "uuid": "d2969ea9-10be-4e7e-8e2e-db1ae1621cc2", "comment": "Malware payload (EvelynStealer)", "value": "4e962253eaad130a404a4920d629d881b2adc3b718ecf9d6e2544edd4ba8a4a2", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725003, "uuid": "8e483635-5815-4e65-9a46-d170020e13e7", "comment": "Malware payload (EvelynStealer)", "value": "880349e655dbce699bbedb09dd7d097b7e5ca802", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725003, "uuid": "7c13b57f-fd2d-4d15-923c-3c7174621e49", "comment": "Malware payload (EvelynStealer)", "value": "e342d64f83558d2a9af43fb878d28482a08590a4011a431b94ddab5be3b478d3f9c6a574ed356876e1384e3aed4159e1", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725003, "uuid": "de5a59e1-199b-4d70-a19e-318eec696371", "value": "T141040912F39760ECE1B7D1705BBBA233A571BC5945F0B92EA5448A387E10F50BA38F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725003, "uuid": "163b9889-8f65-4e98-836a-6290fe7efe67", "value": "f65036381332bdce4f4cdc464cdfaab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725003, "uuid": "53245851-0d0e-4e43-868c-145b9fa73edc", "value": "3072:w7MwDX6Nx948gY+jOOCL6lQmkYFwkeEIJzZw+dO1gyugnBz2d:47DKNZgpwWXYdJFdiwmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725003, "uuid": "6b5972ae-75af-4df5-8c56-15ffdf83f4bd", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725003, "uuid": "865c0eba-d302-4f6f-ac83-adc2484a9b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725003, "uuid": "37f54ac5-4ee9-42e4-b971-53dc293af3c2", "value": "4e962253eaad130a404a4920d629d881b2adc3b718ecf9d6e2544edd4ba8a4a2_0103a02c-da27-4d2b-ab8d-132a98969d36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7b7c76-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688343, "uuid": "7cb653fe-88b8-4baa-b700-5be1a8d3aebb", "comment": "Malware payload (ACRStealer)", "value": "c11e6e9e240423655b919864457f1142", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688343, "uuid": "3fc15d98-1e6e-4971-a3a5-c9ceafe21ad9", "comment": "Malware payload (ACRStealer)", "value": "4ea70440dd3b377f45b0ed5cb9d8b06357f4916b4aa2549c394213fc56cd71af", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688343, "uuid": "8e458352-ff6b-4d9e-ae3d-2bf0e6491cfe", "comment": "Malware payload (ACRStealer)", "value": "aa42d630d7382f02bbbbd41d06945f94c1dbd67c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688343, "uuid": "57c0cb68-1d50-4492-9da1-ec4d51329452", "comment": "Malware payload (ACRStealer)", "value": "7bcf5ee7a9a64f41a7b08bcd3f419845478ca3bf85c095c9c0fe7e11364847014bd10d21c4aee143ba15904f1c3a1dda", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688343, "uuid": "dd639aac-a0ce-4746-993b-41584e7fa67b", "value": "T1FC168E1BBCF91C6DC099B13484737605F664F844672227C71AA0F6282F7B7E25AF9B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688343, "uuid": "d14d3844-b4c6-4b6d-aa06-16115cde80da", "value": "5f54a50c21a18316fe1c0f6044946940", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688343, "uuid": "a453429c-099b-4d79-ba3d-b677dcfbf796", "value": "49152:etbIOBw2gtm2XLmOdRuv1cJKVI8FUx4jhQcQypICHS:etXKO1cJKVVFuape", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688343, "uuid": "ecfcc3ab-35b0-4823-8ba3-119cfb922376", "value": 4342816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688343, "uuid": "5251a79f-5287-4fc7-a316-05efef43d569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688343, "uuid": "b49efdfb-a766-4af4-8975-625f5ddddd5f", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e876dabd-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725248, "uuid": "9f4760f4-499d-4acf-bff0-b4c814dc6d15", "comment": "Malware payload", "value": "edaf22acaf704a7bee0d5a8d0fe53154", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725248, "uuid": "4fc07c01-fdda-4c1a-b342-0043e713db87", "comment": "Malware payload", "value": "4eb59190db9df5c7c07f766579500058b1cc99fe5627e3362cee7f775337d465", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725248, "uuid": "5c027bbd-e29c-412e-a62a-ae9abd43e733", "comment": "Malware payload", "value": "adef8d561d17fc0af36d76eea10e1e7480f0c38e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725248, "uuid": "71c6200c-a5a1-4323-b40e-b25f71325acb", "comment": "Malware payload", "value": "c06e8183e121441d23ff00edffbee3bf54e71998fc1c90c915bb9cf66d7a61f2c86216f557bd13ea2b0d9e8ab7076f94", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725248, "uuid": "c3e75256-6323-4650-b6e1-2c952e46fcac", "value": "T1A6A34A5BB2B600BBE1B68338C4570A45E7B6B8554761AFEF43A0425A1F273E09D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725248, "uuid": "5166863a-ff93-4fc7-aee9-95888a2f1936", "value": "0fd9902150a10ebdcba803b76e55f48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725248, "uuid": "7ada7161-52d1-4133-ac69-a19f4026b379", "value": "3072:4k9MwulKXezak9QbNOkzviKtHAOjzJoyfm2GgzskZpgyzfWHRzT9aiD8V3QPx:4kSAXIMNOkzvhtum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725248, "uuid": "42490b1d-1b43-4c8c-914a-3b411646042e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725248, "uuid": "48b4ff14-eb0c-4e52-8d76-5ef63a4b68eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725248, "uuid": "8b5726eb-6cf7-4806-85d8-3d6be99f6a49", "value": "4eb59190db9df5c7c07f766579500058b1cc99fe5627e3362cee7f775337d465_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83a04a8-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688311, "uuid": "2ae6a7b3-ca56-4323-8173-edff8c6c3195", "comment": "Malware payload (ACRStealer)", "value": "5cf2cb420f9573437cc2ab8d7455f2bc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688311, "uuid": "f716b3bf-8218-426f-9ba5-d01997896c6d", "comment": "Malware payload (ACRStealer)", "value": "4ec04f6789c287592ae455bd013a51f4e85396374042241222dbd3937982aa1a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688311, "uuid": "64d6e53b-3e6a-4286-8afa-3f1e80afc381", "comment": "Malware payload (ACRStealer)", "value": "0c5cb618bd5d57610b8363f1bb14e87c68df98a6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688311, "uuid": "bbcd12e3-d2f9-44b3-9e94-b28abc9a701a", "comment": "Malware payload (ACRStealer)", "value": "5633a74d6f17ce91f9989cfdf14ddaabfe3196d3c09cd08235d80cf524647c167e751a47594e90f8d63f7319b14fefd5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688311, "uuid": "3b7b5539-77d4-4edb-a569-075a7fcb4a8d", "value": "T134169E1BBCB928A9D09AB13484736605F568B8451B2327D716B0F7282F3A7F05EFDB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688311, "uuid": "5b40c88c-664c-4608-900c-abcee08d0392", "value": "0ce9f78f25d90c2fbc242316fb9e87e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688311, "uuid": "497feca1-97af-45d2-9a72-af6a630e514e", "value": "49152:Uc3b6lnrb3Q1merYkK6/eIMIYhRaGJZxxwBYAr9qjLxNDQcQnE6xaP6s:UcrQYMkt/ucxRts/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688311, "uuid": "0e86937e-ad49-4b3a-b2cd-c6ae3d86452d", "value": 4310504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688311, "uuid": "3afd52bc-dfbc-4096-a01e-e2d0b9700c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688311, "uuid": "8485318b-6e90-485a-8a62-3c026d683ee6", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3408b5a6-3cd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776703900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703900, "uuid": "b518681a-e048-4bc0-ba62-b24ae0318e1d", "comment": "Malware payload (Mirai)", "value": "331d07e29c64ea0f47d1395fd1fca591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703900, "uuid": "f7c08ea5-ba59-4939-a686-352faba8664d", "comment": "Malware payload (Mirai)", "value": "4edf82afcba4a7b7bbd66f933329de1f50afa2787febd8d0d0ccc157c5340d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703900, "uuid": "9f8aa3b5-588b-4aff-865a-734dde5fa59f", "comment": "Malware payload (Mirai)", "value": "0743981841f99ce4ad7c60e4718189343a92bc93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703900, "uuid": "260887b6-3071-47a9-809c-c3de1cb4ab7a", "comment": "Malware payload (Mirai)", "value": "1e057afd4a651bd97f13b12f0d95d7662f4ba0c93ff581efe9cce748f44549fb1c6dd051517a60a542dd274319fd0f2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703900, "uuid": "bc3ca273-f73a-42c3-b597-47a7f8ddc505", "value": "T10E734A84F98785F2C547483041ABFA3FDB32E9E411A1CB4DEF969F35D933502AA13649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703900, "uuid": "c858fea3-e9c3-4c29-9fd4-03d256202c03", "value": "1536:KcYw6+9LGDqbeV2afxQwE7fWf81RQ2LkivL73CJbfSUL:KcYyLGDqbeV2afxZEqk1RQ2LVvwfSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776703900, "uuid": "2f5f3b60-bc2e-4173-8ea6-3782d4866773", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776703900, "uuid": "351fb4b0-4830-4f35-a8f6-0f6a23aba61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703900, "uuid": "031aeb1e-1915-4c7b-88e4-e860c13a41dc", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc28f7b5-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676667, "uuid": "9a8ca993-5697-4e58-a316-bbd01c20c08a", "comment": "Malware payload (ConnectWise)", "value": "c966f70075981ada7e032abef893270a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676667, "uuid": "d4ccf054-ba0a-41c6-b7c5-6aa2ccd38c3f", "comment": "Malware payload (ConnectWise)", "value": "4f0cc3077af501b6c40baa59bb80dafd68a7e64091f41731d27335e967168ef6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676667, "uuid": "11847442-b949-47e5-88d5-17f9c50a3671", "comment": "Malware payload (ConnectWise)", "value": "1061d6f44081191f3ec2976e4edcbba7590aedbf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676667, "uuid": "f1e7bcca-64cd-42c1-922e-df220b4ba5ca", "comment": "Malware payload (ConnectWise)", "value": "9bc354eedbbac36e2c9b0b18ffd5f9261ad6bc2566f74d8639fd43af0a27d9474c9eef629e0aacb640be275dadbe1ac1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676667, "uuid": "a3f6d996-97c2-4ce6-b0f7-bf231aa8e4c6", "value": "T1DE46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676667, "uuid": "5737e053-8a20-4012-95a3-2638a74b5ef4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676667, "uuid": "2a9f8c8d-d98f-465a-91fd-ae0b4ba1054b", "value": "49152:OEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:7Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676667, "uuid": "f8a6e76a-12be-42f1-9545-869348f816fc", "value": 5622616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676667, "uuid": "53de5116-62ae-4fbc-95a8-859b65f9d9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676667, "uuid": "9b3ebbc4-e63b-4b8f-bc96-07a4620b0023", "value": "4f0cc3077af501b6c40baa59bb80dafd68a7e64091f41731d27335e967168ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f12673-3c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644978, "uuid": "0cc74979-7c9d-425f-a876-a1d0f5bf1abe", "comment": "Malware payload (Mirai)", "value": "612c127d6abd9861844fad5045d09b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644978, "uuid": "f9f46520-baad-4d0a-852e-fd2c40401587", "comment": "Malware payload (Mirai)", "value": "4f2de54171472ad12fcd08d4dead5dae02e8ac86e7528cf45744b0e17b536887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644978, "uuid": "c820fbc3-77cf-49ef-9652-b89f160df325", "comment": "Malware payload (Mirai)", "value": "4aff715df413443eadc9100c5e7962bd384e4601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644978, "uuid": "51c2567f-4583-4910-b5b5-8808035eb444", "comment": "Malware payload (Mirai)", "value": "2010adb284976ceb3c45ca4be2738d496bf65dd375e809756a2004d80e794a232da687cb79c2ea61d90a20ee85b9da22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644978, "uuid": "7e3d8000-ac1f-4843-a6d7-aa79281bffcf", "value": "T17DB32B46EA818B03C0D5177ABAEF42453323A754D3DB730689186FB43F86BAF4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644978, "uuid": "0bb715e1-aa23-4ee9-b3db-ede413b1743a", "value": "3072:jowtPc4BAtYhkbB0x3U3ofmJ5AM/9W9hl:UwtPc4BAChkbB05UWmJGM/9Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644978, "uuid": "aab3869b-a889-4120-9855-aa0e7eb0eaf8", "value": 114584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644978, "uuid": "ff178a61-8e48-424a-bb7a-ec5e8efec397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644978, "uuid": "c3dcc90d-f977-47a1-bd1b-a7d3e97783ea", "value": "00okarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb026bf-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725441, "uuid": "ced4e0d1-aa91-4529-9d90-e09901e5a125", "comment": "Malware payload (AsyncRAT)", "value": "ddabb2974a54c17682d39c7588917802", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725441, "uuid": "62540ac6-ed04-4779-bfe3-559cb9127f39", "comment": "Malware payload (AsyncRAT)", "value": "503018b1cc677b9aaa756db0135c0575091551d3b9682a23072ccfe0538aa53f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725441, "uuid": "0d3b4ce4-323f-442c-86df-a6ef1dce7ba4", "comment": "Malware payload (AsyncRAT)", "value": "47b2abb24d053e32e7f3e1c7e0e3a2b04453dce7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725441, "uuid": "4bb69504-5f5c-4878-b1dc-e6f8455aadd9", "comment": "Malware payload (AsyncRAT)", "value": "932c5ac48fb414ca6090da126f1e590bac88644d187123e1c97510c0157812b5dffcdd557c340164416bd4610b4da5af", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725441, "uuid": "61ef1e13-ebf0-4006-bde1-354ec43c47d2", "value": "T14B231B003BE8822BF2BE4F78ACF26145457AF1A76603D64E1CC452D75623FC69A436F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725441, "uuid": "2ae0bdcd-dad5-4578-bc9b-c8b7c54f5acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725441, "uuid": "39658663-2165-42bd-8916-262058f769d8", "value": "768:mu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3i/Y47yWvsBDZyx:mu/dRTUPE2kKTkDy3bCXS/Y47yWidyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725441, "uuid": "0b1e9a02-dff9-4e31-9924-a9a9ba87e582", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725441, "uuid": "da05350c-2035-4d3a-91d8-42038e62de9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725441, "uuid": "1321af6c-e4ea-46dd-a544-fd32c92fe95d", "value": "503018b1cc677b9aaa756db0135c0575091551d3b9682a23072ccfe0538aa53f_e7bf343e-668e-4f0b-805f-58981ffa2c5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a8cd8a-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727121, "uuid": "b8ee7af8-c200-4549-a96e-5559c54fc7e1", "comment": "Malware payload (Mirai)", "value": "f59616f08064651d0fa0b9a21abb5573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727121, "uuid": "df963805-6ec3-48db-a163-d06634a669de", "comment": "Malware payload (Mirai)", "value": "50479eca0dce2092c1f9461fd6eb268c34e65e7f5bb6173169a2ed175f40cb47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727121, "uuid": "e8f46ee3-99c3-48f6-805d-d99a4579e544", "comment": "Malware payload (Mirai)", "value": "e203eea2988ac658789597da4f3df1cca6e11ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727121, "uuid": "c54fc598-9fd7-4b0e-8cf9-158edb9333a6", "comment": "Malware payload (Mirai)", "value": "ef6a8e407c34b074a7b92a8f6faea7015dd4a373425420c7be939fb7c53a35b551785701a135926aa6845af6163564d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727121, "uuid": "8af8791b-b6fe-4c49-a073-eff83d7a4ad8", "value": "T1A203E162F93004A9DA7CE0780FD90B615D791F5594261C2BB4D3E743DBE30B2345AAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727121, "uuid": "0a63553b-045d-4ad4-ab71-afe0e9b4ff55", "value": "768:HyI187beFSc+RX4qCw7kwGDGRfHB8k5vNJgGlzDpbuR1JT:Hyf7beMbIqCw7jcGX/vnVJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727121, "uuid": "641b3cf5-16ed-49e1-8e21-ea2e93ad2c15", "value": 38124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727121, "uuid": "45683f75-337b-42b9-947b-27c168d81a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727121, "uuid": "39604e60-82e8-4839-80fe-6c499e822526", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa71db9c-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726137, "uuid": "3dadf84d-f988-4fe3-8e76-41cfb10015e3", "comment": "Malware payload", "value": "9d49357f72ecb1b1b31b747d91e7c8d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726137, "uuid": "d66eea93-3d62-44d3-9bf7-5a00a3a7b797", "comment": "Malware payload", "value": "505a40deaf8f2ab81980a2bab38b1f7d88d6c856b799d8dc087b5f258af9b1c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726137, "uuid": "efb87eb4-9e44-45bc-9351-b0a5501a5625", "comment": "Malware payload", "value": "3fbceee349323f3c7fdc7e92d0106aa518be4d96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726137, "uuid": "b095a923-5d1f-4b17-bebd-5ebf2fe51ce0", "comment": "Malware payload", "value": "885ef834a9a01a44ed7e1a848c4ed5614284a96b04324811e157c91c811d86d92e4564d35eb155136bc4882726d2249b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726137, "uuid": "bd539857-0c3d-4160-a580-9dbb6707dfb2", "value": "T11D341C90B281FDF6EC998FB820D2530993BAF081975DEB2B6620FE3C025EB54D573585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726137, "uuid": "a4a5b3cc-a486-4b0d-a056-23cc211d0fbf", "value": "d44c757f4c92cefb83f56cf91379f049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726137, "uuid": "480a445b-eaca-40ba-ae17-1c9235b08b5a", "value": "3072:bFrVl7xAaMj0S+RtKnk7sT2E3KVu7Hy9OiZPW2U2jut3524:x7CaMgS+nKnkA2WKVu7Hy0iZU2jutJ24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726137, "uuid": "91b44dad-136d-48c0-b141-ab76c0073062", "value": 236985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726137, "uuid": "ef48e45e-a340-4167-a35c-d5d29f60e74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726137, "uuid": "bfa5cff8-4c08-48b6-ab4e-12f69000e2d5", "value": "505a40deaf8f2ab81980a2bab38b1f7d88d6c856b799d8dc087b5f258af9b1c9_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8cad78-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687545, "uuid": "e39fbe8f-1271-4f0e-8626-e58c0065e154", "comment": "Malware payload (Mirai)", "value": "a80753c3b43e28354d9d145c8b2cd7ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687545, "uuid": "0b721d7a-4d68-4d8c-98ee-8b7619f4fe83", "comment": "Malware payload (Mirai)", "value": "506db753045581ec7bef8208da64e2bf0d78291ce98354c0c6e3939db93a9dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687545, "uuid": "789e1d77-cc43-4671-a436-c735bb2ac759", "comment": "Malware payload (Mirai)", "value": "d716dc69197317c6c213929fefd673ab26666f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687545, "uuid": "91c6b1bb-c5bc-40b4-af2b-85beec63f248", "comment": "Malware payload (Mirai)", "value": "01ead890aeacb0911d004480f35175fcb34b3fb2a9b209547ab96cbac4791079a15b9ba6bd19b3317c68be4418ed971e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687545, "uuid": "53a2e44d-a2ba-41b6-90fa-026c9c9631c2", "value": "T11053860A7E21CFBCFBAC863547B74E309658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687545, "uuid": "30a3b402-e5cd-453c-8d46-84bc63cc2c12", "value": "1536:uRRNZTbDuTm/O25BVZdLNCSZqBaCK9xIqgQpez:+RNZHDOyzFNCbjK9xIq3pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687545, "uuid": "04135302-2dad-464d-95a0-5cf951876921", "value": 64028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687545, "uuid": "136cdf24-e0cd-457d-87aa-5ef716505a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687545, "uuid": "f5b3362c-b454-4a2e-9967-160fd06108c3", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63efebf8-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725885, "uuid": "d42e72c0-d61e-408c-8b07-f6f7472f5f83", "comment": "Malware payload (AsyncRAT)", "value": "af3e9e1e75319ed62d0cb8b4cff58fc8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725885, "uuid": "f41d9516-9260-497e-bf26-21025ea97c77", "comment": "Malware payload (AsyncRAT)", "value": "5159e64427e5c6d2f9c4132fb2bc565a7216746057aed1da3e949c58af640c40", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725885, "uuid": "69fc1897-c4e5-41fc-99f2-136ee234139e", "comment": "Malware payload (AsyncRAT)", "value": "f837575f4dc53df70989c3fe1370a57cef439a70", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725885, "uuid": "3e2d2fee-0e73-4008-9c95-64c6ee9bfc76", "comment": "Malware payload (AsyncRAT)", "value": "4a4287e6a174b2843ab76810b73cb41beb5ea56857e17fe128072b849ed755b443a81d319ead2195ef87becc6724b7b1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725885, "uuid": "6c994e71-fe91-4874-9216-4bf0d8ac7c2d", "value": "T168034D087BE04615DAEF6FF559B372020730E5179A13DB5E0CE59AAB1F27BC0CA017A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725885, "uuid": "2e0a5e62-d232-46ea-ac32-1c00560f63b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725885, "uuid": "7e388e60-41db-432c-b66b-38b0230b070b", "value": "768:rupCKzJ9087oSsKSagbeFB9W8HO+htFZeq:ruIK7lYAFB9W8HO+7Leq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725885, "uuid": "3ebc4c8e-9510-416d-8891-27ffc489b283", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725885, "uuid": "fca992d1-8100-4c7d-ad86-e6f7e78602a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725885, "uuid": "5efaa4f2-aa2f-48f5-ba8e-b0ff7e6caedc", "value": "5159e64427e5c6d2f9c4132fb2bc565a7216746057aed1da3e949c58af640c40_f0b35d57-1be8-4071-9014-e4f4aa5f062f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bedf6bd-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687243, "uuid": "4ee3c2d1-9186-43bf-8e08-b33895fbe480", "comment": "Malware payload (SpankRAT)", "value": "bc386e45e433b714902bcde2ecf2986b", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687243, "uuid": "ee46ae09-708b-4445-b129-77e99847ed37", "comment": "Malware payload (SpankRAT)", "value": "51801d7f364c52174633adddf1d81960b4ff984a7a512d8051cf3928cb41a56c", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687243, "uuid": "b017a7f6-fc34-461b-a157-ec4fe903c7ed", "comment": "Malware payload (SpankRAT)", "value": "289c35d4154fdbd785fd1a1e50b057756561c463", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687243, "uuid": "7dcd3655-dbe6-4a3e-a8d6-ff4157faca25", "comment": "Malware payload (SpankRAT)", "value": "67d918f79d55f5af7f813b888343c014398b1af39bbbf012f05214d5b126d5becc0ae2bdbd876af3a86fa0fa48fe701f", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687243, "uuid": "30d342fa-d1f2-4e14-ac7e-c24065e55816", "value": "T1E3055D03FA9985E9D59EC03CC75785366A37B4DD0B3066EF26842B183E67FA16B2C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687243, "uuid": "facf5664-bb21-4c8e-bf47-8ad742f0c0f7", "value": "94965649dff3f5e7b9dda771dbb442d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687243, "uuid": "9f0b5b40-c0c0-4b3c-977e-63f7c58b318a", "value": "12288:P1MPEjDjXBVGXBD6lkzVsBZPDbinABCih7C1HQIt:qED7vGRD6u2PZ8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687243, "uuid": "0604e1dd-74aa-4ea2-b566-349b007cc5e1", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687243, "uuid": "00dd9acd-7890-418a-9903-9bda305d9e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687243, "uuid": "586e997c-388a-4846-b76d-755448281503", "value": "51801d7f364c52174633adddf1d81960b4ff984a7a512d8051cf3928cb41a56c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a98fb6-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726107, "uuid": "5268ea1b-b4a5-4ad5-a07a-0d7691c3f29a", "comment": "Malware payload", "value": "c74f326c985e8d19147d0a7fc740640a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726107, "uuid": "aa798589-9166-4893-85c4-8945aabfed98", "comment": "Malware payload", "value": "51f4e8df8b56de1930be0c277ecf76dbe132a1138dff7fdcfc0a0d7cf0d3da45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726107, "uuid": "d7831736-128d-4ed9-94b4-c91d197b764f", "comment": "Malware payload", "value": "96c8e11cf6665467420502dae65a7eaa8f6a9ce8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726107, "uuid": "6da5fd39-75ea-4d6d-a35e-775d334faab9", "comment": "Malware payload", "value": "c87efd3cce1227e5bce1dbeb1c7bc9fa45cc827c2be99b3a9c088cd0ce2234ea1f53838bb8edcdec8a88aea395a20ff2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726107, "uuid": "42b6b438-b133-486e-9f6d-b1a096b8b590", "value": "T181B35A57B2E500BBE177923989670A46D7B2B8114760AFEF03A4464A5F237D28D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726107, "uuid": "7807dac5-4d29-4ba9-a912-772f62edf295", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726107, "uuid": "28934413-e9b6-468a-a2e4-7cd04427da36", "value": "3072:PlA+vkXsN6BdfY0rxDY8k3xmNkFU7PLO5GN8c:1v0suFrxkXY765+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726107, "uuid": "a9d64140-9e43-46cb-aeed-fd70f43fb991", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726107, "uuid": "174e71fe-f327-4c4b-9d7f-8a59545ec4f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726107, "uuid": "a033760c-ee18-452c-8c50-0532ba37df28", "value": "51f4e8df8b56de1930be0c277ecf76dbe132a1138dff7fdcfc0a0d7cf0d3da45_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6d7df0-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673931, "uuid": "c8e3308c-da7f-4598-8ed0-baa80f467cb9", "comment": "Malware payload (ConnectWise)", "value": "8f7a85ca8c0ec261acb9a34047874490", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673931, "uuid": "2e6851b1-b6f8-456d-b4ee-e3ea95f0eec0", "comment": "Malware payload (ConnectWise)", "value": "51fc0d5c3759f6c916fac21356858645c73a873900443f7847f24132125f6b3e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673931, "uuid": "b50fbcef-0669-45f0-9dbf-fd8b40b15f3e", "comment": "Malware payload (ConnectWise)", "value": "4ff5afe4f0c2e99ad3ca47f01dfcecac4cf30f5b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673931, "uuid": "f334d753-c806-40bb-b0ee-c61a97904bb4", "comment": "Malware payload (ConnectWise)", "value": "a4bd83e303fb94a615829d97c4725de8767c1dfb039a994d1dc8ad41f982d5197a1119975ad2a3a25546616c5690a091", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673931, "uuid": "02d7d48a-b734-413f-ae6e-11e279d0c86d", "value": "T1AE46E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673931, "uuid": "01c70b6a-0f76-4f44-90b1-5db241ba5651", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673931, "uuid": "d842c516-775a-4932-97de-98ad7bb56e5c", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zligLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673931, "uuid": "28a74ff1-8f0c-4f83-96f0-4c328e4869ee", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673931, "uuid": "512a31be-5802-4659-9e74-3c8da0333525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673931, "uuid": "78630c8c-e1e8-4120-9541-36fc9e9bdd57", "value": "51fc0d5c3759f6c916fac21356858645c73a873900443f7847f24132125f6b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5365ac-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674740, "uuid": "993fb3df-eaac-482b-aee8-11ba77aaef9f", "comment": "Malware payload (SimpleHelp)", "value": "fc0812677c2947a13bd2c03723aca03d", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674740, "uuid": "80f64fb6-1e2c-4db8-bc84-6cc91798218f", "comment": "Malware payload (SimpleHelp)", "value": "5219ad3fea503746696842b4672cd771facf83c3a513bcc162b210d1dc4c0329", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674740, "uuid": "5993f5a0-49a8-42f3-af10-d81a6892240a", "comment": "Malware payload (SimpleHelp)", "value": "fb05cdda61072e0fb9012913470a1df2d7af22dc", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674740, "uuid": "c1b7eb18-76cd-4264-b02f-87b882c773a4", "comment": "Malware payload (SimpleHelp)", "value": "d6ae1fce5a324be639ca6ab2662565f27cf9242d61c82fe65e112d1eea2784fd49aafe9b18265f473b0eca2a39846ae0", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674740, "uuid": "49acbff2-d65e-476f-9d09-9918cba83a37", "value": "T116773324FAA16DBEDF33D5FCC4464147AA5AA4A70389211327F145E68F207D0862FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674740, "uuid": "c22be434-731a-4183-9291-a3244c50c85d", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674740, "uuid": "590226d7-50af-4c2b-a69e-098f6f290fda", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcB:K/jkCgpPUK8PyL7M8aE1VWhroHFcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674740, "uuid": "88afbc94-eb67-4e70-9901-692c455e5bcd", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674740, "uuid": "788cfaef-e56f-426e-b725-bcf7c79eff47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674740, "uuid": "42425169-ce17-4f75-bca9-589d2d8fd7a8", "value": "5219ad3fea503746696842b4672cd771facf83c3a513bcc162b210d1dc4c0329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf8ac6-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725631, "uuid": "ab0f7bbf-efa9-4dc8-afcc-6b39ac43edec", "comment": "Malware payload", "value": "8889c399da6ba57be7e4bc5f2692880f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725631, "uuid": "75737708-f30a-483b-96a2-374b3b5168a7", "comment": "Malware payload", "value": "5271fde21df8ccd35386cc28647d18abfff93205abae53fc4339769f9867a9ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725631, "uuid": "dc1d2f69-9c75-4b79-bcac-d8a94ce5a9aa", "comment": "Malware payload", "value": "8ab60760567b2263946917c5137d3277f04f188a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725631, "uuid": "07af4ee8-8ba2-48c3-bcec-7a60a097bb8e", "comment": "Malware payload", "value": "56965778cae038c0f292f2f35ddea4af0a0977625e60adb48c73e3cc12f31314648cd29387078b16e93131e289084381", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725631, "uuid": "0da1102a-d74d-4d33-8429-43da0cb5f652", "value": "T1AE72C60EFB0358DDC50EC1B845EF8B32F9B4746286675B2F3260D6762E116B8632EA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725631, "uuid": "4ab7839b-defc-4857-b39a-9f2683fb21d9", "value": "97cd355bfd26c86a2d6dc518a82bee6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725631, "uuid": "e3c7e035-a0fd-45e0-a285-f75538a77304", "value": "192:MjIE92g9U2Xz/vNXXLplWZXs3QjpwQkipUDTndOxoBCKsE5wqZSLUu:Mjf9uiFLTWVGcwBipS+eCZMwqZSLUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725631, "uuid": "85b57f2f-c10b-4879-9a55-856aca6e012c", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725631, "uuid": "27e3a361-69a4-4867-b1bc-be376b271c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725631, "uuid": "34158578-0d52-4539-9728-d1e055a05f77", "value": "5271fde21df8ccd35386cc28647d18abfff93205abae53fc4339769f9867a9ca_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397279f7-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724954, "uuid": "ba7aceb7-3a3a-43aa-b4cb-ac778022d023", "comment": "Malware payload", "value": "d4422c978088de2387bfcf2a26cf7ada", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724954, "uuid": "87c33aff-7299-4e92-9983-8f6db6882fb3", "comment": "Malware payload", "value": "52dfbbf3639d3f692e54df660a6627e58a0e43c002eef3668e497b1a706fc60b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724954, "uuid": "daf6c413-7a24-42ef-b87a-b3792a898f4b", "comment": "Malware payload", "value": "2eda04810aea6f6eaaa566d4866cca05610d9e83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724954, "uuid": "e95d09ce-d0b6-4945-b522-2208bd5250bf", "comment": "Malware payload", "value": "1d25790594a3f625ba9e617ac4acb59e3543c1523bb651a819ad4c95232652e4ff32bdb838b5280265aa6cd756168638", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724954, "uuid": "c02322a6-348c-48b9-a895-c1d44072a985", "value": "T17E341A90B681FDB6EC998FB920D2530993BAF081D71DEB2B6620FE3C025EB58D473545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724954, "uuid": "2a97118c-8381-4860-84a6-49daa7d0e04a", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724954, "uuid": "bf14f1e9-8426-4670-b026-24de59b5ea72", "value": "6144:lqbW97CaMJS+xKnkc2zKVuPHy+iZW2jynXGA:0mC5gXkvOdhHBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724954, "uuid": "6165109c-a915-445e-9ea3-8a525970ac35", "value": 238113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724954, "uuid": "04ccc86e-1ed2-48aa-8dd5-38be7e10fb73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724954, "uuid": "523c90ad-2fe0-47c4-b1b5-0423db2c73cd", "value": "52dfbbf3639d3f692e54df660a6627e58a0e43c002eef3668e497b1a706fc60b_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a291cd37-3c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776670585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670585, "uuid": "30359c11-e9ad-472e-adcb-39448f4f24ac", "comment": "Malware payload", "value": "27072bb8487db2197c814c44cb5d95a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670585, "uuid": "0435a463-5a1e-417c-885a-01256e29c982", "comment": "Malware payload", "value": "53bb86b317a003824bfad940584ece3af263fd724791a43e42bdbd1d3288d8a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670585, "uuid": "68c74a2c-54c3-4076-9fe5-5d6b79ea6c9e", "comment": "Malware payload", "value": "41bb149953b9235372fd265977b17c070bfe6ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670585, "uuid": "18eec50b-a70a-4429-9b78-f536d4add38c", "comment": "Malware payload", "value": "be9c6a3a5c36d413b64da261d63b0de650dde184774c857f153cf76ce11cc556b304e01ae7a68fc4248b5134b10679fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670585, "uuid": "5aa7839b-87ae-4579-8ad5-4f595b608c38", "value": "T1BF13010E0A4D0466C51FA37D67A98B3434D8EB212973A1285F9CF1B9576FFF8AE07006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670585, "uuid": "c2064a9a-e2e0-427e-b2e2-e2571cdad73c", "value": "768:+xLRqPO3EL4woNUXJ9UwcyDo+zBS9qNYZ4fNPoGorun1VGPetg/+mg1hR:ELR+uEPUwZVwqVNP/Vn1VGPetwy1hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670585, "uuid": "f5d724d4-5f08-475e-b365-6c8a0cf5ad88", "value": 44741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670585, "uuid": "68736f0a-83bd-43f3-9da7-2d42473c20d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670585, "uuid": "e1594ba5-87aa-423f-b977-91a37fb180a0", "value": "27072bb8487db2197c814c44cb5d95a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8705bc03-3c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776645198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645198, "uuid": "dcba3e84-ed76-4e50-ab74-b163cebe4356", "comment": "Malware payload (Vidar)", "value": "41d21d9e38f0d85b12cffdc87f55f26a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645198, "uuid": "50a8109e-83fb-4c4f-b278-7db8924e9de8", "comment": "Malware payload (Vidar)", "value": "53ce6a4f580b7b9d572bb0cc6c1b9814c2538aabf58429e3f258548a54f0514a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645198, "uuid": "c92f10a8-7d97-483e-85cd-f68ceae1a123", "comment": "Malware payload (Vidar)", "value": "99d531d462bdd31878373a0ca3c103b52e7c5a5c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645198, "uuid": "18c0db99-27ff-4586-bd47-1bd84255d5b7", "comment": "Malware payload (Vidar)", "value": "d15e746043f03ac15b4c5815e75e9e2328072840a9f596d03c9572dcd3c8a9a0e492fe4a7130db74bfed45780f7831b7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645198, "uuid": "f7dac716-8752-46ea-ad88-8dd1fbd34835", "value": "T12C32377DDAF1FCC0036F72D0596D3F86105C0B23EAA56B6CFAC208A55824699DF3A59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645198, "uuid": "506db9f0-7363-4c19-9c0e-8118c676ba77", "value": "192:ZwcgOcgMWBk4JOCxYhlQB8jQEpT3Fu90RNRXtnfZJNgOIQA0RNRXu1v31N9b9qw9:6chcbUFOKilvjQEl89wtnfZJNgfxwu1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776645198, "uuid": "6e131257-58ff-47bf-95ac-73d50d7f9465", "value": 11353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776645198, "uuid": "0fc0ba7e-28df-4ac2-b346-65373135c5cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645198, "uuid": "ec8a0f1f-f634-4e3e-bcd9-e934dbc05fe9", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545818b0-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727147, "uuid": "ee19c7f9-7d51-48e7-9a8c-c6eda154fef9", "comment": "Malware payload (Mirai)", "value": "a63dc145f19e7a6650e24d02dd3f9b67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727147, "uuid": "39c91c54-73eb-4a8a-98e1-33a6a1a9c3aa", "comment": "Malware payload (Mirai)", "value": "54a6145e2929654c921f6e33347744b07c15efb28bc750e5579032ca7b38d255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727147, "uuid": "3e208b0d-d394-4971-8277-1d5d44228083", "comment": "Malware payload (Mirai)", "value": "06db7f48465bfd860f313f9de595253599fc98d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727147, "uuid": "09c7697a-03ba-4d91-a87b-410273ab82a0", "comment": "Malware payload (Mirai)", "value": "c53506328fa18b26d74e0c706e417d6ca9d18e9f9a8d30dc4d8a7d218fa9de46ccf5d68ef812932c33185e974d096699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727147, "uuid": "c968a87c-f553-4248-bf61-cb7ac03e0682", "value": "T1B7733B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727147, "uuid": "2944c602-9628-4663-9695-58cd04dc0bd3", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vNQ:uB/VBBpCO72RDRZNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727147, "uuid": "d1b4d4c2-f70e-4a0c-9224-6cc7f46beb14", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727147, "uuid": "3ff8ace5-fdb1-4def-ab17-8286096bc57f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727147, "uuid": "f991e61c-ef4b-45e9-8b1c-340a1c10f190", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaee7662-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726111, "uuid": "a73b52b2-1080-4678-b88b-b5fecebc9300", "comment": "Malware payload", "value": "bf01a8e97c1a278f777a12f009dff1dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726111, "uuid": "67e95ab1-0fba-45e4-9494-8affd4ee5f77", "comment": "Malware payload", "value": "54c094506f8286d6a01e3663a6cf395153b51a7ba9b1e1e49e5183ae54db2550", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726111, "uuid": "2009cc3f-6ab2-41ad-b5b9-bea6f64b790b", "comment": "Malware payload", "value": "e885b244a2a705ba2ad4f9c5103ec9a9adb68b52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726111, "uuid": "440a2136-d1b5-4dad-97c3-1edaa1c380b1", "comment": "Malware payload", "value": "93831d48173645500a1d8cf506dbf7a25630345a8b5651ce43a702318e3a53f2aef428788f54d61d0d865ef4acb132a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726111, "uuid": "f04fe474-bf18-4ccb-b71c-31b1868fb7dd", "value": "T13EA34A5BA2E600BBE2B78639C5630A49D7B2B85107215FEF43A0425E2F237D19D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726111, "uuid": "97e740f0-58d3-45a5-a3fc-1e7f12a43b34", "value": "7202b9d5bdb3b242f5b7850e3cfc23fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726111, "uuid": "339ef4f2-c2a2-4390-8f97-8aa7b70737df", "value": "3072:cPSVjFdvJG+LQbVA1MXloLvmSOo2iePG3ufWC+vr//T/7nM4L3zm2Q9ZVbq+b2+7:vVBdhFMVA1MVaN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726111, "uuid": "28a38c37-efae-474c-8e86-4ea33781f0a0", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726111, "uuid": "5c557405-bfc2-4d4f-9553-c08212cc77d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726111, "uuid": "802c6314-e386-4d07-afb7-b32645a08664", "value": "54c094506f8286d6a01e3663a6cf395153b51a7ba9b1e1e49e5183ae54db2550_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cf8b56-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673940, "uuid": "d9c88326-ccdc-4451-b55a-ba510979e001", "comment": "Malware payload (ConnectWise)", "value": "1546b00efbb134c765d335cfad594ed1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673940, "uuid": "941e7d6b-158e-496c-adc4-4022bd020a6a", "comment": "Malware payload (ConnectWise)", "value": "5513f6751654f5c64dee4ad09e0182d3c204d880f6ed91684bef55e66d7d8397", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673940, "uuid": "92093e71-666f-4425-8efd-e0db675caf60", "comment": "Malware payload (ConnectWise)", "value": "f4d9bc47604c48b709a341820a5e34eb97fc4955", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673940, "uuid": "1fe1f757-f93b-435c-9b78-959e0a314e1f", "comment": "Malware payload (ConnectWise)", "value": "6598624349535742ae78cd9459f0e2378c93d43f0225597a65b82fe1d627a509df9a0dd2904feae2117292f9a8d00f42", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673940, "uuid": "4e709dfb-3eb3-4c81-9982-930da198dbbe", "value": "T13646E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673940, "uuid": "37225ce6-7f34-4a56-970a-8041048c53bc", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673940, "uuid": "4123f5fc-4deb-4537-bbf2-8efe66539707", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlUgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673940, "uuid": "3935feb8-4056-42ae-b994-feeb50ef72ac", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673940, "uuid": "e31e9b22-fb4f-486f-9dde-279217c848ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673940, "uuid": "91fe1f0b-40dd-437d-8a0d-55befecb01b5", "value": "5513f6751654f5c64dee4ad09e0182d3c204d880f6ed91684bef55e66d7d8397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad90c8d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725628, "uuid": "6461616e-78e5-48e6-919c-176b532630a1", "comment": "Malware payload", "value": "610150fb52d22ccb6e7a1dbddc768322", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725628, "uuid": "a399c06e-5783-4221-a643-13edc28bdaca", "comment": "Malware payload", "value": "551959ee1d62b10e9155b50a29ef3e336dac3c2781309aafbbaced37fc1bdeb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725628, "uuid": "c50dfb31-6b79-4b98-872b-32aeb765ffec", "comment": "Malware payload", "value": "6affb81c300eb10a90202e380e9fab00bc4bd70e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725628, "uuid": "cf079f68-bc13-4738-81a7-0fb9fde9360c", "comment": "Malware payload", "value": "e4654c5f9c1dcc5d30963ea704b0c7c29716db2fbcc22d569698d57a0b94f646fd6a89f0d7a822dc0be789107f37b3ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725628, "uuid": "e6d6a645-6cbe-4224-9fd7-97c3f6d61b1b", "value": "T111B36B5773A500BBE0738678C8630A01E7B6B8121760AFEF07A4465A6F277E19D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725628, "uuid": "bfe975a5-b956-4b78-9d1e-b341ebf34e32", "value": "795c030cbb432d39bb155bcc7728c8ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725628, "uuid": "7521568d-2136-407a-a748-f61cad0ee037", "value": "3072:umsCo8ITrpqZjz0FKUYNVuPoNxPCc1y5+4:lv9ITrSjz0gXuP8Is4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725628, "uuid": "bdbff45a-afa4-4a8c-96c4-3786e97d8985", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725628, "uuid": "12a7a187-e1f6-4143-90ef-42a110fe57f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725628, "uuid": "469532b8-85cb-41a4-9557-cbcf34272401", "value": "551959ee1d62b10e9155b50a29ef3e336dac3c2781309aafbbaced37fc1bdeb4_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dbf638-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704839, "uuid": "225635a1-a172-48f3-9843-72f3926a6c5a", "comment": "Malware payload (Mirai)", "value": "589a247a465a44143ff9b5a264922c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704839, "uuid": "48600127-73e2-4386-afdf-2f18f8806657", "comment": "Malware payload (Mirai)", "value": "554d7344e64667eecab353833ef0a4f5d37c3f2040b03ea2436b6601908dfa8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704839, "uuid": "e99b3f1d-ab0f-4088-a1e9-3bfd04ae06c8", "comment": "Malware payload (Mirai)", "value": "a34142b43c8634b2a05606131b284b753c81040f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704839, "uuid": "616f8ab3-db0c-4c6b-8006-5ef11316440c", "comment": "Malware payload (Mirai)", "value": "bbf06d5948039df45a08f9c5630aefd11792c4d5a261f8706812c7fd7af3296adfb2cda0833190c86adc428cf2110985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704839, "uuid": "aefc1c98-4dc7-4e36-87dd-9a8d9f7196da", "value": "T1BBF2D181A3E59B1DE13D60B40DFBEF0A4910DD48F14885966BD8202FB46AF037D5DBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704839, "uuid": "4f9e5cc0-6fa7-4555-8081-01b865c41a28", "value": "768:ZzaePOomlY4qqlTYKCPYK7F+pgoSgaCJTrDIgvnbcuyD7UHQRjK:ZmeGLlVqqlUfHoSXknouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704839, "uuid": "302e496e-bbca-4edc-8428-227beed145e7", "value": 35016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704839, "uuid": "0a47374d-72fc-453f-93b0-7ced5ea7fa9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704839, "uuid": "1572ad8c-654e-4d3c-8d02-3caf8ab9b1c0", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8781b4-3c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (PDQConnect)", "timestamp": 1776671761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671761, "uuid": "4394b7c0-b4b4-4b5a-9714-0eeeb24f3efe", "comment": "Malware payload (PDQConnect)", "value": "2e0d7ac2b3d2f1345ea6a1791f6135fc", "object_relation": "md5", "Tag": [ { "name": "brokerpackets-com", "colour": "#5150FF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQConnect", "colour": "#D19370", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671761, "uuid": "ed85d48a-bcb5-47fd-9a9d-f5b54b5885cf", "comment": "Malware payload (PDQConnect)", "value": "559618e2ffbd3b8b849a6ad0d73a5630f87033976c7adccbd80c41c0b2312765", "object_relation": "sha256", "Tag": [ { "name": "brokerpackets-com", "colour": "#5150FF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQConnect", "colour": "#D19370", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671761, "uuid": "ff2a61b4-0072-4239-a80f-588886a02387", "comment": "Malware payload (PDQConnect)", "value": "ff15881bcc051784470ef48abe82f123dd22b886", "object_relation": "sha1", "Tag": [ { "name": "brokerpackets-com", "colour": "#5150FF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQConnect", "colour": "#D19370", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671761, "uuid": "c0cf160a-1a83-45ea-a82c-9a8a09d5ce50", "comment": "Malware payload (PDQConnect)", "value": "95521977753754b01e0c361fc55afaa0fdb07b4b8628b69e7ee2a8956aa4e2ce64811bff60688a36c430b3af8f6950fa", "object_relation": "sha3-384", "Tag": [ { "name": "brokerpackets-com", "colour": "#5150FF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQConnect", "colour": "#D19370", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671761, "uuid": "a0212e7a-9a90-403d-8a27-a753d95abb01", "value": "T170360119B6940CADD8E64235842EF115AE71780D273C85DB0F7A3DF97E2AAD0633A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671761, "uuid": "4521e26a-505c-4ca2-9b8e-991b01543b4c", "value": "98304:nXAaFvtlLgiu+/OrIG9Ba4BNEb0y9LtluAa6s2FykXR:XnvZqIV4MlvmNGyaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776671761, "uuid": "13833456-d3c6-4068-8ed0-a0e4387b90d3", "value": 5114368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776671761, "uuid": "40de8056-64c6-40da-a1b6-955d29458ed2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671761, "uuid": "dd0df955-c978-438a-8fd9-e94615f71966", "value": "559618e2ffbd3b8b849a6ad0d73a5630f87033976c7adccbd80c41c0b2312765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3669e984-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776666108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666108, "uuid": "89b6bb3a-6965-47f3-a9de-57dfcfbe7813", "comment": "Malware payload (GuLoader)", "value": "7f354d0ab270e7ea8e01f5688b36972f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666108, "uuid": "0295b699-700e-44e9-b5e8-1ed21814061e", "comment": "Malware payload (GuLoader)", "value": "56316afa7cc9642c064f64f1572f8e0c6a70f207f31229609670a6c4515624ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666108, "uuid": "6dba6ccd-25f0-46e3-a442-f43f1fa15684", "comment": "Malware payload (GuLoader)", "value": "e524c03ee568a40acdbce99b417666680df000e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666108, "uuid": "ba6c2e2c-a000-416d-a61f-ba6913e68800", "comment": "Malware payload (GuLoader)", "value": "4a709e2b30677a37d18c8cce1eee002c75781b62510b2005c935ec96d36819ad868333a8f7a1c0c993708b6fce817621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666108, "uuid": "8a3bc46e-e0e0-4b5a-92ab-ea5544c486f6", "value": "T109C4F1E3BA2490A1E426E7F4CCA9D9F5233B3E2EA960691633DC7E0F7C31150492755B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666108, "uuid": "5d6afb7a-3462-4fb2-b595-419a1670ff6d", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666108, "uuid": "c5f6e190-1b8d-453a-9e52-1171dbf5a78b", "value": "6144:mX45rw62BYlzaq8vpyFt3HUZJ0gVRgH4xVvAlGDxuKmB1QIC86gn2wSm6AYZTTgV:mX4OKQAFt3HUTXgY74lGDxa1QICTXZQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666108, "uuid": "8061a7d3-9b16-4723-b17b-c8190ce99d18", "value": 585953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666108, "uuid": "075a3454-5bfe-460c-b257-61bec90bd5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666108, "uuid": "e3bfe79e-f950-4dc8-b046-46be4371bc62", "value": "Reportager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e86ced-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726049, "uuid": "1b316fd3-0210-407a-9258-ec9427e9849d", "comment": "Malware payload", "value": "d7060712a36006e9cdda203b6473d4da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726049, "uuid": "5b3f552c-cf87-4aaf-a868-b9636e562719", "comment": "Malware payload", "value": "56550f342e1297e389a1a62fe3fee82234fab130838682b2d6da0b4ac8965ca8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726049, "uuid": "4760087c-854a-4b3c-8c12-d2525f06a03f", "comment": "Malware payload", "value": "a320f95c06bdd694abb982e1984a0d9f58525065", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726049, "uuid": "fc5a3095-611b-4a87-90b1-dbda79287c17", "comment": "Malware payload", "value": "1a27ec2cad8b3c3deff23f45f2515bf72ba15b382076aaf753470e8a55c1316bba734304614d3ff17e9e4c033987b114", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726049, "uuid": "fc1c23b4-8e15-4a72-9574-bc7cf97305eb", "value": "T16AA34A5BB2B610BBE1B78239C4570A45A772B8510760AFEF43A4429A1F273E19D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726049, "uuid": "825cd5dc-d9d6-471c-8e28-4e3a1057ec3d", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726049, "uuid": "c364d4d4-17f8-419b-8faa-340deb9ca560", "value": "3072:Lq3qp8VeI6CQVOuHIicGmvTpIS/GWmATME5JAST/2njLhbC3G1MSzoQsxOZ0HCll:LlWVHsOuHPcTDzU/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726049, "uuid": "f63d44d3-ff82-459f-afb1-dbe1fe10c469", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726049, "uuid": "a1db8dc3-b530-4ab7-bdaa-c19240320540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726049, "uuid": "a394a566-1122-4b9c-bc43-92e3038e6376", "value": "56550f342e1297e389a1a62fe3fee82234fab130838682b2d6da0b4ac8965ca8_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4ffdc7-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725788, "uuid": "dbada703-7ea6-40e4-87f2-6d5983db61a5", "comment": "Malware payload (AsyncRAT)", "value": "424d1a2cf051133099c625cdd081d63f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725788, "uuid": "90e749ea-b32c-4cfa-9428-5294d84025fd", "comment": "Malware payload (AsyncRAT)", "value": "56a293b29b0147a25d20dc475407f56da8fad99ad07fb18357c90413881b5ced", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725788, "uuid": "d7ad187e-69eb-480b-b833-78c371c07a83", "comment": "Malware payload (AsyncRAT)", "value": "d77c23f54c91de1ee4ef896e996bed52e48a06d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725788, "uuid": "688629a6-6501-44aa-9199-bc90b5fd3097", "comment": "Malware payload (AsyncRAT)", "value": "1ffed8dd56b44c44fc45b7618b0784d3d13ae6a72474419e9b539aced138ee5c96b3cab10e2161d80b5b6fa7a10104da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725788, "uuid": "97d756e4-3eeb-4341-ae86-6c40f98a80e8", "value": "T109F24C083B904226DAFF7FFA59B375020670F5039913EB8D4CD99AAB6F277C045147AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725788, "uuid": "0080ab5e-719a-4aa2-a542-2a280418b91e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725788, "uuid": "62049891-5346-4b30-8338-e48988026c89", "value": "384:eQL75gwVpuuIzSlgRg3J6LN8n4eMFbVcp/6AaK2MAU07pkFMAfNLTYOZwp3V2v9u:rLFgGJ+mn43xcOMvbFJ9YHOMhZ35zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725788, "uuid": "51621208-8340-4722-ad0e-ece999bd47ba", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725788, "uuid": "6830c048-d12d-4030-a2c7-1804072bb337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725788, "uuid": "029b2a25-cc8a-4fda-a914-682240593ec1", "value": "56a293b29b0147a25d20dc475407f56da8fad99ad07fb18357c90413881b5ced_1d6e15d9-253f-4530-8215-b433005274cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdee934c-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674523, "uuid": "76a22b8f-3a65-494e-9445-03e7afe8569c", "comment": "Malware payload (ConnectWise)", "value": "5527dc5c9187c9a197b96ca8f9b34a0c", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674523, "uuid": "bff8f276-d34e-40d9-a271-1bdd7dd9a3b7", "comment": "Malware payload (ConnectWise)", "value": "56d4e72d3a9b143ec707565799c516144a0e8bbf09ba40c0247dc37bca9b1ff4", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674523, "uuid": "3252d8ba-b2ee-45bb-92f4-91ef7df62e18", "comment": "Malware payload (ConnectWise)", "value": "b8d5d99d418115d874d87ab239db71dd689d31a1", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674523, "uuid": "157c2a77-ad4e-438b-b18f-0affedecc8ee", "comment": "Malware payload (ConnectWise)", "value": "c66bd691505d8dcc8d080ab71b461078f4a8c09c32ae8c1819a1e34a367266fbb41d95f753100cdf581db4fcf337221a", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674523, "uuid": "e9f0d381-cb88-4087-930f-7e7b4f3d808d", "value": "T1C99622112BF8A529F1B70A3CF93A95B059BA7C64DE12D05F13A4796D38B1DC08A72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674523, "uuid": "1161aad3-77ec-415b-bd20-9c9a928b3116", "value": "98304:0icRpmus8C0dX2DSuGOi+ZyIb2icRpmus8C0dX2DS0icRpmus8C0dX2DS2icRpmu:0Hm9R0AnJZSHm9R0AXHm9R0A/Hm9R0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674523, "uuid": "6aeabd4f-772a-4cbc-97d7-7720030febd6", "value": 9396224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674523, "uuid": "6e4df083-7952-4844-aa99-975da89e12ff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674523, "uuid": "35345f66-a3d4-4946-9bc9-4b4bfe9dc5f4", "value": "56d4e72d3a9b143ec707565799c516144a0e8bbf09ba40c0247dc37bca9b1ff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d3d6dc-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725222, "uuid": "980cc6db-9c40-4c8f-86fb-efd54d551d89", "comment": "Malware payload", "value": "843aa55ebb8f00e8378501318799373e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725222, "uuid": "1b359d8a-5f1c-4f0e-8c55-5549bb11b326", "comment": "Malware payload", "value": "56d6bb3a7744aa224675155458fa5bb358fbaeddbab81f22b5f405ef7dcbf603", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725222, "uuid": "a35cdf17-ec59-4c9b-bd46-682a13a52b24", "comment": "Malware payload", "value": "d917355a5ef74831c4f0d54690860b1e28551bcd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725222, "uuid": "776531d1-0017-487b-b1f1-b7f114d9516d", "comment": "Malware payload", "value": "6c6f29bd94ed84ccce08d8cdb2e6d117f02a0c2a895ba3b205c58488848686469ee7cbdb3875a4f83aada9e03bcee5bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725222, "uuid": "783e6695-c9a3-4699-82be-739f5ad63fe9", "value": "T102A3495B72EA40BBE1B68638C4630A09D772B8561761AFEF43A4424E1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725222, "uuid": "27cc91ee-dd38-4054-b2a9-ef8e52fc6fa7", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725222, "uuid": "823d9627-02c4-4db1-836e-0da95e4f5d61", "value": "3072:ztd4yN6xpAqJQVAvfhxtVrB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51pyr:JdJkTB4Anh/kXJB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725222, "uuid": "7dba157d-4be5-4190-b05b-f00d7760a6d4", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725222, "uuid": "6e9223cc-556a-48d9-b7b5-54a428d50d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725222, "uuid": "21895b2c-c75f-410b-b2f7-db83d2bb9e1d", "value": "56d6bb3a7744aa224675155458fa5bb358fbaeddbab81f22b5f405ef7dcbf603_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dc99bb-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673952, "uuid": "0591047e-7df7-45c6-8c0b-9dc08b842437", "comment": "Malware payload (ConnectWise)", "value": "5b2f84d6b552ca9bd0351df357158ea5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673952, "uuid": "c09397dd-92e4-4e7c-917b-b41bbe5790ec", "comment": "Malware payload (ConnectWise)", "value": "5715c5499089b699183695ede91ee00882708d45df12d53a41745bd8ba17810f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673952, "uuid": "8858c2e8-48f2-4212-b435-a60aabbe2cd1", "comment": "Malware payload (ConnectWise)", "value": "1e897b9fc5b05e50a3f7ab305180bb79adbf9bcb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673952, "uuid": "09647bb2-e698-49d2-9e64-e24531888c0c", "comment": "Malware payload (ConnectWise)", "value": "a78f75d5ad6773b2ed584041cb59da87c3ec6f57e498ee58f04709e510a71edde909321e733080e87ccd434aa717a7ad", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673952, "uuid": "8cb3065a-f1d1-426d-97c9-9d537c7053d9", "value": "T1E346E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673952, "uuid": "aa57c51b-2bdf-4e8c-9ae3-c768036103c8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673952, "uuid": "77759ae8-f929-464f-abef-7604f239c47c", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zllgLLLLK:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673952, "uuid": "0d146808-98d1-4d7a-bd56-e7133ed3365b", "value": 5788424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673952, "uuid": "d2ec5ddb-3103-40d4-bc1a-15fb7d57fc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673952, "uuid": "d0644994-0021-4b6e-bf6d-ba52489b9eeb", "value": "5715c5499089b699183695ede91ee00882708d45df12d53a41745bd8ba17810f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8b6349-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725151, "uuid": "42a93467-5a31-47c8-af40-b4ef97d65e9d", "comment": "Malware payload", "value": "eefb0f79d5e2ac675d70867b1b612fb1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725151, "uuid": "a3f584d3-91bf-4423-abcb-22a1da7e91b9", "comment": "Malware payload", "value": "575c5f695f6857181003bf60b92632fe0525b186ab7d3357ba148de3f7ab3409", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725151, "uuid": "3ca5913e-f410-4efc-93e0-f302613d7cf3", "comment": "Malware payload", "value": "2b4d025a8723a701d4b54a7900d1b2a5b2a8bd8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725151, "uuid": "d7c5c71f-94bf-4bc1-abdf-505c6b5eb881", "comment": "Malware payload", "value": "9b0f0285ec35f848c7cd6fdcde4fb034e056ff5ee6bc18b99ac4f78feb1a89cc5142303236ed715e4acbcd393dd5bbce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725151, "uuid": "a45bae8c-d392-4082-88b6-fb12c51420d1", "value": "T181A35A4B72E600BBE2B78638C5530A49D7B6B81143219FEF43A4465A1F237D18D3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725151, "uuid": "86457b6f-4441-4505-ab08-26ae93a6a4d7", "value": "89a97c0efa41b17c5ccb77f897c17c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725151, "uuid": "f0a56290-180f-4bbf-9ae7-d424b00200b6", "value": "3072:8R/WBGfzvsiA8GSUQb8wTuckDAtpFrpqpqpvfkTin2mIBFP/:8BwGfjtHaM8wTuFbXmSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725151, "uuid": "e3e43339-bfaf-4c2b-96a3-bb5af0aeb94c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725151, "uuid": "ca51c364-77ae-4582-9076-783b2d18f8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725151, "uuid": "d46fd780-706c-4abd-ace3-460971f91bfe", "value": "575c5f695f6857181003bf60b92632fe0525b186ab7d3357ba148de3f7ab3409_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fddeac0-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776725448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725448, "uuid": "0af5a520-965e-464e-bcfb-22deab5b6fa0", "comment": "Malware payload (Mirai)", "value": "69b4fa476cb1addc41bd5f395db31949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725448, "uuid": "ed4d91f4-f18e-46be-be23-2a31e105c40f", "comment": "Malware payload (Mirai)", "value": "58625ffc34f0bf6d6363d7bdf224f5ff7f50d469ff89121c1f39f2838d5e4d72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725448, "uuid": "0042f2f6-7a16-4510-a7a6-a3f25b105979", "comment": "Malware payload (Mirai)", "value": "e9e1f58669402ca854a82a4921ee2e13e79da251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725448, "uuid": "a01afc70-afe3-4194-9171-07d25308d59b", "comment": "Malware payload (Mirai)", "value": "46d5db247a91b8903182ec355bb16579cc5fc655fca7e5acf293fcf57ef0873d9222bd8740eb261e51ccd478611fc626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725448, "uuid": "92e34178-072e-40a2-9f11-c28f619307ae", "value": "T11D1318DBB4099D7CF91FE7BE94174909F630775550830B2667ABFCA36C321A48D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725448, "uuid": "7992c52f-a1c4-47d0-b6e9-61bb49c6a54b", "value": "768:F7eHhoSSXi6a5TiNCcSdzV7O3xJ0emw9djCDU8n3N:ZmenXjbNXSdzdOL0emwvjCA83N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725448, "uuid": "d5f3cbc4-3e79-43c4-a2a4-4794ed8e93cf", "value": 43596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725448, "uuid": "534126f5-ddd5-4a5b-95ac-db1510904e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725448, "uuid": "5dcdbb73-e2a7-4fe9-9af7-e5e273b61de0", "value": "00okm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4fe3d6-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725984, "uuid": "fca93036-0aea-4ef5-8a99-c49ca44c8efa", "comment": "Malware payload (RemcosRAT)", "value": "ce173ebbc6d829b97d9ce2a2e45fa702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725984, "uuid": "dc64a788-28dd-473e-8383-1bc0085d639c", "comment": "Malware payload (RemcosRAT)", "value": "587e7bbbb8c94edaf90e077f6721c6042e3f46f00e65497cde5513dfbb20cb3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725984, "uuid": "369ba0ac-29b5-422b-9ada-23bde9513538", "comment": "Malware payload (RemcosRAT)", "value": "5079a03c8d7af4362feb2039c72d42a5a6012d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725984, "uuid": "97499b9c-abad-4260-a428-74745530d690", "comment": "Malware payload (RemcosRAT)", "value": "8a04328479c332e8518018bdfe5448c3730d5dd9d438cc3a7619282245711e4ef9d123c90d19555f89314bf8d1e6e208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725984, "uuid": "6f55542c-d624-491c-9473-4484921e7d0a", "value": "T1A0B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725984, "uuid": "578c2bcd-57fb-48ad-95b7-a15cc4d56cc8", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725984, "uuid": "b13fdf22-d210-4df8-8236-d0f261ba9243", "value": "12288:a6pxxGI8gvGOHJpAbDYGxLhZ+sPZt/mPFN:a6pxxx8U+bDYGxLhZtZUPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725984, "uuid": "5b605493-5d00-4da4-bdf4-f820a29c7760", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725984, "uuid": "25ac7f2b-94ac-4399-8835-47c6dd1ae9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725984, "uuid": "bd8d97cf-ca84-4fee-b9ba-87ce9d93477e", "value": "587e7bbbb8c94edaf90e077f6721c6042e3f46f00e65497cde5513dfbb20cb3a_5c5727a2-4cbc-42ba-9c50-388b6847d70e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d641eb-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776696412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696412, "uuid": "177b1588-7838-4fd2-a5ca-eedeacd6ce1b", "comment": "Malware payload (PhantomStealer)", "value": "6e2dc6a227753471d7a56e400a90a0b8", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696412, "uuid": "2bb5ff43-fe2a-49bc-b16c-98eced32e739", "comment": "Malware payload (PhantomStealer)", "value": "58e2dcc92359786951cf50c1dcdbc0733d22089aea02b362ff82ebd7e5cc7b4e", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696412, "uuid": "58a40666-3d61-4199-8076-26842ee99c09", "comment": "Malware payload (PhantomStealer)", "value": "7ce650554809a7d9cda65fc90a0dfb47fd6e18f1", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696412, "uuid": "bc49a318-3795-4f67-87d4-12153f6b7d5b", "comment": "Malware payload (PhantomStealer)", "value": "2e68a60560656426b593504f8d91acfb23d6d600a121573ea1dae9494ff7e27da5761a59f34b45b705a268469b4d4412", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696412, "uuid": "367b0f53-1015-4b3a-9090-5f52e63370c3", "value": "T16C633D9E4BE00CD0EBDB0B5F59C30867BD18401A8558C8DDDE45E69A97F2C2ECE1A8DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696412, "uuid": "26a635d7-2d31-40d6-bbe2-a005bd178d0b", "value": "1536:hQAKuZn9p9huE42d8lHhEvgsDid2eHqv5nl4flCCTCjgV0EC+iJw7XcOu+Zs8Vp1:XO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696412, "uuid": "5fb4516f-fcc3-4dd2-8055-b05dd133ffe4", "value": 67682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696412, "uuid": "d83e7756-fe95-4d31-b43b-ef03c8d7eb35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696412, "uuid": "221e37d1-e755-4c15-aba5-75a0b6cefb9d", "value": "Teklif fiyat2026-20-99.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827dbd20-3cae-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776685563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685563, "uuid": "5cd306ac-58be-4c8d-8ed5-09cf3d6de43f", "comment": "Malware payload (Gafgyt)", "value": "f113918a0ed6b50f735597f966eefac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685563, "uuid": "68b2db1b-5657-4f59-a2bd-cff484291a3f", "comment": "Malware payload (Gafgyt)", "value": "58eebc9b7f61c6ee91b3b621866a65c469d2a73db69dc2c7f0346ccaf5407b32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685563, "uuid": "a2e4eeb5-b3ea-44bd-a2c6-2085719e1a9a", "comment": "Malware payload (Gafgyt)", "value": "1960a95b8a30b4cb7922ce41ed89dda22687c514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685563, "uuid": "d47e038f-f2c6-4613-b036-1a82faf3d3c9", "comment": "Malware payload (Gafgyt)", "value": "9a422ba5ea10a3adb0c6e9233961ce4a1b037a0ee665d05e28337c899ca9978d2cfa038f0eeae8386f4096af036821a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685563, "uuid": "f2c59b03-1634-474f-8073-6eb6497806a6", "value": "T1A143022A1F439455DAF084F4109E8B7011644727B1E6ED0F7D68F38B9E4A87F5C4BAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685563, "uuid": "a37c30c8-1f48-4356-8a22-1f19539fc7ad", "value": "1536:YCHi9p+VgpKP3JCFX4fQFFwXNahJkb8NrnVrYr:hHi9sHCFX4fcwXwy0nVrYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685563, "uuid": "6906208b-ed39-409a-bc70-f300da403459", "value": 58664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685563, "uuid": "ca427994-b3ef-48fa-9052-32ba3aab49a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685563, "uuid": "338430ce-d199-4ad8-9729-dbef1b169bb1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66738318-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725459, "uuid": "3e6b8ef8-d4be-43a0-8d9d-a4707a90152b", "comment": "Malware payload", "value": "94b5bc14076d566fd39ecc6ec289b327", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725459, "uuid": "209b5442-0b80-47f8-b353-2599ffd585e8", "comment": "Malware payload", "value": "5991fdeb3cd1d35a200be41a06ceead3409fc8db84fc7f7a50a8520c8eefbb43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725459, "uuid": "2fb8f9a0-7cf2-4e0f-ac9f-a086ab04e591", "comment": "Malware payload", "value": "96388129e8f51888c34301ff09072b855070d803", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725459, "uuid": "b5bf9419-e9d0-4066-b11c-710185298805", "comment": "Malware payload", "value": "13afc8adde4d864cd27bae284d122ebf1a65dbe0053040732040008a34d81da730925b5f4e3d832920aff9c079db6aa2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725459, "uuid": "7c27f760-ad06-449b-9b87-ee71a52c2814", "value": "T14E43E152B643E8E9D4E69274C8F72331B7B1F1D026725FAD42B0EAB40F809905E29F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725459, "uuid": "c66c1831-76af-4b04-8fa2-855748253663", "value": "ddcc75ec6ffae04a12c67efaca8e537b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725459, "uuid": "5d2ca94b-0020-4210-90d7-395b5479aecd", "value": "1536:qScB9VTttTKSMiZkYfON9zs4KnWo4ubJZcvu0m:FM9VTtDlkuaMnWo48JSvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725459, "uuid": "93a418b0-fe74-4271-a4a2-3d2a350a4324", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725459, "uuid": "9e743681-80bc-404e-a099-91ad03a9d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725459, "uuid": "0bef508f-5d17-45f3-a682-e3254528e13c", "value": "5991fdeb3cd1d35a200be41a06ceead3409fc8db84fc7f7a50a8520c8eefbb43_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97365b6-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674488, "uuid": "17514ecd-2217-47d7-af06-8683c4bbb4ac", "comment": "Malware payload (ConnectWise)", "value": "822c8bdfa497a71b5d9700a8d1a95e76", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674488, "uuid": "d0fdd0c1-1716-4ebb-9ace-24ccf20b86e7", "comment": "Malware payload (ConnectWise)", "value": "59b750a1d27f4e7684953ca218dfec0db190debfd4d6b73b065fb28993ac4b5c", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674488, "uuid": "dadfd88d-29d9-4d55-b34a-57818165869c", "comment": "Malware payload (ConnectWise)", "value": "5d16f16cab4807dc656960c449ecda20975cf81f", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674488, "uuid": "438b0458-2fa7-46f3-ba92-7f6f6b5fc5e0", "comment": "Malware payload (ConnectWise)", "value": "ba45ff0031679a14a1450aad0fe5b5226729259c6b810fb1273baddcf2f5ff57d5004d686b39514d0456495e82709c7d", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674488, "uuid": "a87728f8-afc1-46fc-8ec8-67de71b2bc58", "value": "T147C61201B3E565B5E0BF0A38E87A42656A75BC049712C2BF5394B96D3D32BC09E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674488, "uuid": "641d2ea6-77b1-4265-9605-4b18c9d1c5a1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674488, "uuid": "66aad08f-4060-4134-b6a7-1a6d07544727", "value": "196608:nfefPn9Hm9R0AnJZSHm9R0AXHm9R0A/Hm9R0A3:T5ZZmuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674488, "uuid": "5d42ba9f-08e8-489b-90dd-461ae14e0869", "value": 11904056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674488, "uuid": "c6900c76-2105-4745-a7ed-3a0b76c935b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674488, "uuid": "96274772-ac5d-4b83-aee4-f5ef2170e8fa", "value": "59b750a1d27f4e7684953ca218dfec0db190debfd4d6b73b065fb28993ac4b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665bc0ff-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725030, "uuid": "1bfafe52-d6b3-42d9-974d-3eed5df1525a", "comment": "Malware payload", "value": "06793a940bb69dae411944018914d6cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725030, "uuid": "1659331f-7d7c-45c9-bd4f-e2e8710f9745", "comment": "Malware payload", "value": "5a264e98f0e891e94f655581e8beb124a91c869a86aa591d038d5905c2bf6bf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725030, "uuid": "7ed0ff98-5ac2-40dd-bdc7-1e12772e41cd", "comment": "Malware payload", "value": "0af0d2eeadd756ac4b3de846934abd81cadefb72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725030, "uuid": "147dde0e-1994-45b1-a6fb-152368e77394", "comment": "Malware payload", "value": "726e689ed31000ff98ef051beb7e4643f7746b7e87ebbbca4d9d914185ff7e4b744fb518773c3f1e0e0fb23475d3e41a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725030, "uuid": "feafc577-f22c-4663-b610-bda2ded50b6a", "value": "T11B340B54B681FDB6DC998FB820D26309A3B7F081971DEB2BA620FE3C025EB54D473945", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725030, "uuid": "1d78a5bd-36be-4f2f-bfcb-8f67da2137a5", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725030, "uuid": "22a039a8-27db-4de5-a5d4-83a25afe533f", "value": "6144:kG27Cao7S+7KnkU2MKVuLHyniZO2jq3HQ:UCdedkH7JijOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725030, "uuid": "40b32305-b136-427b-877b-e1b8dfad09fc", "value": 237120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725030, "uuid": "06cbbe29-2cd9-4c34-9927-0b02cdf719e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725030, "uuid": "3c26e6be-bc85-4489-98c2-1aa5203abd19", "value": "5a264e98f0e891e94f655581e8beb124a91c869a86aa591d038d5905c2bf6bf5_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f09d8a-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776725462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725462, "uuid": "848f185b-22ae-4ef9-b5fb-007eeb522609", "comment": "Malware payload (Mirai)", "value": "d60a7ff13cc2e5eecb8be830b10a1346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725462, "uuid": "0b400587-12c1-466a-8905-d289d0c8200d", "comment": "Malware payload (Mirai)", "value": "5af29300555d691955832f48e9b0fe670ec328db5cc7e048ef6f7853921af1c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725462, "uuid": "dc4f54e7-6806-4ebf-9e37-faac2e8595b1", "comment": "Malware payload (Mirai)", "value": "fa706f771dc76cbc63acc5a1f34ed3d4fba321f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725462, "uuid": "cc2f8deb-5c34-45aa-9593-bc6442e400f6", "comment": "Malware payload (Mirai)", "value": "cd085d1cd224ae18a31c6080a2a587cf08c57d6de32f95058e0ea137f7d27e2e88258f85d1ac165f18f3e8087b812bc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725462, "uuid": "96ecfd04-e061-45b3-aa0e-b2b1ac858eff", "value": "T12C034CC8B903DDF8FC1606F42136F77A9BB6F07A2128DD97C39995329C42A05A6062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725462, "uuid": "b4fb89bb-4044-465e-a8d5-c98f2431b404", "value": "768:wZT8epBPi4gJW0KMcjp49A9/YuEGhfqbvVEgouBnk6Py5iE9Ee4V:wZIezPi4gJW0KMgp49Ax8KEvVFxBnk6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725462, "uuid": "7bef1432-6d98-48c1-a322-e84618cb2f22", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725462, "uuid": "1d24ead0-0566-418e-a8cc-e42962c2de03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725462, "uuid": "2ed52b04-4ae2-437e-b0d2-73bbbc433550", "value": "00okx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c757ed-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724941, "uuid": "936e36e5-4e09-4c71-9023-fc346af56a55", "comment": "Malware payload", "value": "2f61708ca7b1f95a6bd0fe8ffc120d21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724941, "uuid": "e41e892c-f36c-431b-9d34-0ffb1cfb3a4e", "comment": "Malware payload", "value": "5b07f31b3bf546f4fae2cbf4f0e889deb1ae762795107db975657d094d275f80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724941, "uuid": "364ac207-8fd3-483b-a6b5-469544cd054d", "comment": "Malware payload", "value": "c91c817e26dd96998b43df0db9d3fd40db1e12cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724941, "uuid": "74ef55af-1787-4939-8a73-43138659507a", "comment": "Malware payload", "value": "ca083329f94f5f39352654b6876e6788c01d79e7bfd4c227a209243086f1b9cf58a9f18655f2181f64cb38a0fbf65af0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724941, "uuid": "917c619e-7a71-4bcc-9b2b-289ee095b39c", "value": "T149A3495BB2B600BBE1B78638C4570A45D776B8454761AFEF43A046AA1F233E18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724941, "uuid": "88e72051-d72f-4a4e-a6b6-560e4f3569f4", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724941, "uuid": "38542071-efbe-4667-a29a-2f33a7cefc28", "value": "3072:7nRSDXaufe5GP2Qb6Ac6imeoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHfvGOB:MXrfolM6Ac6xgr+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724941, "uuid": "cf066c73-2978-4d60-bf36-e22501bd9273", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724941, "uuid": "48aac2b8-b52e-4ad8-905c-d7fabb1161bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724941, "uuid": "5f9eb05f-2cc2-4d5d-93a1-2e474a2cc621", "value": "5b07f31b3bf546f4fae2cbf4f0e889deb1ae762795107db975657d094d275f80_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f0560d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725531, "uuid": "0aece0d3-f444-4e28-9742-94004e0288c2", "comment": "Malware payload", "value": "31621d3a99ea676372c88bcc13dcb1f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725531, "uuid": "ca7a2d91-b399-4941-b062-9586a1beea7f", "comment": "Malware payload", "value": "5b65dcede56b4b78b9a980cb9e6fae7db41722446f98fa041797fdc47e9cfba1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725531, "uuid": "37b3f775-40f3-4d29-ae23-c1081a1b88e7", "comment": "Malware payload", "value": "1355427fc8c44245460f993e6264ee01399f62e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725531, "uuid": "e60855fd-b85f-49cb-8748-a182a808e5b5", "comment": "Malware payload", "value": "b51b491c60634812dec48b32d8d9471adad8a042e8790482b1075322c6a454f8219ce96a59a276c470a9fdd65cd9d1c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725531, "uuid": "6d965b6c-007e-4cd3-a18b-59be3ec92f93", "value": "T117341B90B281FDBAEC998FB820D2530993BAF081971DEB2B6620FF3C065AF54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725531, "uuid": "56cbe137-a075-4a71-82f1-5a8b13f829df", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725531, "uuid": "b9770ca4-4783-44b1-8965-ab232d9ef27d", "value": "3072:/4eckVPxIiTfVl7xAaAs0S+ttKnkKsT2E3KVu3HyuOiZPzJU2j/XChDi3kVPxIir:17CaAlS+LKnkd2WKVu3Hy3iZa2j/XAOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725531, "uuid": "a6a1c64e-a76c-4329-9e12-4e8b15f1a1ad", "value": 243227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725531, "uuid": "5ec4dfec-698c-4be2-aff7-cd1f564b76b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725531, "uuid": "95f40106-5f44-46d9-8d0c-9a0123ba5f02", "value": "5b65dcede56b4b78b9a980cb9e6fae7db41722446f98fa041797fdc47e9cfba1_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501bc95e-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727140, "uuid": "145e6c04-8aec-415f-acac-6add66f37746", "comment": "Malware payload (Mirai)", "value": "ff51ebbc38d05a7c8b261daef6b5f196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727140, "uuid": "1f3d25db-be51-4d63-b2cb-2793c3819496", "comment": "Malware payload (Mirai)", "value": "5c5084195bd95cb926b285ad53296b747886ae049f3cdf0ae6c251cd96739573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727140, "uuid": "54b6f413-7774-412e-a806-0dd9f61dea3f", "comment": "Malware payload (Mirai)", "value": "3e74fedd2f8abbbcbe2777139463c0277afde788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727140, "uuid": "fdb6955f-4315-4000-9da1-c37b484709c2", "comment": "Malware payload (Mirai)", "value": "753ed6d9f9b2d87e6bb96519e2a24c057e10c77ff8f6bbd708d8432006e4087c4bf24f4b414328320cc1e4cb7afd1cd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727140, "uuid": "7549506a-95ab-48b8-8376-3928bc870510", "value": "T12F132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577136C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727140, "uuid": "e9191954-7315-4c78-882d-b7e8d4527e01", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCw8oOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727140, "uuid": "c9b8f690-48b3-41a0-a953-e8b7f954e192", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727140, "uuid": "80e377f7-7aa4-4022-9dfe-e9cf984eccde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727140, "uuid": "8bccb80f-16e2-46b5-9210-3c19429e4521", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04abfa46-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687500, "uuid": "f7ea8772-9291-4893-a6b4-96d31eb79fea", "comment": "Malware payload", "value": "8c0e95a52a32d034276a7d9f45bb1c21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687500, "uuid": "3897c31c-ad12-42e2-b2b2-b5ec4a263902", "comment": "Malware payload", "value": "5cb39df2ae1dc1386c310492fa9bf54ee6b0228ec2cfe32b5f9eb49ad6f64165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687500, "uuid": "bf174a73-58f8-41ea-8aab-5e874bf86dd1", "comment": "Malware payload", "value": "c90cdb8e531ee3ff85ed0be4b214043b2191f491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687500, "uuid": "114188af-bef7-4207-ab0e-7bc0bfe7d8c5", "comment": "Malware payload", "value": "e122ecc453351aae10707bf05ed517d342ff7e970cb8ad5203cee5d9695b3dd9a5f3dcea9861099662f9b92eac986006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687500, "uuid": "3fc44167-0ffd-48d0-80a8-8339f960a959", "value": "T17443F171C06B4A99F5EBBBF06D9C52B263FC5697A52F84A420676F07EC76E004410F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687500, "uuid": "e603ad74-7549-41c2-88b9-455b2c0559ed", "value": "1536:sWXlonqzcM/WkfGrAphP0Z/jvwpqVpUKq9R4u+qgw06WXY:f1onqzlGUh8Z/j1VAL4u+qgwXWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687500, "uuid": "7dba1551-05d0-4f0f-a9a9-2d6a75bc3018", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687500, "uuid": "7ce05995-2a33-4f6b-91d5-a6e1b69a62cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687500, "uuid": "90df0ffc-bc56-483a-be6c-262335d2f220", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1944849c-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676367, "uuid": "8becb1be-4199-4fe0-acaa-0b73d661d750", "comment": "Malware payload (ConnectWise)", "value": "fbc3caf787db6945e20e509a2109c4f4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676367, "uuid": "85467c98-1825-40de-9bea-3c4320e943b6", "comment": "Malware payload (ConnectWise)", "value": "5e4e17f942b36751b5f4b47cbae52174ef1bb0e8c609d6563c5a8b7873dbcb79", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676367, "uuid": "d8e3b1c1-b7c0-4b2d-ab2b-ddf2fb1e6c51", "comment": "Malware payload (ConnectWise)", "value": "a0ed622a0b08fa8d37c452139f71b27a0de762be", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676367, "uuid": "c18f0613-5371-4e6d-9246-c5d107620a12", "comment": "Malware payload (ConnectWise)", "value": "dcc5ae675451fe22dd2baf7d9c43a31278796cc83830d2787f43762f3e9686ddde5730f7b75491aebe109e018321135e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676367, "uuid": "dcb5d4f7-928f-4ca0-8ffe-b6f1eff01c80", "value": "T1D9D6232523FD405AF8F74A79FD3682E46D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676367, "uuid": "ed177240-bc91-4ebd-8417-402f2b5d2488", "value": "196608:bWh0cGw0Wh0cGdWh0cGIWh0cGaWh0cG0Wh0cGGWh0cGm:bWacaWacsWac3WacJWacVWacxWacH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676367, "uuid": "4536ed62-22cb-4c5b-8e54-9f5791244a83", "value": 13361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676367, "uuid": "e0023443-9023-4704-823c-61c106083873", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676367, "uuid": "4ff6cac8-041c-4a5d-bd80-0134180895ca", "value": "5e4e17f942b36751b5f4b47cbae52174ef1bb0e8c609d6563c5a8b7873dbcb79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a64e69c-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725895, "uuid": "ddfa40ca-2071-4c2b-87d7-33a9a3c9bfa6", "comment": "Malware payload", "value": "2bfd008d7e9c56f1f822ea3e63dc5661", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725895, "uuid": "ff848a29-0b7a-4eb1-988e-800a6f8a7534", "comment": "Malware payload", "value": "5e96f414082407f0d184ea7fa554bb5e39089fe969cec60a16960b6d70142dd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725895, "uuid": "f64b33e2-f131-4bd0-974d-a8ca4be37b18", "comment": "Malware payload", "value": "0e63ce397ea7343eb7fa364227abfeffd78debd0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725895, "uuid": "0780b446-b27f-4e85-baa1-8da343bc6c93", "comment": "Malware payload", "value": "63de0f178ff58bdba7bc53fb6875e1eb08f690e9a495c31f9168b5cef89d1a4c0d99426359c72234be461f474b32f388", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725895, "uuid": "8904b085-7eca-495e-9eec-2bd6057d605c", "value": "T16AA34A1BA2F600BBE1B78638C4530A49D772B8454761AFEF43A4466A1F273E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725895, "uuid": "a95a1482-5f0c-4f61-b01c-e4b6b1edaef6", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725895, "uuid": "d844694b-8c8a-446b-ada9-111137b1267a", "value": "3072:WRn4RwPUciuNGC9QbfQ1/+DAW/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMF:yXPriY3MfQ1/4Kdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725895, "uuid": "f9c938d5-25a3-4f7d-a6e7-d0b4e520a9a8", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725895, "uuid": "db92012c-1d78-4904-8b33-4b3d412c1735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725895, "uuid": "46b4a748-c684-49b9-bef0-6568c2ea7503", "value": "5e96f414082407f0d184ea7fa554bb5e39089fe969cec60a16960b6d70142dd6_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0a3489-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724985, "uuid": "d65ab0bf-587b-4ca4-9917-baf391b4e3f1", "comment": "Malware payload", "value": "18f0f6e685d62bc58b77a5aef2a7014a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724985, "uuid": "95c771b9-e599-4989-af03-47e72c3d5d4b", "comment": "Malware payload", "value": "5e9fc9981aae9eef2908e773cd66862ba8bb1cfc69fc13ca16ec110221c5ab2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724985, "uuid": "fc136192-5d31-4f03-842a-a6d11623ed19", "comment": "Malware payload", "value": "a9256183e4b956bb67713d1411016c0bc2f0ff13", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724985, "uuid": "138d2e7b-9ca9-41e1-8c8f-adc26e10405c", "comment": "Malware payload", "value": "4858fa17f1ca4245a65a56ee691c80e5910d83d82bce39b4e344c5b2f2abea2214a3c91352a78d2dc64c07bdf6a8d029", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724985, "uuid": "76edec77-f7e2-4810-8fe5-3b375d7ab367", "value": "T113A34A4B63AA00BBE2778678C4934A49E772B84557219FEF43A4425E1F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724985, "uuid": "687fce05-7744-4b8b-bab6-c72f7944c300", "value": "c97070657aa79bdf949ea0ebbff73aeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724985, "uuid": "6014187e-e1a3-414a-b3f8-9044bf67a501", "value": "3072:kadsSVIf03Q/GyOQb8Q/yJjG5U0vrXT/7nM4L3zm2Q9ZVbZacTphsrvMWvW:PTV403IwM8Q6Jy5PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724985, "uuid": "5268acc9-9e1c-4729-9a0d-2ce3a8a61c51", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724985, "uuid": "25d4fbc3-ca48-458b-8dcc-781f97f40ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724985, "uuid": "c1fde7ae-c5b9-429f-b99b-daf042efe53e", "value": "5e9fc9981aae9eef2908e773cd66862ba8bb1cfc69fc13ca16ec110221c5ab2b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8b613b-3cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776700881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700881, "uuid": "864b7f80-01bd-45e8-bbf7-74aa0cc9f568", "comment": "Malware payload", "value": "1c872d6a5fcf623175e185be33f7827c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700881, "uuid": "36f3aba8-681c-45a6-9533-841a3b990fd6", "comment": "Malware payload", "value": "5ef1b410c7cdbe63e14935315211f15a2910cbefd11b3d3019d0603a31e2bd1d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700881, "uuid": "e23e9eeb-68bb-4305-9f3a-b94474984a11", "comment": "Malware payload", "value": "0ed2014986c93140224fa1214ff2a48a23e47467", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700881, "uuid": "10cd2ec4-990c-4e0c-8562-24a663e61704", "comment": "Malware payload", "value": "37d631fa49a0989f6bab840f47232d8e609ccba613526da86f2d2479b5b31f208f6d60984c4cf02138c338a417fc6b06", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700881, "uuid": "b6719a95-9a70-4d35-8f11-0c36999e2278", "value": "T13BA38E41F2E242F7E6F1053100A6727F973663389764A8EBC74C2E529913AD4A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700881, "uuid": "fe4c8aaf-91af-4420-8149-5af9e31b48bc", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700881, "uuid": "5d774cf6-fa38-4b26-a8e9-c2a4013c6036", "value": "1536:/7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfcw8G0xrYOD:z7DhdC6kzWypvaQ0FxyNTBfcq0xrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776700881, "uuid": "14e91074-a19c-476f-9f17-d4879364c164", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776700881, "uuid": "0cd56909-5360-4988-8eb4-40c376f50ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700881, "uuid": "4c544c66-3c78-4b7b-ade7-c559ac19dbea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9485d7f7-3c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776663689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776663689, "uuid": "f8d35d72-3587-40fe-b14f-3ae6e05146ac", "comment": "Malware payload", "value": "055643e11f0dd56d86ede0f0d35c1e8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776663689, "uuid": "22b6cbec-c6a9-40af-a328-32c7c1c58777", "comment": "Malware payload", "value": "5f2118495bbb74f0946f1476465d717ec5b6f35bf629fd3423f785479fe61202", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776663689, "uuid": "6eee787f-2ce5-4997-85b8-0402c7fc2efb", "comment": "Malware payload", "value": "152236a2ec262357ddc4b2b7742f44c9944515cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776663689, "uuid": "3d20c4ec-6c01-485e-a6a6-947300c5cac9", "comment": "Malware payload", "value": "4d07ea25e112578863b93c7696436cbb06e5cd8fea32c27c2bea2b98c5eb5ed7478ed1d6fc9cf9027815c2b585e0e8dc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776663689, "uuid": "7dad10ca-2180-4ac6-bedd-19f48f190c38", "value": "T151136D6566813C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776663689, "uuid": "ca9f8c07-a9b5-4dbc-927f-752b5b4f5074", "value": "768:bhXRWNGxVpE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bblxNco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776663689, "uuid": "0e5bfae2-755c-475d-bdd3-caaf89e01041", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776663689, "uuid": "1379c257-f374-44c6-ac69-24b587cf704c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776663689, "uuid": "deef73d3-8690-4afc-ab04-d73991f1521e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae5fd0-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725104, "uuid": "ad830e2f-5280-40fb-845b-65ac695c7fb6", "comment": "Malware payload", "value": "7d1cce6e89a8a1125046f4c1c29484f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725104, "uuid": "cdd7fd17-a1a4-4fb4-ad7d-cb7972ec604a", "comment": "Malware payload", "value": "5f72806055ace3d9961e5c5410b3caf12f77d039f4c27732fc370fa53656fa49", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725104, "uuid": "a47b4ed1-d066-4d08-991b-817ec9889ec8", "comment": "Malware payload", "value": "baacb191bd7c73b3cda2337e1ca1f52cac2f1a76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725104, "uuid": "3b673f31-e879-4e31-a02b-85cb57a83e4c", "comment": "Malware payload", "value": "bbabd60ba3e62f78ce06dd54e3d705006674e13184f76637e7b93874b8a918993d5123f563f73f5b73df4eb3600e0aff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725104, "uuid": "ac67ee9d-ae7d-42b3-b124-8e15b452bd85", "value": "T166821A0DEB4BA8BDC509E1786DEB1731A5B1BD3206766B2D2368DFF60F90584725E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725104, "uuid": "6106f6f1-1b62-46ab-87ef-5d8c4200e723", "value": "e5586c2e7d29a6a74ce35ddec6708f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725104, "uuid": "952ef8f3-eda9-4474-a1fc-bf42b578b284", "value": "384:AdHE59Ya2XAZE54QvUCbwvOC8SDUmFjmckVPxIiTRfV9uLPHJ:Wk59gwZPQsCb2O4lmckVPxIiTRfHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725104, "uuid": "5d5ab6ce-64eb-4df8-a154-d355e2f392a9", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725104, "uuid": "3c72372b-2a15-481e-b5dd-bc18cccb7403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725104, "uuid": "ee6900d1-1899-43d7-b755-06e0bcf3a5e7", "value": "5f72806055ace3d9961e5c5410b3caf12f77d039f4c27732fc370fa53656fa49_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2796f3fc-3d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720629, "uuid": "059c6b9c-cdda-44b9-b5bd-febc949b7552", "comment": "Malware payload", "value": "0b94157071117c81dc418c0c8d5c9c30", "object_relation": "md5", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720629, "uuid": "9068e6b2-1b8c-47ba-8295-258d106682f0", "comment": "Malware payload", "value": "5f7af01d252fc1757dbff353c782b187d76910e018bd828adf084f04c66a5f3d", "object_relation": "sha256", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720629, "uuid": "fd844eb8-4652-48a7-9c78-c1d430476130", "comment": "Malware payload", "value": "3e4b50e0a5b646c13e2449edd8c742766130edff", "object_relation": "sha1", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720629, "uuid": "29865ecf-6d0a-4dfc-9081-c4737c8befe9", "comment": "Malware payload", "value": "e665570a7d71bf11efb346a2887531e6fe61f003057f13f28e28e05924f578d194aeae4356ffebdd43cac1ba16ce397a", "object_relation": "sha3-384", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720629, "uuid": "a9f2fb93-b4d2-4687-92a3-b003d0b1c3fe", "value": "T170856B17B35608F8E156D17881838726E7B2BC455322EBDF13A9C6792F13BD1AB3E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720629, "uuid": "15776ee3-5add-4cda-8876-3739dce9b3cb", "value": "24576:Lvh7vh7vhfLJgzzrSitK6jDNGxK+9H0N/sM7r6bgiD89rxZCQEKZm+jWodEEPQt9:LZ7Z7ZCzzOitK6jDNH+lS/KbVI9rxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720629, "uuid": "9b1f5eb5-529f-4de2-ade4-6268e5f156f0", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720629, "uuid": "6bb16fb5-8750-481d-8c96-b3df2a9dc0de", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720629, "uuid": "47d7fe95-5727-4806-8873-7d27d39b7a3a", "value": "\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c8db0e-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697413, "uuid": "f931ae17-2229-45be-a181-afa73eb0f1ef", "comment": "Malware payload (AgentTesla)", "value": "78ec60a85f3478d4b564812a558b3264", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697413, "uuid": "e5ce3e8a-e904-4e38-8477-7f951ed4e806", "comment": "Malware payload (AgentTesla)", "value": "606bd05033d2f3589375a95550f71ab49ac3328b7f9272ce821a32c79737431f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697413, "uuid": "bc96a5c0-3619-4d7e-853a-0b884baa02a5", "comment": "Malware payload (AgentTesla)", "value": "7ca224e75ddeb994d9b8dbd9de33bbb8d0031eef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697413, "uuid": "ef42eb85-4eea-4d48-9a74-56b0e55b2083", "comment": "Malware payload (AgentTesla)", "value": "f2a4a43971b6314b47447e9e2b905136841fcbafb3c585b53a8c7bcc580e1ad9a830cacc45fcb2820b4f8bf6687c3f88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697413, "uuid": "1a432351-8e94-47a5-9d26-6a47c0cf61f6", "value": "T147568508D0A4B1199CD2CF5AE673D0B048DF796E5E0D8AA3A02F967C1C97FA35A115CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697413, "uuid": "c7a7380b-f395-4da9-8946-049660f3368f", "value": "98304:YXOv3rP5ZP/hHpJGSZFqNzrlFXGxgFg51Vq0d9TBSFAd9SH+gUwCwU1uIWLHHhSr:YXM3rP5Z/lpzsrlFXGxhq0d1BSFy1cC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697413, "uuid": "dcddc5d2-010e-4f43-a782-edf3c0213393", "value": 6027836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697413, "uuid": "12608bc6-f9bb-4ab1-86a3-0537562392f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697413, "uuid": "fdef6d02-51a1-479b-9979-396ae50e56db", "value": "Purchase_Order_PO-206541.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe436d0-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725663, "uuid": "433da560-c7e0-49db-bae4-d2d6d9a3b29a", "comment": "Malware payload", "value": "b35439282cc8507699b782af402011a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725663, "uuid": "d53ae40c-0a1d-4e72-8a81-62a02a2efe02", "comment": "Malware payload", "value": "6076993eef5770d9c25b5575ea3d4187ec35d9eca4243aab4c11d7057264a302", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725663, "uuid": "244d4c3f-854d-4c34-9002-636e8aba6e03", "comment": "Malware payload", "value": "3ffe6d90ec0c522ca901fe9e1717d7e5029e6a3b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725663, "uuid": "4949ea15-8bab-4104-ac33-1e2655c5e56f", "comment": "Malware payload", "value": "1eb89aa29a80b0eda0daa5673d568340b19e4fc01a1a1f2bdac1bc7607f6f37b47a935234f167b536fe4e01b36238bfe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725663, "uuid": "458d8158-abb1-421b-a262-1197cfc9054d", "value": "T1EDB34A57B2E900BBF1B7823889A74A45D7B2B81557619FEF03A0424A1F237E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725663, "uuid": "ab99a130-255a-452b-acae-8e82c1ae9d15", "value": "ac066e042c3584915e280cabfa8ae393", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725663, "uuid": "cd39ae42-a3d6-4a38-bf30-5afaad5e6dbb", "value": "3072:vecY1jiseG9oPQbcJ7w57IjhTK12CQncK:8cseTMcJM50VKOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725663, "uuid": "3bdfe23d-3f85-496a-97dc-866ff4d1ba65", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725663, "uuid": "2fc56160-c4c8-418b-a806-5d8a717eb931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725663, "uuid": "af6151f0-7f62-4062-8232-39d839c09e52", "value": "6076993eef5770d9c25b5575ea3d4187ec35d9eca4243aab4c11d7057264a302_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15d3be5-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725988, "uuid": "d71e330a-e2a2-4fbc-b689-393169acabd8", "comment": "Malware payload", "value": "c45411a7a6fc1fb3448709962639d854", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725988, "uuid": "de948656-bb82-40e6-8122-7cb1e921c496", "comment": "Malware payload", "value": "60a5546114afc6e1f965d16b327eaa41f6a0f3b6a9af4eec20559c54e06f7c09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725988, "uuid": "762269ba-606f-480c-aa30-45097ce98dd3", "comment": "Malware payload", "value": "62d42ff36ea8f7bc34c5dfb5aaf27e0c61bfae3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725988, "uuid": "0d3625eb-4941-4ba1-90e1-86477cd3637a", "comment": "Malware payload", "value": "e8aada2a44a1c2733043118eaf975bb327bdcfde2d267e547290b1d2a14cb940b092977007d92d7501dd6d56cb80b7a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725988, "uuid": "d207e99d-bac3-4461-b052-581433ff7e65", "value": "T1B1B34A5BB2BA10BBE1738778C4670A45A772B8414761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725988, "uuid": "bb42868d-c510-423a-a8a1-11f13f5c90e7", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725988, "uuid": "882a801f-0e19-4024-ae1c-454f77b5bd1b", "value": "3072:VXz3QQah85ZpA4rwgw3LVVQezDZ4Ckx5qVHckVPxIiTlpDi:VXLaabDw53Y4hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725988, "uuid": "8f8c653a-0049-4f7e-a8e2-fc5438c9d5d7", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725988, "uuid": "ac385de3-f9a8-4a71-8d48-f53b61528cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725988, "uuid": "6fa136b2-2c6d-4b53-bacf-c4c704748370", "value": "60a5546114afc6e1f965d16b327eaa41f6a0f3b6a9af4eec20559c54e06f7c09_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71c9968-3c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668015, "uuid": "72d6dbc8-8551-4409-a157-b3b5d3fdecb5", "comment": "Malware payload", "value": "86e15724521cde03a5262ec04b4e5bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668015, "uuid": "285b837b-0f15-41d0-b1c3-24bef71bb893", "comment": "Malware payload", "value": "6117f3f72eeacb24536a468c6a6f6d878987dfd88941b9622fc35b25e92581b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668015, "uuid": "156c470c-81d1-4ef1-b586-ef95db60b8db", "comment": "Malware payload", "value": "8d99bcf3e9a4e7e541fef2f5ee6d0adf039229b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668015, "uuid": "7335b95a-b547-442d-9cb0-12f9d1936ea0", "comment": "Malware payload", "value": "b34236ba3031de34493048f04537dc17b7e91e747619afb05cf5d66863ac8a7068a43f5cbee6317a712ba2169b783a83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668015, "uuid": "222b4a8b-c8d2-40e7-bf3f-be29f9776489", "value": "T1FE560797B9D25957C4E83677A8BE80C433631EB98B8A16575D04FE383EBE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668015, "uuid": "f18f0b72-df4b-46d7-8a35-72ca91b66501", "value": "49152:vwPwCXnDiaOpHxTRkTQv7AvTRkhiLVdj0czTGr95Ek:ooCXnDiFpHxTRaQvMRFTjfzTGHEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668015, "uuid": "671711ea-6707-4164-9a6e-94ff5054b8a1", "value": 6357154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668015, "uuid": "330f7a3d-3d5f-4f58-97ad-5432abb13420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668015, "uuid": "7a3ac94f-1513-4dd9-84be-e7817a5b75cf", "value": "krane_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4bb367-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673961, "uuid": "af72967b-a244-4bbf-a259-a44e36573b9f", "comment": "Malware payload (ConnectWise)", "value": "dba1cb088e416bd27fe2f1cf90afbcd0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673961, "uuid": "cd5863b9-762c-4db3-8e95-145cb294a541", "comment": "Malware payload (ConnectWise)", "value": "6190e39cab4f89d0d1a611ac62e82ee76736ce9f4bb47674de3713048b52f03e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673961, "uuid": "bda00d12-b9a8-442b-932a-e4f3ff97b4fc", "comment": "Malware payload (ConnectWise)", "value": "6556ad2e614cd77769122938ca337a753bf7ef84", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673961, "uuid": "57383cb0-7256-472e-913a-ab49bdceb3b5", "comment": "Malware payload (ConnectWise)", "value": "d82c4b65a193d373eb8d1f7f40884a3f602c39566d49da135794b7ec2ddb3c7b3fa12b9d7f2c6829332877579dd0aa36", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673961, "uuid": "05d4852f-5405-4c6b-9abd-c6c684c80732", "value": "T1E4D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673961, "uuid": "bad37053-88fc-4f25-9d92-3f66acf1db87", "value": "196608:0Hxcp9ym3nltDUJVRHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3DHk:SGplpWGp7GpHGprGp8GptGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673961, "uuid": "d113d343-8890-45c6-8481-00478cf544e9", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673961, "uuid": "5bc33118-5b2c-4e23-8b7e-c19d20070ddd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673961, "uuid": "724d4b36-eca0-40d7-bf6d-3be58dcd3106", "value": "6190e39cab4f89d0d1a611ac62e82ee76736ce9f4bb47674de3713048b52f03e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3037bbc1-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725368, "uuid": "9d4b00a8-316f-486a-979d-851fa85b7f19", "comment": "Malware payload", "value": "de6ee820d609baf4759a857ad2f0b445", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725368, "uuid": "b773b5db-14ce-4018-8545-4cb6636252f5", "comment": "Malware payload", "value": "61f688bf8b71c5358487d9eb36c99e56557ee80bcfd7edc71a7e440ae2a04f18", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725368, "uuid": "b4893d0f-5bf0-4f9d-bc6c-6c4e266be364", "comment": "Malware payload", "value": "9a42c455876e91f24f4b1beedb9ceb1b99518a20", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725368, "uuid": "bad344f3-c963-4494-9982-9e65eb34b12d", "comment": "Malware payload", "value": "e5900c9104e7ead07b244695730b57d355a0bba8b355cbc2ab1d065c353d205e08a4688c385bf6722ca4fa8a42bc08af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725368, "uuid": "1e7886ff-9bd1-4149-a003-a71695f9bbd7", "value": "T135B35B5BB2A900FBE5778279C4670E46E3B2B85117609FEF03A4425A1F237D18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725368, "uuid": "28150767-e3e9-4063-ac12-3eb2758b7437", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725368, "uuid": "feaf038a-a6c7-43ce-b212-5304a7ad4a70", "value": "1536:9r4trLOUnelseYw4MhLVxj5pVTH4SFcSdhn+hlLIvtEJsWTrd79dl2bcmTrVLywr:9g/Rngoyhj5plYAhn41mtqBzkbjL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725368, "uuid": "e0f60ed2-7a39-4af0-827d-63876758235f", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725368, "uuid": "5bdd6f40-54e8-4b76-baef-e817e8d66041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725368, "uuid": "15112939-45e9-49f4-9519-8790c144f1dd", "value": "61f688bf8b71c5358487d9eb36c99e56557ee80bcfd7edc71a7e440ae2a04f18_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba83924-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725817, "uuid": "44211897-574e-4a1f-b534-ed17fc0cfbd8", "comment": "Malware payload (AsyncRAT)", "value": "0f5cde4ba4ffaa4e4f88027ef5224708", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725817, "uuid": "2c18c1ea-85a2-4e35-9fe6-7c1d724f9f62", "comment": "Malware payload (AsyncRAT)", "value": "620b8d01bf42ea689a25e6a43647d74528522577bb452f3860061372fca5cd39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725817, "uuid": "cf8885e5-4b66-4dfc-bda3-b3b0b8be9088", "comment": "Malware payload (AsyncRAT)", "value": "f620e954460e9a4dae914de3482335858d00c7c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725817, "uuid": "2330b28e-da1b-4c8f-877f-618bc40a338a", "comment": "Malware payload (AsyncRAT)", "value": "01b1da533bace6b35e9e67ea10b76c5872d846f97e958c62a1ea17ec8ade21e025539dd86068d8103013d1c055ba1881", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725817, "uuid": "5dd73041-055b-471a-851e-621452e5a035", "value": "T105B35B1B72B610BBE1B79238C4570A09D7B6B8514761AFEF43A0466A1F233E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725817, "uuid": "b73f644b-5703-4ef3-8e82-f69688039af5", "value": "ceb20e06b162e1cdd50a2dfe6c5688ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725817, "uuid": "5e51058e-98a5-4f61-a8bb-4b33b9d1ed7d", "value": "3072:BbExtkjkGpGjjQbaQRWWyg41/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMmi:BWtckU0MaQRWhgruxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725817, "uuid": "f033aa34-3dd5-4958-81ce-a5a1833c7345", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725817, "uuid": "efcc4c03-0e5f-4bfe-baae-6774e40a4e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725817, "uuid": "607a9f93-29ef-41b7-b1fe-38757fb4ce57", "value": "620b8d01bf42ea689a25e6a43647d74528522577bb452f3860061372fca5cd39_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5c0331-3c9b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776677397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677397, "uuid": "a957d146-534c-42c1-9d13-f1b8625b6ee5", "comment": "Malware payload (GuLoader)", "value": "973907afa63ef492c97b878c6607c622", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677397, "uuid": "3c4c35c1-25ae-40f5-9e22-4dd6c46f9659", "comment": "Malware payload (GuLoader)", "value": "620ec17b242611b426f9eac13d1b8128a7fbf92c644cac03252c8372df582cc4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677397, "uuid": "39c5ba9b-2d1f-4989-85d8-afa8afed6382", "comment": "Malware payload (GuLoader)", "value": "ec5fc368021ceb79fc48f9a9d561b2bc9428710c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677397, "uuid": "3bd8886d-5fb0-472b-addf-f66a5ecbe3b7", "comment": "Malware payload (GuLoader)", "value": "599863a0b622b160d2fb336f50b56ee2b76dfb7276d4b05c09a49441d40a7623f1bd3bb844b091e04f7b148ed36b5d54", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677397, "uuid": "8b2af25e-c175-4980-9824-dbdb098ae2b7", "value": "T1F4643A70ED20069B4F871BECBE581666C9BDE609453714B0F6DE434EA0065ACFBFD229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677397, "uuid": "e1132aee-45a7-4667-b993-ca67f7e7474a", "value": "6144:qlpl2lKgl9lRl8alWlM/lwql6l1l3lRliflSlFClclXlql9HhlOlRlAlrLlQlP:qlpl2lLl9lRl8alWlM/lwql6l1l3lRlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776677397, "uuid": "0949693b-dd13-4f1b-8d30-6491f892c202", "value": 323965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776677397, "uuid": "8ad37a43-af12-498c-bbf5-263f32f88094", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677397, "uuid": "2aa69d75-d593-4fed-85bd-49ecca566133", "value": "Met-Tech_RFQ_ProductName_InternationalInquiry_2026_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3a55e7-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724828, "uuid": "4636bc02-59ac-4e3d-a7a9-69f4f7b48e11", "comment": "Malware payload", "value": "6093eb7039c103ec63ad31e9ed606af3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724828, "uuid": "cec9abd8-4035-4bc7-b1f5-d59831d2bc23", "comment": "Malware payload", "value": "6320afcd8111e22f29952da8a6763f6d85ed1effc643e0e2cb306b83ab677a27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724828, "uuid": "e0bbb606-c23e-46e1-a86a-7162eeaeb7d2", "comment": "Malware payload", "value": "dec7d5acb91ddfd3fb69973a70fa92d941a35d5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724828, "uuid": "08f7f42f-4376-4294-afe4-2c2f99dfc7aa", "comment": "Malware payload", "value": "58de00b4105217d860a214be333e58aed5dbeb67db14518953509800b293ff5d2af5dccc6c52a06b953a7da55a7839ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724828, "uuid": "b951d839-ef88-4add-8e37-b5c86efea6a8", "value": "T1BEA34A57B2E500BBE1B7867888674E45E776F81507609FEF03A0425E2F237E18D3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724828, "uuid": "4ec82720-cafa-45b5-b9a0-1342a75969e9", "value": "1b1ecd8aac346742266e180bcd50be0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724828, "uuid": "6eb6de7a-6f15-4bf8-aa56-faf4db6da815", "value": "3072:5ZMrseK1TY9GjUQb8Ag5TLWMNU0WyF8w:Isz1TmXM8Ag5neqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724828, "uuid": "7c24ddf6-dd86-49f0-89f3-41a3bcde1a79", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724828, "uuid": "0db49623-1783-4f18-858b-4ff001d7a039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724828, "uuid": "98c46c92-7f9d-4b1d-9183-c400af4ee4fa", "value": "6320afcd8111e22f29952da8a6763f6d85ed1effc643e0e2cb306b83ab677a27_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f020508f-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644945, "uuid": "29a239fe-245a-4df3-8543-4209786a5339", "comment": "Malware payload (Mirai)", "value": "aba53863824d7434c0e7ffc6e462e960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644945, "uuid": "d81b4687-cbb1-48bd-8843-06738ecb6435", "comment": "Malware payload (Mirai)", "value": "63d0c3526b4facf1833952c51417ec372e2bed9d4526ad7e2d28118e7d690881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644945, "uuid": "228d6bff-982f-4492-a082-9419a50ecaff", "comment": "Malware payload (Mirai)", "value": "078d82f814f50301c6c151269503cee81293192c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644945, "uuid": "1b422c87-b21e-4ad6-9bda-8d4adab033c6", "comment": "Malware payload (Mirai)", "value": "d570253a1c8afcbc09125f0d60313e41eced72c062b8e8baff49826535d9f50e611d753d234df7f9ab69797405b89c40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644945, "uuid": "ba206f46-eb51-4d2d-8435-258872228f7a", "value": "T1601307DBB405AD7CF81FEBBE94174909F631375550830B2667A7FCA36C321A49922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644945, "uuid": "61c2a915-5f06-4879-b20a-667fef68a890", "value": "768:NvePhohSIJ6a5HSNCI4UzV7SbRJEziew9Yny0U8roJ:FWe0I0fNl4UzdSnE2ewinyx8UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644945, "uuid": "3f7fd140-86f3-4c43-a0a2-566ee536437f", "value": 43608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644945, "uuid": "f8c9e41d-3089-4a01-a072-44ed3ec700a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644945, "uuid": "686216b4-6819-4596-9ba0-e65b60fe6c5e", "value": "00okm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fd28e2-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676382, "uuid": "caa1e2bf-ba63-49a7-adc9-95b10845b745", "comment": "Malware payload (ConnectWise)", "value": "3555cffe3359c6d5b9caab02a0e86eac", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676382, "uuid": "c49d0bd2-6f80-4f62-b810-71e42f2fd8e4", "comment": "Malware payload (ConnectWise)", "value": "63de3008bb5dfa0d396967f3f6720809c4bff2922c7735a2fcb5f555ccb88ae1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676382, "uuid": "825fead0-b035-43bb-bd0c-d2b6a2b5f905", "comment": "Malware payload (ConnectWise)", "value": "26bef77e66ead95bb64bc4c279868fe042a0c4cb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676382, "uuid": "6fa4aff0-ddba-4746-b54a-0652864220d4", "comment": "Malware payload (ConnectWise)", "value": "3604bcee290645f792ad6054941a8c8f8546f1064015dfe73afed2b9432be8936a027a373a2d64f381251c29e105fbf6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676382, "uuid": "dfba5bfb-84aa-4922-98cf-cf035d6c5912", "value": "T140D6232523FD405AF8F74A79FD3682E46D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676382, "uuid": "87754521-bdf5-4696-8a91-3ed4bc0ef97a", "value": "196608:QWh0cGw8Wh0cGdWh0cGIWh0cGaWh0cG0Wh0cGUWh0cGm:QWacKWacsWac3WacJWacVWac3WacH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676382, "uuid": "8d5ae2cf-6ba1-4280-b72a-79e586865951", "value": 13361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676382, "uuid": "d8157cb9-4bef-49ce-99d9-76750aad42e4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676382, "uuid": "dca7e23e-3309-405c-aae4-b6a003f58d99", "value": "63de3008bb5dfa0d396967f3f6720809c4bff2922c7735a2fcb5f555ccb88ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dafb0d2-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725552, "uuid": "67b5ebfe-0e74-4f18-ab41-4f8f7810b069", "comment": "Malware payload", "value": "ea954b6e18cb859bba206285d69a8023", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725552, "uuid": "6c912829-cdc3-4994-895a-7e28787fb86e", "comment": "Malware payload", "value": "64552c2ced89a713e034278994e3e49ebba3b38d4371683d14a10050b638e849", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725552, "uuid": "05958b9f-cff1-420c-a4cc-ac49b7414a52", "comment": "Malware payload", "value": "866800cdc26894fd05593a98ac2ecc0df618dd3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725552, "uuid": "5b72a618-68c5-4101-a3d1-bb8148adbd1d", "comment": "Malware payload", "value": "f02c5df6841f234936aa03c2228ad3409a551df5cea01663efee9f114323dffced52e81c74742f7b2b9ba753ea05a82a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725552, "uuid": "32e3b22d-cec9-408e-adf9-ef06205091e1", "value": "T166A34A5B77E900BBE1B7967888570E45D776F81207619FEF03A0425A2F237E14D3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725552, "uuid": "bb0f121a-61f3-4345-8197-683305237068", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725552, "uuid": "6b061c81-064e-4689-bc14-2bcde82ecebd", "value": "3072:N27g/i4qfIsxGZJQbQAet9/4+0Pp5EOA4v:p/afIa0MQAetFw4hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725552, "uuid": "e8cc322f-9d36-426e-9849-edf974d6d3ba", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725552, "uuid": "0de51dbc-2032-4a07-bf34-f0a311d976a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725552, "uuid": "c773f889-84df-4608-acb4-07994142e780", "value": "64552c2ced89a713e034278994e3e49ebba3b38d4371683d14a10050b638e849_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba7bd4f-3cae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776685579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685579, "uuid": "d61b79d3-437a-4835-8ca1-69a1a75c52c6", "comment": "Malware payload", "value": "01a4ace052b1f5014fe94314a373ba8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685579, "uuid": "817deca0-8bbe-45bf-bf96-645fc0b8f51e", "comment": "Malware payload", "value": "64727ec1e489b8eb641bd535c25b4e305a99b69110c81bb27d35a8779e68984d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685579, "uuid": "ce4db869-0f7e-43fc-a2bb-ffe09d82b231", "comment": "Malware payload", "value": "9c1ce439993ef5913ca23abe6df49ffb569a362b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685579, "uuid": "e07d6ebd-616b-4da2-b191-83f8a038c8e8", "comment": "Malware payload", "value": "70c25a56061287fe47ad144069ce471cf66f28b6c537a46a162452678fadc25b8cbe96a3d3cffa5006719371f663b6e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685579, "uuid": "d2252c7c-7dbd-4565-9b46-5a5fe0a06c73", "value": "T10843029EAAB9374DC2ED5E3F3E5A2F664900B0C5D04D4B5F1388E825CE032DB2D8E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685579, "uuid": "d55c58d1-7362-4755-a69c-0e98305c624b", "value": "768:/foOsRuTJnW5XaORBkNubAKFjoiHSfmKzL4oixQbFJfkvunMdql4Aa1SIvexKv50:bXlMa4RJ8iH/KzDZFRkeSSIWxwJCtTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685579, "uuid": "ecb2f3ba-c06a-44c5-9f0c-05e23e8edba9", "value": 59436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685579, "uuid": "aa3f696c-7d73-4685-b2bf-d0d1ef89a540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685579, "uuid": "b760d75e-3c2a-4290-b795-49260683230b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e064f4-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725492, "uuid": "01defc91-7f30-487b-b092-f4c9b7aa0a5f", "comment": "Malware payload", "value": "45d16a60c527825a1679d8725ff41f6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725492, "uuid": "f9c00e77-95d9-43e9-a21d-0e9c3900a49d", "comment": "Malware payload", "value": "65055c18e2f32241272312208f77f8b10025685aa5704b6c9707c53df83c551e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725492, "uuid": "6da20ffc-4464-48ed-a193-94e3d74130df", "comment": "Malware payload", "value": "871f8ec16c0b7c48d029713059fd803a4082758f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725492, "uuid": "8955505d-15a4-4c9b-84a5-0d3be4135282", "comment": "Malware payload", "value": "c43fe41af5b8a5e10e773450c36908f598f01dda4c2906dddf10dfaa060fa5a5269c0eef1aa496a61f1ca61f2e517185", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725492, "uuid": "6ff91f25-b4d4-4f02-9aa8-b58bee2a00b5", "value": "T1AAB35A5BB6EA00BBE177923884674A42E7B2B81157609FEF03A4464A1F237D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725492, "uuid": "1ef0466a-7b8a-41c1-ac97-9e70e989187d", "value": "5b1060c592dfa6685feea6b3d8b99aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725492, "uuid": "977fd635-8543-4bb2-89ad-470a73e941bd", "value": "3072:skg3PDFi3fFgomQbxJbXTOmK1M3Dqf65lUNjwXn:eMPuMxJbX/lDbej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725492, "uuid": "5bd5ebe5-d234-4683-b552-27d26b428885", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725492, "uuid": "36865878-800e-4c46-ba7f-b2c074d01d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725492, "uuid": "066c93c1-a66f-444a-8fd1-c76c5721818e", "value": "65055c18e2f32241272312208f77f8b10025685aa5704b6c9707c53df83c551e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feea6205-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726145, "uuid": "51af1960-092a-4b87-91d3-f0341d85c7e2", "comment": "Malware payload", "value": "f00a1024664f1442c566d745f50b36a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726145, "uuid": "c9bb8116-cc7b-4869-a405-91d312eb26ad", "comment": "Malware payload", "value": "661e613b993e97e2df4bd5bb3940cfbc4944d71b82579d7d81fd5a17da418436", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726145, "uuid": "653e6b3a-f7c9-4f92-9731-eb6342151fff", "comment": "Malware payload", "value": "decd3f578872414d6e7df6301551cd44c4579610", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726145, "uuid": "7efc1d5b-f246-4616-960a-bc717fe5f2b3", "comment": "Malware payload", "value": "c1d9a7db219e00e1f1dbb14db6f31bb26cea0c8e0d27c706319bc10ee988fc196f9701461ce6ba38fb72f6f945f3b82d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726145, "uuid": "8058401d-afe5-40ce-9a34-7da05900fbda", "value": "T1C0B36B5BB3A500BBE1778239C5A34A4AD7B2B85153709FEF03A0465A1F233D15D3AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726145, "uuid": "73cdb5d5-6439-4106-ad50-8157b275137b", "value": "9920724e49c79622c06828b119547ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726145, "uuid": "c4409ea2-5a12-4631-8667-0d8d773c2f12", "value": "1536:uCE0s+zayi3oGYN474mOofpSTHYS8xaoaUaTyYzt/EPsWJNdw9dlD5wgt+:lsjyiAoxfpy4coatTvt/CnAx5wgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726145, "uuid": "e070aace-023d-4516-b650-9a3ce655f4db", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726145, "uuid": "38f85dc9-9450-42d6-b6fd-c53084e0929a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726145, "uuid": "581ea676-3742-4874-ac5e-bef85de75b10", "value": "661e613b993e97e2df4bd5bb3940cfbc4944d71b82579d7d81fd5a17da418436_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff50c08c-3c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676324, "uuid": "4accd112-5c64-47a6-88e3-2f1c7f588241", "comment": "Malware payload (ConnectWise)", "value": "3584524074815c86ca28629955c40b26", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676324, "uuid": "0664d666-5df3-4d4a-b8e3-4db66916f956", "comment": "Malware payload (ConnectWise)", "value": "664b6a2f22a5b60185fbcd4a88cd7bcb57adcfe22c48df6efacf98b48a925c95", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676324, "uuid": "e664e2c9-faab-4853-9f25-5ccecd66bc70", "comment": "Malware payload (ConnectWise)", "value": "34ed6fe6875a339ede7f33a89e96b1f73ea035fd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676324, "uuid": "79e747a2-e8e4-4277-9442-de5a0ef1f6f9", "comment": "Malware payload (ConnectWise)", "value": "ae7e8e452b4f028eb808334c220c460aab020ac1248cc0aa08f28bc69699f8609120437f111f9dd4dc283ecacba351d1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676324, "uuid": "583af2a2-53d3-48fb-aa70-c4cf8a054990", "value": "T19CD6232267FD0918E1F36778FD3A91E291367C658F12C09F2614786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676324, "uuid": "d3b4f9e0-5581-48d4-b79e-60950556cb3d", "value": "196608:3rnLYG3zDhukO0rnLYG3z4rnLYG3zBrnLYG3z+rnLYG3zCrnLYG3zyrnLYG3zU:3bDDDgv0bDD4bDDBbDD+bDDCbDDybDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676324, "uuid": "78b4e4f1-a9f8-48e1-9da1-380dc82762cf", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676324, "uuid": "d59b7454-820d-4147-bba0-ea17a1ba2682", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676324, "uuid": "211eb2c0-8b89-4483-823a-870a5c39c828", "value": "664b6a2f22a5b60185fbcd4a88cd7bcb57adcfe22c48df6efacf98b48a925c95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159d0f35-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676791, "uuid": "ce778bc8-09a4-4ba5-aaf1-782174d06068", "comment": "Malware payload (ConnectWise)", "value": "026ccda265231b17a527241fed0eb3a8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676791, "uuid": "69c96cc8-af3c-4a9b-ae26-7aa20449287c", "comment": "Malware payload (ConnectWise)", "value": "666afdf3328facdb71b962a9ecdfa4cf8706681a6eb431321768c2aeb1d0756b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676791, "uuid": "dd96efe3-a4a2-4077-b59c-4ae426adf0c5", "comment": "Malware payload (ConnectWise)", "value": "7886dff32b9ac7a7f07445c3adcba1b5cc6770e5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676791, "uuid": "b45c2b4c-d890-41cf-a007-1d9e22e6556c", "comment": "Malware payload (ConnectWise)", "value": "6d8c56fb8f947daba6ce819b40a9c2e929030859df5c0e44f039a41e34a4dcc0d07fc14ca81634fc25729a596409360c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676791, "uuid": "98b84cb4-24a5-4c9c-b3e0-8f3e076dc42b", "value": "T16B836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF3398826E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676791, "uuid": "8cfcb813-bf43-4c97-8efa-af9b3236e6c4", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676791, "uuid": "462ca3a1-394a-48ad-84db-18299b3f880c", "value": "1536:poG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYV7fJ:zenkyfPAwiMq0RqRfbaWZJYYV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676791, "uuid": "f2fb1a96-d6b9-4d36-9a4b-e6a059697722", "value": 83336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676791, "uuid": "9cda5586-2865-416e-8961-32c1897126d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676791, "uuid": "d6364ac7-bf32-4dec-b5ef-c23ed1889dbf", "value": "666afdf3328facdb71b962a9ecdfa4cf8706681a6eb431321768c2aeb1d0756b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ad9bfa-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725025, "uuid": "bf06dd91-998a-4e4f-95bc-c8ae99015ce7", "comment": "Malware payload", "value": "a7c942ab022ada1a21be1ab953afc7cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725025, "uuid": "9ab03245-c59e-43f5-b782-f2da3afe3c4d", "comment": "Malware payload", "value": "66874e588b8e26569f743417d6d2eaf6e6b159c9add6246c283bfed9926a15d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725025, "uuid": "96f871f5-e03f-4d81-a40e-852080209db0", "comment": "Malware payload", "value": "a9d10d4fce4fb2f5869c336257e165b34de555e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725025, "uuid": "0d8b12e6-0c59-4b61-802d-988238574cd5", "comment": "Malware payload", "value": "6f08f38b476ae379af70b7f75abc290a7f6750dbe7763739f2ee6ab20aedc7532d1d07def7ce021cbe495ee322b6d67a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725025, "uuid": "da383040-cc4d-4bfa-8153-2f4f17107754", "value": "T12FB3396763B900BBE1B38638C4674B45DB72B8514761AFEF03A4469A1F273D08D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725025, "uuid": "2b4628b4-6a9e-496f-a4c5-3115a8eafde7", "value": "7250aaaecb1af235e00bff84b0abb922", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725025, "uuid": "36eb9aec-174a-4037-97ff-d58fa03bbdd3", "value": "1536:VEbzbzAn+MC5RPYg47dcuJuWpsTHXSDatK6GUoyJuqeEUsWAQxdT9dlDHgUx64:C/UDC5WB8Wpg3HK6NooeWQrLdg4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725025, "uuid": "cb0321df-1e27-44bd-8de0-b655c2160f1d", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725025, "uuid": "2f8d43e1-6b42-46ab-80e2-b8320b8b817e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725025, "uuid": "7a04ee3e-f3c4-4fa2-bf47-e21e15eaf945", "value": "66874e588b8e26569f743417d6d2eaf6e6b159c9add6246c283bfed9926a15d8_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499d124d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725411, "uuid": "ccd78912-2110-48f0-9779-019a6a480513", "comment": "Malware payload", "value": "a83c93f199ffb1bb3e074eecf9c4cb1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725411, "uuid": "3e38a4a7-985f-4fd8-9e91-c81eb4103aa0", "comment": "Malware payload", "value": "66d83b595c5b679a51b59136f4bf81896e503dbbf58156b4a4236a44bf0e8a80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725411, "uuid": "7614b759-ba98-4d3c-9077-561007c06c09", "comment": "Malware payload", "value": "22d66469104bac3b20f04ea707e4b9408dcbfe84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725411, "uuid": "353b7710-166a-46cf-b9f7-315b40cedc5b", "comment": "Malware payload", "value": "34dc38cd8e98b987fd24f68b656f935a56555d383c28fdd5784b63140eccc7e01199d534c63a65bbe1df3c688f8e3592", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725411, "uuid": "75af6de4-f263-4a10-85de-0436b50d00da", "value": "T1EBB34A57B2BA10BBE1738778C4670A45A7B2B8414761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725411, "uuid": "d0eb05b8-9373-4445-a1fc-2f37623deb41", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725411, "uuid": "6a2e282f-5244-4baf-8c8c-7f0c43b8052a", "value": "3072:Y3QQah85ZpA4rwgw3LQVQezDZ4Ckx5qVackVPxIiTlpaB:aaabDw53Df0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725411, "uuid": "aae6fed0-de20-4987-a0ae-843882654bcd", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725411, "uuid": "ecd7aed8-7dbf-4196-a50b-d015cec59235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725411, "uuid": "7aa36bc8-4e7a-43fa-bf23-e212eb7c2a36", "value": "66d83b595c5b679a51b59136f4bf81896e503dbbf58156b4a4236a44bf0e8a80_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c97df64-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725792, "uuid": "3cfe5b0e-92b5-47ae-b077-470192e3cf00", "comment": "Malware payload", "value": "0dcb5f70f62d0db0bb71f3da34c2a609", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725792, "uuid": "1db205d3-98d3-4ce3-9b74-e10f7e96dff1", "comment": "Malware payload", "value": "670958509e42762881ec0518a598330663cf7f1d91aa03c7a01f52faebc1923f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725792, "uuid": "1a53560a-cda0-45ed-afc8-e4e3e5a7d98d", "comment": "Malware payload", "value": "b61eae27f427baffa51011c05aad728eb8f81c22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725792, "uuid": "17f84656-9133-446c-b94e-7efd14cef747", "comment": "Malware payload", "value": "3e9470c9803acd933bc7b8ae3eacdb87579af140c3a0235f0bbf80b5d3214368fb9f77ef64183dac8aef0a0f35694f9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725792, "uuid": "da0c32f8-81d2-49c6-8bb8-993f6af3fd37", "value": "T1B9B34957B2BA10BBE1778339C4670A45E772B8414761AFEF43A0469A1F273E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725792, "uuid": "228b50d6-06ec-4bd9-b89a-6dd0f629cb65", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725792, "uuid": "96c88ded-b6ae-4df8-8f99-e1ddcdca5b93", "value": "3072:Wew8YHakpvHSwyBHrVQezDZ4C0x5q9MPWlS:G8YlIwCueS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725792, "uuid": "87adb23c-b94e-4180-a8b4-4dcea95d40e9", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725792, "uuid": "5f6c77e5-ea73-48a6-9973-9c66044d6195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725792, "uuid": "830ce10c-e989-492b-b08d-7925c8ca818e", "value": "670958509e42762881ec0518a598330663cf7f1d91aa03c7a01f52faebc1923f_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4a9580-3c78-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776662197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662197, "uuid": "068ac4d5-5b61-4efc-abcb-2379070c37a0", "comment": "Malware payload (ValleyRAT)", "value": "6eede1392c90ecb1a900d9ddbd63ef4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662197, "uuid": "835321d3-4a7f-4d51-b845-dfbde99da10b", "comment": "Malware payload (ValleyRAT)", "value": "67133a4a49576c342dd3f8cbd58b49f9ab3b4c456c75327d64ec9ffaede4632b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662197, "uuid": "72e36492-3f11-4f4b-bcac-a07c45b7195f", "comment": "Malware payload (ValleyRAT)", "value": "831be7729eafebdee7b01c56671ca76e8381484c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662197, "uuid": "2489eeb3-8a1b-432d-85b3-70a36d88cfa3", "comment": "Malware payload (ValleyRAT)", "value": "39a77a8caea61e58ef683244be32bcdcda22b29a89382f619d62deaa49f8291cbe1175f4978d5d5867b1ae1716bcbdb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662197, "uuid": "83423426-3a8d-4683-8dea-e0a9a0d3ed19", "value": "T108146B227780C17AC19B153195BB9F721EBD7932076981CFB3949E790FA03D2BA7470A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662197, "uuid": "22e91a08-3370-49a0-ab33-602d668f9339", "value": "ee113de6a7e41d580c082b16b3603fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662197, "uuid": "557bad10-0916-4846-bbb1-d12a1f7dcc90", "value": "3072:aCMBisXNwDbawmN3qSh/1LLxHyNZXs82Gbw4gRaGQ9u0Q3mlmXdH/Uqt:hMBBwDbYhqu/pxHyYubw4gRaGQ9u0QWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662197, "uuid": "251065cb-ed91-410a-b51b-a191bc8b190f", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662197, "uuid": "6fc777d9-29c3-4776-932a-cc56af0d6409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662197, "uuid": "70d95660-e8ce-4c31-bc78-d13ab818d754", "value": "6EEDE1392C90ECB1A900D9DDBD63EF4B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e01d8d-3cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776694264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694264, "uuid": "e521a4f8-5423-4f65-81c3-d031e38b415c", "comment": "Malware payload (SnakeKeylogger)", "value": "c502f0ac3716f49bf4261c1f2b6d8207", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694264, "uuid": "2d95aa64-15f2-4eb8-8e5a-19c6c721a083", "comment": "Malware payload (SnakeKeylogger)", "value": "671839c24c52d9e13182fc4ff5e6b2d97bd62c94dde47b17e35ace78d8de22e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694264, "uuid": "835f9138-411a-41e3-a8dd-b8036d211abc", "comment": "Malware payload (SnakeKeylogger)", "value": "708538e3322c5c4aaed41024c51dba0de9b978fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694264, "uuid": "d37f0be9-596a-40d1-a67e-43fd7a6b217b", "comment": "Malware payload (SnakeKeylogger)", "value": "c18d7cd7c06fcd0fd9398dd0751b31b72b5f050ac10535a7c563a80afcaaa4c502a82f4e99f40eb95b2555b1bc3970f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694264, "uuid": "8b83e099-f2c9-40b0-a8ff-7c4b6b6a8b26", "value": "T191F4AEBCFDAF75122527763ACA37C4248BD4EF1B2025141CFA5C26209FAC3548AF59E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694264, "uuid": "2dac74bf-676e-41f8-bbae-9cd34ce0266a", "value": "24576:1TZEDT5lgUN1I1NZLZhFVYJdzmT2X535sGk5555v45ZZLIh6P555u5HPZ55p5XPv:tSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776694264, "uuid": "0c0191f3-b8d9-47d9-aaa5-056df8bd511b", "value": 793410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776694264, "uuid": "a0642d72-de1d-43ec-94c8-8fd17ec84dab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694264, "uuid": "f882e349-376f-41f0-a742-fa6346f695db", "value": "RFQ-AJC-QINHP5-TIS-L0009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dcdb56-3cf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776715899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715899, "uuid": "c34eb95f-339a-4ac3-a95c-ce9ad649c18d", "comment": "Malware payload", "value": "e81b0f5a54cb4b44f05d93c84128ab89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715899, "uuid": "fc807168-ebe9-46f2-9360-9b8cc05439cc", "comment": "Malware payload", "value": "671b028033d4123f85d64c3c60ccf1f3057bf1e80b3189a355950ba6144ad256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715899, "uuid": "56ca173e-430b-47aa-912c-206085a84aca", "comment": "Malware payload", "value": "119b2fcd5bc1096aa1d5a28e9693c67a5d8ed3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715899, "uuid": "7083beec-4f33-4ed8-bf28-8fa9b8a35cdb", "comment": "Malware payload", "value": "941102810dc889b3f1ba3d0f349c770be7f3906421c53e71e838122e5f77b0372c4fee13299155e9edbc4383282903e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715899, "uuid": "8e49a057-c96e-411a-865b-1866210d72a6", "value": "T146F733F4AB02472DD71A78761B9928F9A82C6359DF53093129CC8E63F05AC8C9BD5C3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715899, "uuid": "90c86b67-bf47-4e61-b1f5-19f344ff37f0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715899, "uuid": "13730085-8a67-4480-a504-a51205365c4a", "value": "1572864:nNLdk5rvDIIAIWXGy1Qn3f0To0KTVFEPUnA0S+xk15jhrc3EuK7:N2VbpAIW2y1wyo0K5FH6VBhrv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776715899, "uuid": "dc06317a-bb6b-4b3e-8932-09752ffe8357", "value": 70148190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776715899, "uuid": "464f4a47-b8a0-4d32-8f80-191330ea7aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715899, "uuid": "a9eccfe4-66e0-4320-9b7d-c9b0a4374dfe", "value": "ChatAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82d1aa4-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776644851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644851, "uuid": "d8e04177-4bf3-4950-85da-0abbfb603976", "comment": "Malware payload (Vidar)", "value": "0015adfd8e4d0bb67371632ad3e74d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644851, "uuid": "7d7c23d3-8b1b-4dff-be99-a63b0c687c17", "comment": "Malware payload (Vidar)", "value": "673d15c65f3c65d8bf7518d2a47907a59c5f26a8dd08fb954107d162c1b3721f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644851, "uuid": "baa7ef7e-fb5a-4367-8097-312d81e2ba88", "comment": "Malware payload (Vidar)", "value": "a7fa3b69cc38d4fef947132aec1bccb48a67dee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644851, "uuid": "5f6e02f0-a3b6-46cc-8f72-ca35dbb62ffa", "comment": "Malware payload (Vidar)", "value": "6a7d1deca31b4a81a20a00fdafdc794ef72440d4fea3d8cdbac60aaf49419b45580b43e8bb237ae3041754f1598de91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644851, "uuid": "bd1a7e7d-c3db-4a2d-abef-b0e2dd2156b6", "value": "T12E3568CBD30464C09324567ACCC4DF945A1B66F00A386E5E3F36DAA07E4E3A5F82D6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644851, "uuid": "774e7486-767d-433b-a281-ce6fb6b9d28c", "value": "79b5ebc59d23627580ac969ff6636ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644851, "uuid": "481f023c-de4e-4f8a-995d-eabcfb8be886", "value": "12288:UEUov2AYIYAC1R4aHOjkMhqmJSOVbfqMWYoML/eHcI41AC6w+k5eySMsFW4RKejq:UEUvIrHh7VfqfMLtlzebMmVUseaUTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644851, "uuid": "5ac34b0f-bbc6-40d2-b168-a04dc811360c", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644851, "uuid": "ae4c8508-1793-4447-a423-2678a0df88bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644851, "uuid": "80ab51a4-51ec-43ea-b0aa-db0811bd11d0", "value": "333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8467a2-3cdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776705449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705449, "uuid": "d9bfe5ef-17e6-494f-b4ba-6f8562dd6414", "comment": "Malware payload (Mirai)", "value": "fac35713bff60380300112139ddd7c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705449, "uuid": "2894594a-97ee-47df-97df-983c8a6d24c3", "comment": "Malware payload (Mirai)", "value": "6743bcfacc02c55ea7b1cb4084ed6be5b46c4922b4d284d69e358bad78c6b999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705449, "uuid": "5518bf03-9e09-402b-a319-6d8558926fab", "comment": "Malware payload (Mirai)", "value": "616c68ffb1e707816090e8fd9ebfd82c2beb3d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705449, "uuid": "db30944b-b866-48c3-9e28-cf02b4082678", "comment": "Malware payload (Mirai)", "value": "7895077d146c18379149a943dcc568439b00ed7d19028ad551cad2e5ae54d1e018fbd60506f22b4851cec6665754cad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705449, "uuid": "8c71425d-24a0-458e-b755-8a1493fec31a", "value": "T1D7A3B44D7E319FBEFBEC823447B39A12A64927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705449, "uuid": "ee58e264-1519-4926-a582-ec0cc1f790b6", "value": "1536:FpLZ3NMS0YDw6hHMy8CjJqsNT3qgDt9HVeJ8e52wg1:jZdMW0y8C9qsNT3qCt9+2wg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705449, "uuid": "fb6528f3-8cb0-41a4-a1f2-e910207a68f7", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705449, "uuid": "a5ef0fc1-6817-4be6-92c1-846cd4dc03e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705449, "uuid": "1c903d1a-15c0-4073-a408-9d055aa09772", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21727214-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725773, "uuid": "73af38aa-602a-44c3-8009-6b1470b19b30", "comment": "Malware payload (RemcosRAT)", "value": "1bab0f0fed886bae81cca815390fed38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725773, "uuid": "e4e2fb03-7076-4d9a-abab-498afba01d44", "comment": "Malware payload (RemcosRAT)", "value": "6799bddeca70aec908aca05a7f56df7fc0b86773ee38100ac1928ed3f8323bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725773, "uuid": "91f4ef5d-57bb-4610-8c09-4d23a157e3af", "comment": "Malware payload (RemcosRAT)", "value": "5088907f7f2d858ef233a50a07657d402cd7e410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725773, "uuid": "f4e0c988-da27-40dc-bf44-e97a5be4c8e2", "comment": "Malware payload (RemcosRAT)", "value": "91cb19cce2c42fbda27ad85c33816bd818f9c28911569ac41034cd8089b1903bdf849352463b9a5e304c3de2c836e428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725773, "uuid": "5ec4627f-0601-46f0-b0e5-2e781ce2a7ee", "value": "T1EAD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725773, "uuid": "6fbd994f-bd20-402a-b134-71e31b0c0ba3", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725773, "uuid": "3338b93e-cd1e-4eb9-a0e0-d0889b13cf70", "value": "12288:iSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:XGuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725773, "uuid": "593c7db1-bc45-4ffe-a726-7189a163dbc2", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725773, "uuid": "72888a84-6ec8-4a86-916c-1a791e65a451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725773, "uuid": "ee812218-84f9-46ec-b479-2ca8e34a7a5b", "value": "6799bddeca70aec908aca05a7f56df7fc0b86773ee38100ac1928ed3f8323bd5_1604ed23-dafa-4254-9c25-88919d2ad135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16167c9-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725558, "uuid": "9872228d-f387-4011-9d2e-ade501192fb5", "comment": "Malware payload", "value": "40528b3126d69b023c529d1792e93c5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725558, "uuid": "9294db42-d457-4f7d-8612-e3e9d0c0afdb", "comment": "Malware payload", "value": "67bb238b5588dda629b50ab600b4d3b234dccacad05a1adc53ffe93858a3d2a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725558, "uuid": "db780df6-e52c-45c1-9121-63685c86fed8", "comment": "Malware payload", "value": "1e3d6cb54e45da6fbd2f55da5c3666565ad6fe6b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725558, "uuid": "1e5fe34a-0042-4de4-9141-7f791ebddc1c", "comment": "Malware payload", "value": "a374cb944600819b9d8799036ee6d3097ee1f8a930156d74d9377da5ef1275ca8f749c941f5f0e08e4040838a939019e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725558, "uuid": "0e9d1316-c1c0-4e8e-b713-41b513f72993", "value": "T1E3340B90B281FDF6EC998FB820D25309A3B6F085971DEB2B6A20FE3C025EB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725558, "uuid": "21c019c1-87e1-473f-8717-d6015a1733ac", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725558, "uuid": "25ae37c4-64f8-4f8a-896a-bd995876b877", "value": "3072:zcTWuVl7xAakt0S+jtKnkRsT2jD3KVuuHycOiZPYfU2jHKso2:zC7CakuS+RKnkK2XKVuuHy9iZH2jHKH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725558, "uuid": "e1c87b29-a16f-4550-8af1-96f8d477b104", "value": 234481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725558, "uuid": "a69fa027-f503-4eda-8f2d-054c3b67c12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725558, "uuid": "07986415-e6c3-4691-a62a-29df8248da85", "value": "67bb238b5588dda629b50ab600b4d3b234dccacad05a1adc53ffe93858a3d2a5_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25158ea7-3cd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776703875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703875, "uuid": "0616c242-358b-4477-a9eb-afa89d2c270d", "comment": "Malware payload (Mirai)", "value": "50f78831db022c539970c7ba5f67004a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703875, "uuid": "9ca80b22-0d04-43dd-a663-c65a27d61f46", "comment": "Malware payload (Mirai)", "value": "67df001a02f23b2099c112d07a2331a3f8e22421c130e9c59f14f5cce078fae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703875, "uuid": "e50c385c-26dc-490a-9fd9-ef85c0dd532d", "comment": "Malware payload (Mirai)", "value": "38ab7827090b6e676acd9c925cb71b5d8a0c4c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703875, "uuid": "fd108ea8-ab3b-48dc-a573-f4467a0f1d8b", "comment": "Malware payload (Mirai)", "value": "312e2e321ebc9ba36bc68f86a20b95234865f5baa3349a36e411744594d3e0aa1f9510338952e9647b22e7fbf2106a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703875, "uuid": "63cbe2e5-936a-45ed-ad1c-3fea466aa3ef", "value": "T1C9F2F22DC3858A10D5B7E03415EEBA7F1A67920CD044D197D28D7D4FFC3AA6D67282C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703875, "uuid": "1d281275-3faa-48ea-9fd9-50981d556527", "value": "768:bQI3pad7UAuDjGbojCXKxH4Ty6gQsz/+yoAZsetTcv6p6ZOnbcuyD7UHQRjk:bTpdA2CGxHQy6Re+FA3TcSYOnouy8Hyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776703875, "uuid": "13ced8d9-ee23-473f-85df-f28b952c99e7", "value": 36028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776703875, "uuid": "411b194a-ff61-4be2-a39e-cb9cf7012695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703875, "uuid": "81fd23a3-ac04-4ec4-90aa-63c2bbed022b", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1422cf7b-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725321, "uuid": "e5a80dfe-fcac-469d-aa24-28ba6cdef7cd", "comment": "Malware payload", "value": "1108014c89b0cc6d0789b9a022edf8c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725321, "uuid": "4e2d19e4-8269-4eda-b8c3-9792bb96ae7a", "comment": "Malware payload", "value": "68d8be6f50548c59476cfa0a36c083a93128c4b5985ee49a9ce5664ddd0733bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725321, "uuid": "af573925-b5df-4fd9-b25c-8cdbf7a469d6", "comment": "Malware payload", "value": "a16083eceb182ffc143c8ae91d9a4dcdda902709", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725321, "uuid": "fb68e9a3-7e8d-4e5b-b856-3c7e5b971676", "comment": "Malware payload", "value": "ac235c67abc29622c3dcde91287529b643f4bfc69a9fa31adc313a19dc580aef6286346f946ddeb65e1a993377048440", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725321, "uuid": "b010ed0a-a6cf-4fc3-9d4d-532dd183fa09", "value": "T1F6A34A47A2EA00BBE2B68678C4530A49D772B8511761AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725321, "uuid": "8a237252-b881-4773-8036-276de129e553", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725321, "uuid": "ab4f2133-b4b4-45d9-ba9a-e1c6cc5dbdb7", "value": "3072:8rTeXQwDasaAmiTQhAS/xYN0Z51756565rnIryH1/CIUK:qeXbuFaTcAS/0H0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725321, "uuid": "09e5f1bd-54c2-4e02-b873-313f9a3dc211", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725321, "uuid": "4710ec4c-2476-4ebc-9651-169bf026571a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725321, "uuid": "62595bad-e950-4af8-b8fd-76e2be641711", "value": "68d8be6f50548c59476cfa0a36c083a93128c4b5985ee49a9ce5664ddd0733bc_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f10d3d-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674209, "uuid": "de8d4b83-f86d-4305-a05f-967b9a676b47", "comment": "Malware payload (ConnectWise)", "value": "b8f518a16afefc3c6aee4451a9612a0c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674209, "uuid": "ff9e0c00-5178-48ac-8339-25ecbe939272", "comment": "Malware payload (ConnectWise)", "value": "6921edbb2461b6b2cf0b0a92b9554e7db9f2633c58895febc6fa02da0f55fdee", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674209, "uuid": "bf69de34-d3bd-41b6-9a43-315595d227ce", "comment": "Malware payload (ConnectWise)", "value": "7bc23b03284f2f9694afc71c4171b9d64072657a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674209, "uuid": "1853c038-70a1-447a-970c-91f5ba1ba96e", "comment": "Malware payload (ConnectWise)", "value": "49aad489114751dc2fe45ba9c1a818f48933301a07d740deef133a07655e1af4a501bbeb0586aef809c1de917c2d6042", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674209, "uuid": "24c399ef-e5b4-41e4-bab8-e65ca18bb3ba", "value": "T139750110B6E9883DE6F62B32FF7A92605F39BD251E20C15E9394350D0D70A919BB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674209, "uuid": "3bf9ec13-dccf-445b-b0f9-872426557c78", "value": "24576:SZPlmF0uwTKh56Z5vePu/DVeL1pVjeOpnUUGGu/aYmQurhwQUv:4mh69eWbVypVCygGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674209, "uuid": "5645ca82-3308-46f3-9530-3faad50598aa", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674209, "uuid": "1d5eeaad-aeae-4cf4-94c0-3b59c0ae09bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674209, "uuid": "059f3aff-e121-4a94-bcf5-e09fde3e7983", "value": "6921edbb2461b6b2cf0b0a92b9554e7db9f2633c58895febc6fa02da0f55fdee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83884281-3cba-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776690719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690719, "uuid": "d39b71bd-c1c1-4587-9b86-7fc939fab49e", "comment": "Malware payload (WeedHack)", "value": "b720c63c48c09b3aafb22058c08ec19a", "object_relation": "md5", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690719, "uuid": "09bd7805-48e7-43d0-9d0c-dbbc868c681f", "comment": "Malware payload (WeedHack)", "value": "6961b9af1cd02d882e28ffdc34af4e4e5be3a6bba4dd8b3ad929a0e14ac918b3", "object_relation": "sha256", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690719, "uuid": "80dfda56-c3c3-4909-968b-e814a3bed68a", "comment": "Malware payload (WeedHack)", "value": "cc09df8d93cddeedc6e57c497da8a5c1dc1af160", "object_relation": "sha1", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690719, "uuid": "704d0115-9a3c-4838-9d67-b867643c7315", "comment": "Malware payload (WeedHack)", "value": "d62f7d2f7bf77567f5f43414d4d7c5d6540c7d407ff17d37ff03782cfed775757775d8c5fe6cd6a60c345d355b5574a3", "object_relation": "sha3-384", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690719, "uuid": "cdcc22cc-4141-434f-94cc-3cd8ff6e4a46", "value": "T1FE36332DFEBD8C49231A5CD4EE26BA75CDA79CC808775E22CDBB591203D77E18AC5012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690719, "uuid": "eb955737-0fd9-4293-85ff-5f61d76d5afa", "value": "98304:6Z7Kb32h/I4BN05e1uTL7KlRw8flZUIG3IHSlcAEyd:69Kb3z0zMUH7GVlcAXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690719, "uuid": "3ef17dd1-35e7-4844-b426-2e359d9b56e3", "value": 5000150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690719, "uuid": "82889c8c-f11b-4631-88ea-8e7dd70ce3e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690719, "uuid": "f7f0a312-21ce-4e9c-8396-87cc2e6643e0", "value": "scrim client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad37dfe-3d12-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776728661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728661, "uuid": "10bbbb2d-ffca-451e-b8b9-148ea66efe39", "comment": "Malware payload (Mirai)", "value": "b1662280ae9d71f47e47b0ed8d6b4bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728661, "uuid": "b8650496-09cd-4f5b-a94d-9e3cd9e978be", "comment": "Malware payload (Mirai)", "value": "6a995d185a72559ba2e22e4edb0e198a7fa6332aa8cbb7066047d43e02dcd0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728661, "uuid": "f045b9c7-7f21-4283-a602-094958884284", "comment": "Malware payload (Mirai)", "value": "935dc3a921b4e989b7299af34a4d695078a7bec0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728661, "uuid": "468c3fc9-9f03-4097-a093-50ef5cca4730", "comment": "Malware payload (Mirai)", "value": "d5f6436eb6b0bf0be1f4a0281699f6649a79d726f9883ad32d5e06cf843523c838afb236bbd5cbe7391d02dd1cf476e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728661, "uuid": "686328ed-e978-4940-b34d-90663a438ee9", "value": "T1EF43A71E2E219FFCFBAD863587F39E219648379216E1C684E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728661, "uuid": "ec0ed347-4e10-4c73-9732-058d26e89676", "value": "768:ltzel5ktWAGpYGzrEIvfEI3wD95DNxnjIyOFyj6OvrGAyTEpWwA+hAWPlK5gkfT6:lK5MWAGpNzBax5DN9vrGHTvHKCwb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776728661, "uuid": "463b4fd4-f255-4f7d-ab5c-ddf9a7711f06", "value": 57076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776728661, "uuid": "291ae192-a682-4f26-880a-7fbdcd8635be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728661, "uuid": "f023b8c2-9e9b-4e52-b128-5e19a288754e", "value": "00okmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddafe87-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725606, "uuid": "6e50b937-25fa-40a5-b4bf-cb337fa1b253", "comment": "Malware payload", "value": "fe44df54d8fffefa574d566a233a7831", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725606, "uuid": "23024e8a-5f37-4e3f-83b3-8b69f9474525", "comment": "Malware payload", "value": "6adfc4b725b80846d385b18071973b71181dcfd85eb2be45959a2bdca927a6e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725606, "uuid": "2bb37cc9-a670-4aa3-9ee0-cccd4d1f7e88", "comment": "Malware payload", "value": "9531c4069b0836987b396cda14f2ce9f296061aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725606, "uuid": "126168ca-0711-4bb0-a068-eb689376582f", "comment": "Malware payload", "value": "081639429a01f98fcff81375d325818d12e477d2a549b0f10bec6032c99554effded0e23b8bf0e498dc712701fba55c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725606, "uuid": "72bc6c06-f4f7-40e5-9fb4-8c782d21bf47", "value": "T1F2A34A57A2EA00BBE2B68678C4530A4AD772B8511760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725606, "uuid": "286dc7b7-18fe-4d47-a534-199f096ada8e", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725606, "uuid": "85b1fd3f-8210-4d2c-b989-ad36d1e9c458", "value": "3072:12TeXQwDasaAmiTQhAS/xYN0w51756565rnIryHN/CDcK:yeXbuFaTcAS/0QzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725606, "uuid": "cd2f68d7-2c78-4994-bdf8-a01b36f086d5", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725606, "uuid": "8155bb18-565e-4404-b8da-eb10a1ba28b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725606, "uuid": "ef55f198-9ccb-4816-93fb-044e2f178852", "value": "6adfc4b725b80846d385b18071973b71181dcfd85eb2be45959a2bdca927a6e0_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb079b74-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644963, "uuid": "d2adb77a-65bb-4345-8f0a-aba6b687a012", "comment": "Malware payload (Mirai)", "value": "dc66e37b40a6768f4028226133137b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644963, "uuid": "a9b4cb07-911e-4986-be02-049478d65bed", "comment": "Malware payload (Mirai)", "value": "6af9a42eb78caa4023f8ba153940f131c415e521519c9f64c0829c373eff2ff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644963, "uuid": "9aa9f422-b0da-4108-b247-30eebe2822f5", "comment": "Malware payload (Mirai)", "value": "ef6a25efe42758b43c4efb21a145161e5c4d87e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644963, "uuid": "c6730415-7624-428a-b668-d6a78425f236", "comment": "Malware payload (Mirai)", "value": "594ce74118712843794f818f0da7eadd366e74b67f5674cd7ec2bf901dfaad74e48249bf59297741ebfee189ed1db2b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644963, "uuid": "b9760a8a-b3b7-4bd0-bc89-c6c945f08d21", "value": "T1E2037DBAC4296D84D5154275A8358A7C6F63E110D3833FFA5B4989A68047EFCFA0A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644963, "uuid": "7713f929-f27b-4646-9cc0-78f0b7f9f35d", "value": "768:Ha9fewtwwF6KHX/3ee1dEigANW3/rfCXoCfaCi:HadewtrVbCcKfHMaCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644963, "uuid": "7571819d-9827-4976-abde-70a75f71ae9e", "value": 39212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644963, "uuid": "2cef5d03-e953-4016-ad3c-c5c21fc2b151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644963, "uuid": "a87f91fd-950c-4c97-a267-bfc3af452ac4", "value": "00oksh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736cff64-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725911, "uuid": "1acc485e-d8a6-4af8-8595-f7c179955eab", "comment": "Malware payload", "value": "a45198814284740425d71697a083b1d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725911, "uuid": "2589a548-3885-4396-9a78-67e74833f943", "comment": "Malware payload", "value": "6b5dd18c16d559337480bd2b3fdc0e2afcf3c1c2161636967591c00f5282a51c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725911, "uuid": "b4d0b22c-0d43-41e2-be1f-e6d93ac332b6", "comment": "Malware payload", "value": "a49d9b5141bbdf877728515b79f5f5636932436b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725911, "uuid": "ba30f5fa-a85d-4010-af3f-8cb254c65c75", "comment": "Malware payload", "value": "3328fa1d3d5dbef9e1de6c64c5ba2370d7377fd4c92ea96db1de9e8263239d5538997a3bd81b3d636f83846419335f01", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725911, "uuid": "b5f83bdc-44c1-481f-ba9e-925a75ba4649", "value": "T19E72080EE68BA8BDC109E1B40DFB5B31A5B57D36067D6B2D2314DFBB4E00694A26F810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725911, "uuid": "ae07897f-f74a-474d-ab2f-f740ae57d43f", "value": "e42678787d5b7aff9b39c41d548b8e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725911, "uuid": "3e51ce93-478d-4cbc-89f0-40877477e529", "value": "384:Fcrz9pAvSVbZltYzwVD28+KKmckVPxIiTgALMyK:Fg9sUb/KzuDumckVPxIiTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725911, "uuid": "5032738b-7379-428a-af5f-63a3ec1f1938", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725911, "uuid": "2825500e-153b-4e5f-b0e4-da9afec3fed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725911, "uuid": "a6fa4eb8-4973-41c4-93c9-15428b24785e", "value": "6b5dd18c16d559337480bd2b3fdc0e2afcf3c1c2161636967591c00f5282a51c_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50717dd-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725591, "uuid": "aad9401d-61f5-43c8-a760-49f1250e17c2", "comment": "Malware payload", "value": "61a673b5a408a779a33265d27c46d7f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725591, "uuid": "532eeaf5-8673-4b91-8e1d-d0a4387b271d", "comment": "Malware payload", "value": "6b71533aabcda84c9b3d30f64b9c4d4688a01ccbe59922029497468239436d09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725591, "uuid": "09ac5e7b-fd42-4018-8e56-dfd510eb0f3f", "comment": "Malware payload", "value": "881783a0c8eef503894030bdf17dfd2eb9354b88", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725591, "uuid": "498fcae7-947d-4820-8f1c-f630339e27dd", "comment": "Malware payload", "value": "36d734478049b3f90f4469adc9e741d5122f3eb5b6c66cda5140e06930e4301e17de4484a96e7cb06ce66a88183c8a55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725591, "uuid": "8e4b03fb-f7f5-4b31-b4e7-489f48ec6a5f", "value": "T169A3494B62EA00BBE2B78678C4930A4AD772B85517619FEF43A4425E1F273C18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725591, "uuid": "61ca0785-778c-44de-a122-923780aae931", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725591, "uuid": "14e1d72e-73ff-4062-8f15-546eb216de19", "value": "3072:F3WHVWRRWAo2QVAChQNDvrXT/7nM4L3zm2Q9ZVbZacTihsrHRj33:xW1UIE4ACh4sF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725591, "uuid": "9ea407e4-a885-46f8-90db-3c4dc6368009", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725591, "uuid": "c52c1b83-07a9-4dfa-af3a-fd51c4ee312d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725591, "uuid": "19617bd7-e1cf-44cc-a0e8-475bbb24bbae", "value": "6b71533aabcda84c9b3d30f64b9c4d4688a01ccbe59922029497468239436d09_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e7b951-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725237, "uuid": "4dc4c03f-1dc9-428d-b860-82132650b41a", "comment": "Malware payload", "value": "1641c13295f30b66c9afb3aa43116f47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725237, "uuid": "b3d36f78-14d4-4283-9242-056c9362d8cd", "comment": "Malware payload", "value": "6ba39c979f3f4daf1e1fadc4b7eb983ea1fb48fa49a5a5325c99afbbede2d289", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725237, "uuid": "841b4f33-50cf-4ce4-b9a1-45975535fd2a", "comment": "Malware payload", "value": "c345269b616a63332dd8b9ca57a96cacfcb9ead4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725237, "uuid": "61e703bb-d9e0-44fd-b4f5-f142e5a7581a", "comment": "Malware payload", "value": "286f430ac93bcd786fb2779a4f60a785ead35608337bfb1bd579094c155c98e34ca3ea29b8ab71257b65ad2f818a6a47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725237, "uuid": "f94e0961-ec0d-45e3-b23e-d8a88ab460b9", "value": "T1D1A3495B73E900BBE1778638C4574E49D772B8524720ABEF43A4465A1F233D18D3EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725237, "uuid": "914e8a5f-f7b4-490e-bdcb-b493dd6b34b9", "value": "3f65ea29d90fcb98cc03781edfc42862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725237, "uuid": "fa9eca7d-3d69-4398-9953-9208f4e8c615", "value": "3072:5LeTrVwYwnGysQbEATnTz7KJMblIdj9dLRQpu:4ThwYsyMEATnHewu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725237, "uuid": "ca389b54-468c-4692-8292-76f0bebff315", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725237, "uuid": "e99aa33b-3499-4d69-bbf9-d5c11126abfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725237, "uuid": "1524633e-671e-401c-8ed9-3be3bb29a9c7", "value": "6ba39c979f3f4daf1e1fadc4b7eb983ea1fb48fa49a5a5325c99afbbede2d289_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b87cdd-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776696329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696329, "uuid": "b55300ed-43f1-46c1-b6cb-a3a858169153", "comment": "Malware payload", "value": "0bd01c9fe17844eefff3c2db1201e143", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696329, "uuid": "bdd1d855-dd7b-4fff-8705-bb79fda4d232", "comment": "Malware payload", "value": "6bca1bae97dc42ef0f89dab860c99855978ac3dbdc13169e009caa8c60001ece", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696329, "uuid": "c0c4488b-598b-425c-a364-435132707ac9", "comment": "Malware payload", "value": "1602812b33a3f436ed2cb999b37a38a69e35cfd3", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696329, "uuid": "b3521cd5-e023-4571-adb9-49f2ef80e10b", "comment": "Malware payload", "value": "8a36657a02b7369f8e6d66a383cddf69de942f90c22ffe0f2e6bfc51e56580aaca0530a45820b36a9f087eddf78f30f6", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696329, "uuid": "7e2214fc-b37e-4d8b-af12-cd68e7dd9d13", "value": "T14E43C02E7262E416DA81897A8EC4C2CB6B15BD82EF53D14B36C0770F19372D1875B29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696329, "uuid": "bd17a6de-ad1d-4781-bf7c-b52b8f1afd2b", "value": "768:X85ljnxhxOHWRHXjcU8JE16bgNvgynry5WZjqJrNfz1vSnjk6rg3ycoWW1E6uBM:X85t9OcuJeA+vgynm5n5vAYyxZC6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696329, "uuid": "280205e1-4e7d-4301-89d3-d40251125424", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696329, "uuid": "6ec16209-5406-42d8-bfde-e3aa7d345f45", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696329, "uuid": "71888f8d-4f39-48de-ac88-895ef7a1bd1c", "value": "HSBC Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bebf162-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725495, "uuid": "ce42c371-c09c-40c4-8eb8-23c43bda6d12", "comment": "Malware payload", "value": "75a7c9e7b7e2a241d3f014ff5279ce5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725495, "uuid": "2943f83c-406f-4a0e-8fe4-721e6f7c1192", "comment": "Malware payload", "value": "6c3de9dcfdf458bc0f8b62ef1dcbaf339eb313d2206f952c47b12b431f3f39ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725495, "uuid": "7a3cae80-a7ff-47b5-8b1b-7018f5a5c624", "comment": "Malware payload", "value": "04e015abd77614eb43eb975e88060bf9eff84519", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725495, "uuid": "4cbc8602-7fd4-4941-8de0-1e6d55c62c1f", "comment": "Malware payload", "value": "b25d09440edb341ba0777cff0357efa15fb6e26710336a58c03e147788fae65d900a28b93929164773e7379e5eff9bd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725495, "uuid": "2d0a201b-680f-4f6a-a9f3-5139b7e6f856", "value": "T13EA34A47A2EA00BBE2BA8678C4530A49D772B8511761AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725495, "uuid": "e2b57b85-3ebd-474b-a11b-ea0da294f19b", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725495, "uuid": "3d2b3236-0b07-452a-b08c-221b55d130c3", "value": "3072:e9TeXQwDasaAmiTQhAS/xYN0g51756565rnIryHC/CJUK:KeXbuFaTcAS/0saR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725495, "uuid": "b66dda64-407e-403f-bf56-9b76609c42ea", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725495, "uuid": "d4d908c0-d5c9-4adb-ae91-8538effc2b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725495, "uuid": "1367ff57-4770-4a73-a182-0a5a6ebea252", "value": "6c3de9dcfdf458bc0f8b62ef1dcbaf339eb313d2206f952c47b12b431f3f39ef_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef75a65b-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726119, "uuid": "b75570e8-5e7f-465b-aaca-fffa8fe15978", "comment": "Malware payload", "value": "6f6ac64ea4c23976b8b6aa66c1c1fb37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726119, "uuid": "4dbe9686-976a-4d35-8f0e-7390322eac1c", "comment": "Malware payload", "value": "6d08fef537ad92a618cad3efea018363d5bff84f30669747b49b5dd3789c5555", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726119, "uuid": "3bceaa81-e65c-4a30-a00e-582384efa770", "comment": "Malware payload", "value": "694d8ff81bed581610e4686444c640571b464d74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726119, "uuid": "9710d3cf-0a93-45b8-ab48-e97973608015", "comment": "Malware payload", "value": "94dde33cd2cdaf6b169c846877c9f30c2d3ad364e4f8bab12e3310d09fa57597639ca625ac7420aff801a48eb0e7bc40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726119, "uuid": "3576f188-45c0-486f-b555-900478cea70a", "value": "T1BCB35B5BA2A500FBE5778279C4670E46E3B2B85217609FFF43A4421A1F237D18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726119, "uuid": "1e6b29ba-979f-4c02-a4dc-fa75b55522d6", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726119, "uuid": "31effce0-b8b2-4881-b6ff-6870be42482d", "value": "1536:9+uTtrLOUnelseYw4MhLVxj5pVTH4SFcSdhn+hlLevtEJsWTrd79dl2NceVsBpN:9H5/Rngoyhj5plYAhn41ktqBzkNvst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726119, "uuid": "a3c2be72-8b26-427f-a555-8170dc799f94", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726119, "uuid": "38f492e3-a080-49b0-8853-9ea11d5ccc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726119, "uuid": "4d370ff0-1451-402c-b3f6-571fc12596f1", "value": "6d08fef537ad92a618cad3efea018363d5bff84f30669747b49b5dd3789c5555_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfb6df2-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725499, "uuid": "3559e8e8-9cd5-4fdc-ad5f-5e7ae0b59591", "comment": "Malware payload", "value": "68ec93ec28b71a9475cd8d24f2ccd379", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725499, "uuid": "fcda5b47-b9b1-48a8-b194-fd665e96eb44", "comment": "Malware payload", "value": "6d3448fbc1cb7f2cb9d5f87571449a435873c9633c7aef05185aa7bae0b708b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725499, "uuid": "38d1f74b-a30d-4025-a85a-a32ffca25f12", "comment": "Malware payload", "value": "15192e9bf82e56493b06b6fbed4bab68d9897a55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725499, "uuid": "88c8f4cd-827c-4607-b60b-5dd65df792ba", "comment": "Malware payload", "value": "c4758c09bd03e325f0e6a6c17b038842fc47cf2e05654f8363ceadfc7334b08846c582bfd2c128bcb5568fb6e6e0515a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725499, "uuid": "6fb2a365-a717-4bb1-b4d7-18d8644a80e0", "value": "T16AB34A57B2BA50BBE1768338C4670A45E772B8414B61AFEF43A0465A1F233E09D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725499, "uuid": "4b9bdd39-447b-416f-a059-c3cbe10531ba", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725499, "uuid": "26ded879-e351-46c3-8309-08dda90e2b9e", "value": "3072:HTXxQHNopvHzzSg6FVQezDZ4C/x5qVR5AK:7xA6VzXO+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725499, "uuid": "0b9ef88c-d71d-4f17-9085-7bea4a00d7f2", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725499, "uuid": "a2294421-61b1-4307-8b15-923ec400c6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725499, "uuid": "f61adc71-a8db-4812-95f0-08ca1193644c", "value": "6d3448fbc1cb7f2cb9d5f87571449a435873c9633c7aef05185aa7bae0b708b6_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853551a4-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673971, "uuid": "81e3921d-98de-4aca-a007-fa8b5d9afdb8", "comment": "Malware payload (ConnectWise)", "value": "b75e39aa3857afa28de10d7387d20dd9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673971, "uuid": "0f6f8911-09b0-490f-9080-5de78b7cefba", "comment": "Malware payload (ConnectWise)", "value": "6d875d4ccf68851e9383322ca6404322ce953c974b92cabfc6211f29aca19000", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673971, "uuid": "a095f488-3bd4-4524-a94f-b2e610d6fe6b", "comment": "Malware payload (ConnectWise)", "value": "84d3254d706c9a87a109502216f24dd890c00806", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673971, "uuid": "e6b10c9a-d60a-4eda-8b96-483d09f01bfc", "comment": "Malware payload (ConnectWise)", "value": "9459476c86d9f59e21028632cb5a7748c3e0a4d3b9c153af9c1c87d6380c2b096daaa7928c370c052655b4a68bc3907a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673971, "uuid": "266ba383-0e33-4a88-bf32-5b3e0364a821", "value": "T1BD46E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673971, "uuid": "d034065b-c540-44b6-8a1d-2eeca636988d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673971, "uuid": "b3891977-4fbc-40b1-b99a-e61e3c10005c", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlcgLLLLK:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673971, "uuid": "0e7d4be2-0792-4b87-98d0-2b12f35f1c69", "value": 5788664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673971, "uuid": "5a1d04ae-e8ab-44a2-b93f-f5b4ec4a83cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673971, "uuid": "14e3e6fb-5fae-47f7-8fc9-0a568e6c6676", "value": "6d875d4ccf68851e9383322ca6404322ce953c974b92cabfc6211f29aca19000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7830e066-3cbb-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776691129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691129, "uuid": "05daac26-148e-40c2-a8f6-e0ddba292f80", "comment": "Malware payload (SalatStealer)", "value": "855edb9d940143aef4a235c4543002ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691129, "uuid": "d50b695f-b1d7-4734-ac71-d9b71074966d", "comment": "Malware payload (SalatStealer)", "value": "6db42494bf23cbf25a5d370baa2da589f99166a3dbbe746f6342d8e034312a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691129, "uuid": "68486fe3-0d7c-4b28-94e6-d373fd2d63b7", "comment": "Malware payload (SalatStealer)", "value": "8ea5b81acc5fc064f8115eae9308d63057cea4d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691129, "uuid": "df9bd828-c1b3-42e8-96f8-14b23aec4616", "comment": "Malware payload (SalatStealer)", "value": "7993fe5c7f3a3eb708d26ea9f99525b289ecfdedd0bdfde98285c4febf1bce163bb1880cd50a39a2a3a38248128371e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691129, "uuid": "6dcdb85e-ce98-474b-b50f-c7bd45b1aca5", "value": "T162C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691129, "uuid": "655c6df7-fd52-4815-901a-3b9dc9fc0efb", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691129, "uuid": "614a16cf-a00d-4e3f-8db4-30ac5e829d72", "value": "98304:CLeG61elNbCGfnf0t0E6VzcV57OOiT4kG20CbEY:y6ajfffE6kmkZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776691129, "uuid": "c1cb80f8-916d-47c9-99ae-851ea29a1f2f", "value": 12572672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776691129, "uuid": "e64b9040-e7bd-4146-9d79-97f323099d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691129, "uuid": "9d7195cd-b58c-4f95-a87b-a43be84beca3", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758a9cdf-3ce1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707446, "uuid": "adf74ed4-f776-4395-b657-c1df117723d0", "comment": "Malware payload (Mirai)", "value": "86db4b0014508080fe58516f30b53ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707446, "uuid": "2175bbdd-ed09-4f2e-9a34-ace7ec8fb38f", "comment": "Malware payload (Mirai)", "value": "6df4c91d16ad3fa441363d72b98b024fbae17d27616e59263edf4282749a5edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707446, "uuid": "7a8c724b-b6bb-4bc4-a67f-7448d37efe1d", "comment": "Malware payload (Mirai)", "value": "9a2e18f8e5b2a7c330d7ab3af7d310b1815ee6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707446, "uuid": "ca9fc923-6c0e-48f3-a77a-bcb7d2afb435", "comment": "Malware payload (Mirai)", "value": "06da77ad79b63826138d668a73d97c8185652b9180e5394c4757d7162d26c0f2e4bc624d2c3f28de033d19a25ca783fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707446, "uuid": "7183ab05-48fa-4123-b1aa-69ca54567f41", "value": "T165B3AEEBF6472592C85243F013C79FCE3E2322909E57A5E76D1E267B25790CB1D06B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707446, "uuid": "66edc820-0fb1-4773-8073-cdbe30032e98", "value": "1536:NdF0l6gKLckzizaliGTx6VCNbsp/xJ6bngza/LW5:jelYckezRE0VkspWngzaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707446, "uuid": "3ba8a161-767e-4399-849a-8f36e9273575", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707446, "uuid": "66a1aa54-8539-4764-8c1a-3dbef57cb4a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707446, "uuid": "3d2392c2-1c1f-4645-8924-db2177f5aa8f", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e66bfca-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676483, "uuid": "1a9e422a-23db-44cb-b5d2-a1ca969ede72", "comment": "Malware payload (ConnectWise)", "value": "2fe2dbeb0b4baecef9c99ab7d69fb83b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676483, "uuid": "00fb4445-cd08-48c2-8a79-0b90220bf415", "comment": "Malware payload (ConnectWise)", "value": "6e4dffb5e8b416ee7a43a67a642c0792eb91aaed715e965d451fde3a398ff2ec", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676483, "uuid": "bb22459f-7bc4-45d2-9c35-52140e4d289b", "comment": "Malware payload (ConnectWise)", "value": "65ce81d4440f39006bc7bac033cb18ec61add02c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676483, "uuid": "f01e7e31-d9a5-4e85-8b81-033cea9ca085", "comment": "Malware payload (ConnectWise)", "value": "22881589d1357dfb2a7204099018e6da5707213171108ca783279714e8cc7ef286f1d31354ecb007f90cd3ef6805cf97", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676483, "uuid": "7671915f-86be-4777-a5e8-c68ad2a2238e", "value": "T1FD46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676483, "uuid": "85a86711-b3a6-416a-9c9e-2aff8d591879", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676483, "uuid": "1963a8c9-ecba-477e-9663-82daf4d10e1a", "value": "49152:MfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:wqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676483, "uuid": "33d62c73-1d2b-4674-9275-48957dc170f6", "value": 5649200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676483, "uuid": "6db957e1-7bc9-44a3-8e83-af8169c0b2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676483, "uuid": "bc79a5d7-b5cf-43b9-8b39-3e1650708066", "value": "6e4dffb5e8b416ee7a43a67a642c0792eb91aaed715e965d451fde3a398ff2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0f61c8-3c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668693, "uuid": "0bcc8290-ce2a-4acb-87e5-fce004037778", "comment": "Malware payload", "value": "7bf87174b011999bfab65048ea3331e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668693, "uuid": "e69c83a7-7689-41dd-9859-26bc8eef6b3e", "comment": "Malware payload", "value": "6e51da140295ad9487d43dd0e6704311e9637f3d1398bc3ded110f69e3c20736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668693, "uuid": "21d759ae-81b4-4e3f-9edc-19d3f650d88c", "comment": "Malware payload", "value": "d5e84954aca3814fae0fcaa6207ceef6841daf8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668693, "uuid": "d6db4736-ac23-4116-bc07-cc06f3fec5e2", "comment": "Malware payload", "value": "6fb0c40f480cbd9074ba3c0321077b7566e4364192f7ea33504161acb3fd287e1ff0584b9fbd36163f1756b00d859661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668693, "uuid": "3042625f-e69f-4ea9-9b48-7913a88e13ea", "value": "T1D6B79432CE450E674EF262BC69658AE3FA70A32F1380591BBDFC9A4C1F76D716042B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668693, "uuid": "b147ae40-7d25-4e55-81db-463d6859c0ad", "value": "90e661b7ca3751e7b7204b32177d7330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668693, "uuid": "d4338c9b-5a74-4b87-8d9d-390316e6c60e", "value": "98304:oQb8GMfXGN+nVVUH3v397uv+dfSxJqlXgsnTZ63Bnnnnen+X:oNVVUvQiQ8TZ63BnnnnEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668693, "uuid": "4a050336-c475-4d94-8029-76889e07f2af", "value": 50130712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668693, "uuid": "f387bd90-fe9f-438f-b116-6d55afcb87d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668693, "uuid": "89500393-ba46-4e77-80bf-75db01a1b61e", "value": "6e51da140295ad9487d43dd0e6704311e9637f3d1398bc3ded110f69e3c20736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e25e2e-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674726, "uuid": "d0bc9340-e1bd-42c5-abfa-b1f25b35b32f", "comment": "Malware payload (SimpleHelp)", "value": "8195b7b23d66ec44755e40e36eaf605b", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674726, "uuid": "2ccaf4a3-1e1d-486c-8891-3a50bc07513a", "comment": "Malware payload (SimpleHelp)", "value": "6e830cd023fe628b1c2631e6109597ccb88f95067f9e0ee43f09d1f4b477c058", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674726, "uuid": "2a44ed75-9c73-4c0f-8e40-ef90cc38ec77", "comment": "Malware payload (SimpleHelp)", "value": "53a73b609b67e4945837c164fe31fb0f1f18023a", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674726, "uuid": "db6dc957-8696-4bb9-beb5-03ff7c07d272", "comment": "Malware payload (SimpleHelp)", "value": "00586cc82c42796ff0a63fd0cee2f27bd79ba72cf775a239dceef891638485e1f97f0183c6c9e46abad0c1ddfed7dea2", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674726, "uuid": "f4cd94e7-c16b-47ca-a385-ae17ca784628", "value": "T18D773324FAA16DBEDF33D5FCC4464147AA5AA4A70389211327F145E68F207D0862FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674726, "uuid": "8a556007-db26-41ef-a901-636d58cf2271", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674726, "uuid": "2606bc88-fbc7-43c0-975b-e38f35fbe2a2", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcG:K/jkCgpPUK8PyL7M8aE1VWhroHFcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674726, "uuid": "0c15778d-f550-494d-83a0-62404edd0765", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674726, "uuid": "b4c3ca20-53f9-49ca-a576-f129be42ad20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674726, "uuid": "c002c4fa-7aa7-4cf6-bb1b-00c67701de3d", "value": "6e830cd023fe628b1c2631e6109597ccb88f95067f9e0ee43f09d1f4b477c058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c359faab-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776726045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726045, "uuid": "02d2b358-f8cf-41f8-83c0-7337b2bfa4dd", "comment": "Malware payload (AsyncRAT)", "value": "336321ab21e0255ff79e56907ced35e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726045, "uuid": "d040d8a8-c68d-4e49-99c1-0d9c9df295c7", "comment": "Malware payload (AsyncRAT)", "value": "6e8a6741f6cabd174389ce0ac693c2712aa7aca9bd697e9a3eba975bba985b46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726045, "uuid": "c8881c9b-e25d-46d0-854d-aa0ec32c315e", "comment": "Malware payload (AsyncRAT)", "value": "883339cea7e584e195fb9f7cc3ec33463281a0ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726045, "uuid": "d334a44a-f8b4-40b3-809b-54fa1f6a1b6c", "comment": "Malware payload (AsyncRAT)", "value": "383a62d5e9f93cc9c323e2378cbca5767642b79baf99731e2993b359912abe5cea7763292022cf3efa658b2b45bc4cdd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726045, "uuid": "429ef59c-80f7-4466-b4d8-99c02a09e744", "value": "T148E24C4877E08312C5FEAFF12DF3B10A5275E11B9823EF5E0CD889962B67AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726045, "uuid": "0bb4c954-7486-42fc-986b-da2945ec1ee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726045, "uuid": "d4d487ab-e95a-45a0-8ccf-e42eed4a0f45", "value": "384:opaJuqQYbqjpk972V7/AqBZB1FOmLpM4vh0FbOKTCOQKFRApkFTBLTAOZwpGd2vY:d16zY0FPC4vGFbO75KFVFo9j+Ojh+b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726045, "uuid": "91dbfcf4-ea3c-4164-81e9-2e4794f96e22", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726045, "uuid": "2f79cbbb-c68c-4d36-8301-189ddceca00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726045, "uuid": "9cec02f9-d180-4193-9406-1972ad09a0c4", "value": "6e8a6741f6cabd174389ce0ac693c2712aa7aca9bd697e9a3eba975bba985b46_23546e0c-c384-4f94-829d-ac28e5daaf8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7f95a6-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676587, "uuid": "da5722a9-5327-4267-96e0-b08d2307329d", "comment": "Malware payload (ConnectWise)", "value": "33b6e57f1573950d7d121dbd6f96b9f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676587, "uuid": "014defd8-89f1-4928-a8a1-51588c83e1f2", "comment": "Malware payload (ConnectWise)", "value": "6eaedf03024a573dbacf83cc186f15c112a62db7ec9c0782f0ba18dfec96fab1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676587, "uuid": "eaa0004a-553b-4965-a48b-0f1f3e0c2e7c", "comment": "Malware payload (ConnectWise)", "value": "b25b84710896e7c6d45591b58b20604213d7ea2a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676587, "uuid": "7feece7d-135e-4ac1-9fb3-7d7f3e8a35bd", "comment": "Malware payload (ConnectWise)", "value": "2a0fdb17889c07c92f0c0c95dd1c82891c2eaff94f6a3995e99fac6ebde820e3df2994645e851d02feeed3756990f01f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676587, "uuid": "c58fe14d-2739-4780-b60c-ef30e8f47b49", "value": "T16E46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676587, "uuid": "1e43c187-5da5-45f9-ae2c-84dc5b518e3d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676587, "uuid": "8bed13df-1e22-471d-937c-65602ac64925", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676587, "uuid": "1133b6f9-373c-4969-9e8c-40cc0a79e928", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676587, "uuid": "7c3c3e2d-4106-4098-aa85-295be5985f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676587, "uuid": "b102968a-87bc-4656-8acb-7c05bb5a1405", "value": "6eaedf03024a573dbacf83cc186f15c112a62db7ec9c0782f0ba18dfec96fab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446d968c-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689324, "uuid": "6ac0371d-bbe9-4123-9839-2d0e014e36a3", "comment": "Malware payload", "value": "7b0a33ed5476561e9ac0fceeb1da43c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689324, "uuid": "4400e70e-ea25-441b-bf11-78e96d6c92c9", "comment": "Malware payload", "value": "6f2bbe66a67f5e7a655bf1c775bf342ebcbd5235daad7486c0154505c209629d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689324, "uuid": "725dfce6-0a2d-4677-b416-8b3418ca5ee1", "comment": "Malware payload", "value": "f0a81f67a43c2994b7461cd02f75e085bf6696a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689324, "uuid": "26ea62d7-de77-42f9-adc2-a26e0bca29b8", "comment": "Malware payload", "value": "531b830cbad6896190f8e100946352e20bd30915610eeb79f640b97a90aaebbac8fedd64ffbdc006fd1e2b226e11d904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689324, "uuid": "09ab9da7-89f0-4205-b02e-b7ca5a2c7a63", "value": "T17D443A07A7AB40EEF0A2D635C9D24841FB727C595B6156CB03507AF60E727AC6E3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689324, "uuid": "638ad346-c3bf-478c-be1d-b986fc08630a", "value": "7a8c872f8e13d32f36a675b52eda1d6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689324, "uuid": "bbd24207-7576-4fba-ba56-8935e8e08267", "value": "3072:V9G2U1qr+L6n2dIrOaWkwI1RcCtZKekAGVs5u9XLhcg:VMCgIrOa1bvDt6R9Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689324, "uuid": "703776db-10ff-49a3-a961-b37d7d5fa092", "value": 267168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689324, "uuid": "60214901-2346-4b08-bae3-60b4f6c81fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689324, "uuid": "fdcd24d2-eb01-4ae8-9213-778e6ce4c4bc", "value": "6f2bbe66a67f5e7a655bf1c775bf342ebcbd5235daad7486c0154505c209629d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd20d419-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (CrysomeRAT)", "timestamp": 1776696426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696426, "uuid": "a3dcdff4-666d-4429-b18d-da763b654cbb", "comment": "Malware payload (CrysomeRAT)", "value": "cc2dfa90962c4ef26d07f424b6acc1ab", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CrysomeRAT", "colour": "#F8433D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696426, "uuid": "67790e51-b2e7-4a71-a451-449f249d2871", "comment": "Malware payload (CrysomeRAT)", "value": "6fb48d98da5de9ac1b06f3ceb240db4d5165860acbe1b16018d169a6dd9762a1", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CrysomeRAT", "colour": "#F8433D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696426, "uuid": "329cfe0f-27b9-4920-bafd-ce7594b1b034", "comment": "Malware payload (CrysomeRAT)", "value": "660ab385f3a407e6684cb15965b79558aa6f2f1a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CrysomeRAT", "colour": "#F8433D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696426, "uuid": "8eb3ed1c-fd66-41fc-a218-06614bdc80e1", "comment": "Malware payload (CrysomeRAT)", "value": "8d2e8d150e975fcd57efa460a64157f3b0ab3c624f93b5c7e6918a9dbdec424983d74d290da62011ef9a14a91478dc3e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CrysomeRAT", "colour": "#F8433D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696426, "uuid": "d3586bc8-c71f-4e1c-bc2a-3773e47ee6bc", "value": "T1A6A38E41F3E141F7EAF2053100A6762F973662389724A8EBC74C3D529913AD1A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696426, "uuid": "5d8ef320-8367-47aa-a601-79b1e651568e", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696426, "uuid": "ac81b957-23ca-4cf3-b455-be000949ad5c", "value": "1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfswvQ33Dy1Oi:D7DhdC6kzWypvaQ0FxyNTBfs1zyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696426, "uuid": "1e01d106-2eba-4c45-b719-9f2a3aaef52b", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696426, "uuid": "f5d136b6-57c5-455d-a0ee-e0d7f10e3fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696426, "uuid": "f14ce819-df3a-4454-948b-3f191a29b0b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e67afc-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776725962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725962, "uuid": "d7b4f480-977d-46d7-b476-454ed96f5004", "comment": "Malware payload (njrat)", "value": "e82ce30dd90338c137c3f589bb173b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725962, "uuid": "cf78e3fe-8a36-45f7-bf69-a369a3d60c54", "comment": "Malware payload (njrat)", "value": "6fbdb7ece48b9ac677ce42083b627bd3bb01bd448ba0f511974697f36e08d04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725962, "uuid": "4764a184-521d-48b0-8b80-abf4b2b6e1f2", "comment": "Malware payload (njrat)", "value": "e4a032d585c2c3ca4b3640cc0c86e7775b629419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725962, "uuid": "9313195a-6e47-4ce8-88a9-6da82ce2197f", "comment": "Malware payload (njrat)", "value": "59c5ec4cf93360dc408bc709181077b5d70de4486c562eae7808ac24ea86999ed7e08a2a39820f5ddda790d8647e83f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725962, "uuid": "2d4fcc15-e370-41b9-98e9-28335e2b5bb7", "value": "T1B9A48C2DA2D01F46C38C1EB8D86B951453F2969736B2E39C9EA442A73D423E45E4F3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725962, "uuid": "9eb7b315-26a8-4795-a220-2b7c3581eede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725962, "uuid": "97798961-7482-40a9-aa5c-76709010d21c", "value": "12288:Dv80pij/1oj2KI2pcbvlRzYCJKrR9jL0LSl:z8s2KI8cbdtYFrRdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725962, "uuid": "e1052a20-91f9-4c92-aefb-b80a900dd2c6", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725962, "uuid": "21be8509-364c-44e0-b6fa-7a891331c6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725962, "uuid": "937c799d-6e38-4e82-b222-adf90d570244", "value": "6fbdb7ece48b9ac677ce42083b627bd3bb01bd448ba0f511974697f36e08d04d_1cff506f-5ec6-4ee7-8ea1-1558f4af1c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd72992-3cb5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776688399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688399, "uuid": "eae7ac1e-6d98-45f3-be97-70c6303d324e", "comment": "Malware payload (RemcosRAT)", "value": "39f086790db40687aa9800a7ff24cff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688399, "uuid": "bd801e31-d131-46a1-a4f7-6759a4ed385f", "comment": "Malware payload (RemcosRAT)", "value": "6fc705ac1a667537515190a50ad2b2ba6dbcc7aaa80e562c440659e40627abf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688399, "uuid": "cdd80fb6-2bb8-4ebf-bdfd-3e2b3baf3b55", "comment": "Malware payload (RemcosRAT)", "value": "20a676d805309b9790e442db8ce4209cee5029e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688399, "uuid": "ed5924d3-9977-4c3f-80c5-d93bd64c48d0", "comment": "Malware payload (RemcosRAT)", "value": "582eb0cbcac3f275992dde9cb4e9f4820dea68e303d3827a01ec51edeb22b7d078a6a84372898bab55f1793666b74698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688399, "uuid": "9931840f-2f68-48f3-ab11-af5fc5adfe02", "value": "T18B445DEC530E58107A9F39FF8B582239565025833EB49E7E9C662F5093E83D231FB592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688399, "uuid": "a8571831-91a3-406a-9718-7545db7d1522", "value": "384:x1MgXf8AK9PTc38A8OqDgcdT8+KUToVDrS38YwTVFequvrgGqGbofeAoXZZt3Akp:x3FLEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688399, "uuid": "3a979d50-6e4c-4dcd-9077-729fa95a44e4", "value": 274896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688399, "uuid": "44c5cee7-ce88-4bc3-a8ee-c4085163b408", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688399, "uuid": "126226af-d5d1-4dc5-a65a-48a261f322f6", "value": "goodpeoplesaroundonmylife.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cccbfd-3c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1776671659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671659, "uuid": "e5f5605e-667d-4870-aaf4-3ae671701571", "comment": "Malware payload (GoToResolve)", "value": "cdaf9b7a428384781988ce37cce2e00d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671659, "uuid": "d8af55d9-917f-40bc-a505-0e05c68dd848", "comment": "Malware payload (GoToResolve)", "value": "70983c62244c235d766cc9ac1641e3fb631744bc68307734631af8d766f25acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671659, "uuid": "b97f1d81-cde3-4673-9d09-1bf8066cc2ff", "comment": "Malware payload (GoToResolve)", "value": "6a6874c83fda5c1fac3d7192772c677cac5cc277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671659, "uuid": "0059d72b-d029-493a-a5a0-a7821b6d7d7a", "comment": "Malware payload (GoToResolve)", "value": "3df6d541d9f42b86f0770771b8635fb881a55b462047f5edcf4d41bb1dc02f078b6cb5534ea5565dbc7c87b6e6a2ca7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671659, "uuid": "bf08c8cf-a5bb-409f-a1db-29b4acb72e33", "value": "T1EB37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671659, "uuid": "d766d5f5-cdd2-458a-bcd9-e369f65dff9e", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671659, "uuid": "d21e1522-a4d2-4217-b1bb-655a7fb80624", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp3:q9WtLzgOTbjZvk/ekS/mcp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776671659, "uuid": "755ef73d-9094-44ed-b6b9-f0df3d68fa7c", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776671659, "uuid": "af7acd13-97b9-4824-8253-00531cdec6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671659, "uuid": "99c4d019-eaf8-4e1d-879c-206630a866ce", "value": "70983c62244c235d766cc9ac1641e3fb631744bc68307734631af8d766f25acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e11bf54-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725821, "uuid": "0490a031-fa91-4453-914c-a61116ff7ba3", "comment": "Malware payload", "value": "184cf780e4a953afa344a2534fd04934", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725821, "uuid": "4517ded7-8da0-4de5-955e-17ea7724a3bd", "comment": "Malware payload", "value": "70d078e1971a6996688a5da4430b91bb6bc98f29768faed50a3258158cad2b2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725821, "uuid": "185a36fa-364b-4616-9c09-dccd8cc7a946", "comment": "Malware payload", "value": "522c35de5a74629270152d427f1ee3321242a516", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725821, "uuid": "3f4f33aa-2958-4bf9-a6f7-c712e0042b10", "comment": "Malware payload", "value": "6ec15683d76a0a71bf482898b8f4cf066c2c3bc29129b30eb3bbf5288a66ddea0ce792ddec28d8d2e20da3353480f01c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725821, "uuid": "df5f8292-67c7-4a24-bd13-d353b14814b1", "value": "T1E1341A90B281FDB6ED998FB820D25309A3BAF0C1971DEB2B6624FF3C061EA54D473545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725821, "uuid": "7ee297a6-8fd6-41ad-b945-e2e153d6b652", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725821, "uuid": "0c92f16e-2d4a-4e32-b66c-20f8ab84f21d", "value": "3072:eQkeuUVl7xAac10S+dtKnkQsT2Z3KVuxHy1OiZPWxU2ju6+q:emn7CacGS+bKnkH2NKVuxHy8iZP2ju6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725821, "uuid": "fae0bf9d-9a7e-4541-b055-6b0def556e79", "value": 234479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725821, "uuid": "35584308-b0c0-45e4-82f0-7892ea4e2d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725821, "uuid": "e1493f06-e763-4a5a-a96c-a975087a76e5", "value": "70d078e1971a6996688a5da4430b91bb6bc98f29768faed50a3258158cad2b2c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df3505f-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725365, "uuid": "db9116e6-11a5-49b2-b70a-fc2d447c9f36", "comment": "Malware payload", "value": "a0f55699f4c1330110ed6862dec45e90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725365, "uuid": "2aeb2183-73c4-43c8-a6a2-c99cb9624391", "comment": "Malware payload", "value": "714a60230004a3f2b636402e83d80350fc892dc41e38a05b9032850072bfc92c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725365, "uuid": "85811d93-e018-44c3-8394-e325616dd512", "comment": "Malware payload", "value": "823f46879ad7521fca30f28e3976cb8c39f69ead", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725365, "uuid": "499c00c2-a44e-45c8-ac6f-0bc9a31d6bf1", "comment": "Malware payload", "value": "fa3b9923f80e47c9034c846e200473113b99c5926aef4684e59eff9ff802d4984c63b03ecf6dd71f31a58842723835b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725365, "uuid": "e10ebc30-87d1-4662-8a89-f5c018d6e412", "value": "T167A35A47A2E600BBE2778678C4930A49E772B85517619FFF43A4421A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725365, "uuid": "d976e9e0-9cfe-4ef3-a95c-721a836edf7e", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725365, "uuid": "7b1b08fe-3722-4f07-9aea-6024b5c3af35", "value": "3072:HvBGrVNNR2AJNQKAfRAtpvrXT/7nM4L3zm2Q9ZVbZacTShsrHfTj3B:JG5HoqXAfRYan7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725365, "uuid": "821a354b-5ee8-4f88-9a0c-5867f05abd73", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725365, "uuid": "fb5f2ab8-4874-466a-b909-3fcc726e9307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725365, "uuid": "422dc2f2-b5b8-4167-85de-7170402dbdf9", "value": "714a60230004a3f2b636402e83d80350fc892dc41e38a05b9032850072bfc92c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4dd76a-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673980, "uuid": "91678fa4-fdef-4bee-9cdc-829915a8d9ef", "comment": "Malware payload (ConnectWise)", "value": "65de081366581aa45017a4ac1b30c4ea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673980, "uuid": "569b51d9-026a-4600-ab0a-9587377f19be", "comment": "Malware payload (ConnectWise)", "value": "7196de499911f0d3ce98f9a5da1097540ae10d1a70bc868b8ce68198de835161", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673980, "uuid": "97d6b421-7dfd-43cb-b540-067eaae9e9af", "comment": "Malware payload (ConnectWise)", "value": "9f42f3279f04cf6f53307f39900ebbfa3cc9ca41", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673980, "uuid": "4372ba29-0d92-4c24-b560-ea3e822138e0", "comment": "Malware payload (ConnectWise)", "value": "ed1530a87ccd248c43fb812763f2353008d8b74f08b1db627e503e1e96ae9b1485c427dbb748d411c2d3e7700279d5b3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673980, "uuid": "116fcbdf-c019-436f-80e4-28b550c4b01e", "value": "T1D446E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673980, "uuid": "38146dea-0968-4c7f-908f-da51b3ccfe21", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673980, "uuid": "c340bf1e-f508-42ff-970a-909458d20ab6", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlDgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673980, "uuid": "a69a882b-8545-4e10-8d94-97a811818791", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673980, "uuid": "6e431e5c-cce4-4928-8413-d3272678fc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673980, "uuid": "3b4f23dc-5cf4-4c54-8931-e19486a2fa94", "value": "7196de499911f0d3ce98f9a5da1097540ae10d1a70bc868b8ce68198de835161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a78257-3cfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776718802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718802, "uuid": "d05dc861-5600-4b2d-8d0b-9ae93a630cf1", "comment": "Malware payload", "value": "84535f9ec4d798a6ea02922eae885d89", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718802, "uuid": "4e46f029-6444-4f7d-946e-cfd5189f776a", "comment": "Malware payload", "value": "71c1b12d67568efafa661bac9947a80b130b81e9418f8367f83698f6d3b62379", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718802, "uuid": "a94495cf-668e-4de1-8d7a-5eb740688c8e", "comment": "Malware payload", "value": "a9486f57fdf973bc7de4a2aeb6a4b12e3bc6489e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718802, "uuid": "b4481a61-4c7a-465e-89e9-5a8dd0e8a8bd", "comment": "Malware payload", "value": "01be26ddfde9bc8ee11cf0fb64c23355352599b6114327facd2ecf178a7550b8dc968fc333f058341f3e92b8a4254ba6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718802, "uuid": "aa0ae9fb-60ee-47d1-92cb-83b6d792f422", "value": "T11EC62327E24961FEFC6A86351A72D126D53B6D126C1E4D4B93E038ECCF316A03D3B646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718802, "uuid": "298e3b26-59e3-40ab-b47b-de093bd7a77a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718802, "uuid": "dbb4a1e0-691b-488c-812a-1df9944a4856", "value": "196608:/WMTZkdF6bVoxzjkBkrQ5GXcI1NNF0E2Rc9lT7p7y/iVUw4PeHInvoXa:/9kdMJoxzgKk5GsI70Ecc9lT7pG/iSww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776718802, "uuid": "a94ca166-a59d-44df-a472-f88436dc1de3", "value": 12268600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776718802, "uuid": "edfee5f4-4087-4ecd-bd8e-ea0fa1027080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718802, "uuid": "38049324-9a17-4724-a1b8-b52362bdd08c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccffd1b-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687567, "uuid": "393ad130-982f-4b35-9746-269924f2ed5a", "comment": "Malware payload", "value": "b5864ae9459fe262d7693dcfecd6bdf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687567, "uuid": "09a24e22-3ce3-46c4-8037-43ff8435b53c", "comment": "Malware payload", "value": "71df0a072a2cac8b6b68b8a15502b0e1f93d8c339dd50476b59a740407b1055a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687567, "uuid": "6fb5000f-3daa-405c-8fc0-0a1d0eb2e8a1", "comment": "Malware payload", "value": "d807f39c82cb9b325f94993e15908698110681ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687567, "uuid": "62ca0091-1081-40a5-9e79-7dfd61a02193", "comment": "Malware payload", "value": "0a808b8533f62d8d1eaef58b7ffcaac2a99df443a38af5ada156f6c856bf39d5f662f1e54ac4a2087246480e3c3a15c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687567, "uuid": "cea1b9f4-5552-4e32-917b-0881ebe4e028", "value": "T151564A03FC9955E9C0AE91318A629553BB71BC8D5B3123D32B60F6342F77BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687567, "uuid": "0e91261d-4cc6-4e2f-936f-f3aea3f28779", "value": "49152:PNzmFlpZj11m7szER2p+P3aufH+5eDe+wUm4Q2Ha9Jl5RfUuvfjt+K3TWmhLKiKe:PNIpdkUk5B853dms7IEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687567, "uuid": "c84e76ed-2659-4b83-be00-28ad93b30050", "value": 6459554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687567, "uuid": "009f7d92-2cf8-4aed-a30e-ec9be8ec1734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687567, "uuid": "dc081cf1-7ba1-4d6d-b4b0-49c80cff97c1", "value": "krane_linux_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ea70dd-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724972, "uuid": "1edad575-89d7-4db1-9ee8-f25aeec0aa6d", "comment": "Malware payload", "value": "cf5f67cba2423612626b18d9e37b2d00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724972, "uuid": "b7a84f44-cb1e-4fb8-b04d-f621c166fee2", "comment": "Malware payload", "value": "72c06f6eeaee17b5bbf2187dd5e7c1a367e01d249d1bbca2cc9f3eba00399881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724972, "uuid": "520bba20-db8e-4cd6-9515-f42a729e05cf", "comment": "Malware payload", "value": "d2255ee452a1a6727c0b2e3e471889759771b534", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724972, "uuid": "a02e986a-2eac-494d-bfdd-ff4cbae2cfcc", "comment": "Malware payload", "value": "2f3014823005bbf938a49e26eeb750c796ae6a971cd3e4cbad8ee9ce4701822b021b80a018a86bc9746b3f819a74062f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724972, "uuid": "870db7f0-198c-47e0-8078-33492e968f83", "value": "T1E0B35B8BB3A500BBE1778678C5630A46E7B2B8511760AFEF03A0465A1F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724972, "uuid": "5bd21718-5ca1-4d46-a57b-deffbea4a548", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724972, "uuid": "b9426ce4-dddb-4e4c-96a1-438513ddbe2a", "value": "3072:PI/azEnyFSpckqn/JqCJxSjjuzckVPxIiTRQDol:PIuEyY2n0leCDol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724972, "uuid": "2b558e12-adfb-496e-95fa-61cc628cb718", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724972, "uuid": "681f6192-79f6-4b6e-a170-c0117f164666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724972, "uuid": "ba442b50-c148-4546-946d-cfed2137bdd8", "value": "72c06f6eeaee17b5bbf2187dd5e7c1a367e01d249d1bbca2cc9f3eba00399881_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38053e0f-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776688874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688874, "uuid": "a0231443-460e-4b55-9766-d7650da2e411", "comment": "Malware payload (Amadey)", "value": "1058c02e47d151603b527158042f2c92", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688874, "uuid": "8cb3a483-4ce4-46ea-b142-7eddfcd16a21", "comment": "Malware payload (Amadey)", "value": "72e27dc4ded2a76a5c29109161b87c3ea8f677eb355e79cedecc99b1b1fa6aff", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688874, "uuid": "1f81f7b2-3d38-4236-8900-a9159a31e822", "comment": "Malware payload (Amadey)", "value": "a3cc54ae524fc24e9448096934ce637971751c3c", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688874, "uuid": "0eb284a5-9bde-4b25-aade-9bfc9d591c2a", "comment": "Malware payload (Amadey)", "value": "c1f2e758bca2fdc9255e04606d8d8f7c731826ce3cf3d538d2efd2b5db73319912e9ef4bb660feee7a3d1ed9eda7955f", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688874, "uuid": "5cc65b48-88ec-4d04-a556-d0f251dced54", "value": "T149855C01FDC755F6E5121B3665BB63AF2738A8090F36AB87EA047A7DB9763D10823305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688874, "uuid": "7a0dd8f4-131d-4982-88d3-64f7819a7372", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688874, "uuid": "6b90f94d-0179-4958-bb26-ddcd7b6a8967", "value": "24576:F7IMTXJ9wHQvLBMBiOGRMPsfBfgnYDMVmmWftjvyiXyzONM2KuESoLe1x925PYJ+:Fz10dvacg62cYMM88grP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688874, "uuid": "5a76677a-caf4-482c-92f8-c7dda9323fdf", "value": 1864832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688874, "uuid": "c499ebb1-4357-48d7-87a3-c8bce51d092e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688874, "uuid": "baf2b236-6b7e-4c4c-a787-b7792084fcfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31788280-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727088, "uuid": "924647c3-5fcf-4893-8880-0b7698a1f1b4", "comment": "Malware payload (Mirai)", "value": "6e48ab3beca792cf8e5770def2b47943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727088, "uuid": "3b26b130-c09c-4d9a-adc9-844d306ce273", "comment": "Malware payload (Mirai)", "value": "7313cc7c86081426a07ed99ba00f097edff6e38f7d56147deec6970ddc66f7ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727088, "uuid": "122b72cf-d93e-45d4-88fa-4b4b8f5283b1", "comment": "Malware payload (Mirai)", "value": "99ab28b7adfb7ad29c84e30d056d5050c57b80ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727088, "uuid": "af018c6b-6d38-40a7-b68d-d2e1fd0f5089", "comment": "Malware payload (Mirai)", "value": "a40e14585cd05b47729ba9e3c63519279c95c7b934859bc0eda9fa3b840f9ba81dd201b876369c38cb618bb38e7f0385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727088, "uuid": "9340ddce-da8f-4181-888e-ac0cb4c60aab", "value": "T15192CFBE946090D5D1B15837E6FDCECBB2B60AFDE3E4306117A85A2CF266680337505E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727088, "uuid": "e3d7cc7b-765a-41ab-bb0f-2d7ec44f96d2", "value": "384:y3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWO7JVhymdGUop5htw:qCmyqM7zLnmZQLh+IWfdzFG/QPSTs3Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727088, "uuid": "0f5d412c-9433-40e0-8643-fff9031aa2df", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727088, "uuid": "7818f3c8-3add-476f-825f-c78d62a2849c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727088, "uuid": "81bfb6f6-7b1a-4c57-bf49-c9ea0da5d1f2", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8d3c52-3cb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689925, "uuid": "db062038-f252-4647-b433-6246a42bf7df", "comment": "Malware payload", "value": "fdaa61f036c882abff8a02f1a2965860", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "NvBackend", "colour": "#7F3CFE", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689925, "uuid": "5c6a53cd-8764-43ef-8213-b84695cdc0b7", "comment": "Malware payload", "value": "731eb891e94a4d54f441824ac6825f8af30d4ec3a54e6aedba5b365a36a5d11f", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "NvBackend", "colour": "#7F3CFE", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689925, "uuid": "30a1ced7-b276-43e9-b103-8ca2b222bc94", "comment": "Malware payload", "value": "157151656bbada99ffbaeaf98c7bb404d9f0a20d", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "NvBackend", "colour": "#7F3CFE", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689925, "uuid": "c0274aae-7301-49dc-90ff-dcc7dde4636a", "comment": "Malware payload", "value": "f73653ebf7ac405e9ebd0889be42537c7055149bb69ca139c718b432d0c461294be5be259a292be625689f83aef4c4d3", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "NvBackend", "colour": "#7F3CFE", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689925, "uuid": "da02440b-a562-45e1-a183-f5da08c3b65d", "value": "T133F323EE081A5A8138EF01B835A1E5E473C771D85B390079AF15A417F015DBB9D8BCBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689925, "uuid": "80a732d5-d2c6-4061-a9cf-3c39b0b69f28", "value": "3072:a7+Gu71Go0JTsOpZck/8BfsI9d7W9UE5JwubKUrRKluppNy1R6xOnMKYNYJRiNV:a7s150JTsAmk0BfHC/wKK6McpLy1VMKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689925, "uuid": "216a0b4c-b202-465e-855a-e921a4733c9d", "value": 160357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689925, "uuid": "21709a66-28e5-4162-8773-c7a5fc4e1ce3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689925, "uuid": "583f2290-ad4c-4682-8415-b0d956d080c1", "value": "NvBackend.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc5c422-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776688104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688104, "uuid": "62692e2d-ae5d-4873-8dd9-f49d830c6696", "comment": "Malware payload (Mirai)", "value": "62560d111fc6c0916505f6a35065d560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688104, "uuid": "2d490a82-ecc7-40e3-a1a4-b22c3ee19885", "comment": "Malware payload (Mirai)", "value": "73a3866f2d64205625e42d7771aa9ca58164571d1af8df59bd6302dd787f6071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688104, "uuid": "84c9df5a-4cbc-4297-b728-7727103c5fc8", "comment": "Malware payload (Mirai)", "value": "4885fa75195c382630da253b3b607d352c5c498e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688104, "uuid": "41b8d855-8144-4c5f-928b-a33236656f65", "comment": "Malware payload (Mirai)", "value": "a83e0c0fe36f51a7d929639586eb74ab5faee44b38b931aaa637771a60b70e245ae8538bd0f95207d133c0c671199ba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688104, "uuid": "2d5fc5c7-643c-44eb-8926-bc4907d56f8f", "value": "T164530260B9B9D568EA302E3ACB2B078299C841FE45ECB1D87F54E6C1EBD3101BFD9151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688104, "uuid": "88d41b81-993d-408b-bb59-372adf01ffac", "value": "1536:iSG0bq3lr71rfXcEUEe23gpSp7vkVdQEJ8ijL/WEB/:A0bq1rJbXCEe23jd8VWEJ1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688104, "uuid": "cfde3f40-7e48-4680-9704-98c7af68e411", "value": 64440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688104, "uuid": "1ec0eee9-65a8-43ac-ba6f-7484bbc2005d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688104, "uuid": "af3967e1-1baf-4bbb-8a5d-b9ef24bdb723", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2ab6ee-3ca5-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776681875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681875, "uuid": "84d6141b-1c68-4ee7-a271-f76c23b661aa", "comment": "Malware payload (ACRStealer)", "value": "ed3f564b0730a2b8995f052befa5f12c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681875, "uuid": "50bde6e5-d3e1-41e5-8e80-8049cf6337e1", "comment": "Malware payload (ACRStealer)", "value": "73a95157bef5cfb8dc294e905b8c0d8e750bb7b18ed374e70307b1cdcecf9172", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681875, "uuid": "4efd61bf-92b9-4a03-8168-7177df4df654", "comment": "Malware payload (ACRStealer)", "value": "d736f95c557ed734e060a6535c5ea940c42dc20a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681875, "uuid": "73c345b0-1dcd-439e-b6b2-b41360e389f7", "comment": "Malware payload (ACRStealer)", "value": "cb09ff589ae8752425f712edafb760efe74a868afe0b3ae74bfd7e07582fdd7949fc99f0df4be4e5a5b896c92f9ed6ed", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681875, "uuid": "5eef7b58-86c2-490a-bcd7-b15d6cdaff20", "value": "T18D269F1BBDB95869C09AF1388473A705F565B8451B1227C71AB0F22C2F3B7F05AF9B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681875, "uuid": "f2a922b6-98ac-4dea-95cd-00a7bab395cd", "value": "91338189f03c052fe44b0f8bf9c5a5c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681875, "uuid": "dd0751d1-d4f9-4c18-bb60-59485688faec", "value": "49152:AEZigVGgO6P/9Ar+IP8Q8muFNeGVVQcrhepxtwjcwQcxhWTU:AXp8m98m/b1yWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776681875, "uuid": "d5f0a270-2aa4-4fdb-a673-6f359ae4f0fa", "value": 4739616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776681875, "uuid": "051a7067-e335-4493-a023-a25c16cf2592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681875, "uuid": "44187877-3fa6-4b46-9514-61046f7c4e4c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.65897296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b15c0d-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686911, "uuid": "bf004b09-2430-42b1-8f98-bdcdbd0a3b2a", "comment": "Malware payload (SpankRAT)", "value": "126ad23d3e0924397149062b78421511", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686911, "uuid": "bc05f047-6f36-423c-bd4f-78e9802d3ee4", "comment": "Malware payload (SpankRAT)", "value": "73e0c98b83f9be28ff8a58f6f6d7c9729dd54c6e820baebf1ee472a9bb7eaa6d", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686911, "uuid": "f6e0a10b-3394-4b2d-85bb-13116e1c8dde", "comment": "Malware payload (SpankRAT)", "value": "7f800c1417f13eb9dc8d91d465af071b2d36b376", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686911, "uuid": "076db0ff-0e97-41c0-afa8-fdd4c21455e0", "comment": "Malware payload (SpankRAT)", "value": "0657d27671d1153a7d5cedc51fff60b36819ef33b8f6f539ed24c8e1ffccb79810056ae5089d6283d310303695e24901", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686911, "uuid": "4774f3bb-eee5-4fc9-aa5a-44cb5c6ec453", "value": "T137055C03FA5985E9D59EC43C875785366A37B89D0B3066DF22842A2C3F67FE12B2C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686911, "uuid": "d5e460fa-8295-4760-b8ac-daf8a2ba8a7d", "value": "4dbdc70a90eeed6df87d36b5e88a45e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686911, "uuid": "596ff705-db8f-49ce-a128-8d3af1ec34b2", "value": "12288:lqxHBll8bKkUF3hNbVerci9zLqsUtWv25/+1S/HD/pzVR:Chz8Wki3hNZG923emZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686911, "uuid": "b09ca87c-7a4b-41ac-9615-46bf36d5a902", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686911, "uuid": "6d3683bb-61eb-49ec-9151-2f338b8b3e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686911, "uuid": "8e4e0c77-9c02-49b0-8b3d-4ba77e129e13", "value": "73e0c98b83f9be28ff8a58f6f6d7c9729dd54c6e820baebf1ee472a9bb7eaa6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5846ec-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687947, "uuid": "c966cf92-2a54-4b05-83ae-04141ac21fbe", "comment": "Malware payload", "value": "a82a3afcc7486e348bf955903477745b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687947, "uuid": "84d46484-de5a-433c-afae-84968d1be8c4", "comment": "Malware payload", "value": "741d9ea1d7ce0d22e0dc37ebbefb1f80a0055edcfaa5626084d9e7ad2b46b260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687947, "uuid": "c82718bc-5015-4bb3-9566-1babbfa16170", "comment": "Malware payload", "value": "23db16b654a1b99aedabee88486262ff09bcab81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687947, "uuid": "5a4ed22f-ff35-4a88-b209-976b3d310a20", "comment": "Malware payload", "value": "e6e87441b801f084a92f66a13967a59c2542c53b3872ea6b93b5cdf09564b97bd0dc7b73c7e44b393c2c07bb223f6dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687947, "uuid": "b20c6960-c486-455e-8c70-5b81cd80b1dd", "value": "T128844987980C20A1F96B957C06725B1F98A6D4F9213F29044E6D29EDEBD13C8A33F7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687947, "uuid": "2b594ab4-7d63-4b0e-b694-917b1a44e179", "value": "562a0fa1097a7e442aee1ca676f7cd61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687947, "uuid": "61186943-504d-47a0-8513-95553011a155", "value": "6144:gnTbbyYCXjj++7rO+36/xZD9weJYZUfKY1zMRE7tY0tb5vn6cthVnVa6NxehcUGx:gOj6+7rX36ZZTy3YqRS33hVndIWUGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687947, "uuid": "addbaab3-8b7c-4e15-95b0-68478f03f7ac", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687947, "uuid": "69145e29-3744-498b-bba5-4101dd7b04bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687947, "uuid": "c33110be-49b1-4dfe-be64-a89be465299b", "value": "py.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ad760a-3d14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776729510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729510, "uuid": "c8e0ee90-3cd9-4ee5-9b44-e89c0fd7426e", "comment": "Malware payload (Mirai)", "value": "03496ca4c4d804997d78406b33183ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729510, "uuid": "612a8f85-d1ff-43a9-841d-f586c9f36bb3", "comment": "Malware payload (Mirai)", "value": "7473ba9d600617052260cefc7a679a131ee6bcfed094e5860156223728b22263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729510, "uuid": "20a6acb2-316f-4281-9add-066faa707853", "comment": "Malware payload (Mirai)", "value": "7419ecda08283edcfde4b42b21062adc99034279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729510, "uuid": "d36371c6-9f3b-4654-8075-bb533f32ef4c", "comment": "Malware payload (Mirai)", "value": "a34700acabc4c4438afbc58252ebb2fb3798c88e1a8c717670086876aa885e2448eec23837ad75b6a3e3885042970014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729510, "uuid": "2d5d3db9-d8f3-44d5-b78e-5b603baa9409", "value": "T17A330A56B8828A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729510, "uuid": "48d08331-a82c-4e36-b896-4c431354fb01", "value": "1536:AdnM5V7dJfTYKk8nYO7C1YgLiIyip5OeQ+3:HJLrvk2YDr5OeQ+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776729510, "uuid": "1856dc47-b316-40ac-b2a2-5247573fd913", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776729510, "uuid": "b4d77425-a90c-4dc3-8da8-4b72d745e000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729510, "uuid": "c69e788d-585d-46c2-b405-5f860104c7cb", "value": "00okarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef38110-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725903, "uuid": "dd71fa05-9c7d-4639-8a25-9f26850f7ba6", "comment": "Malware payload", "value": "6f7ec133506088a98cac66ca7237f393", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725903, "uuid": "0255b5e4-dc07-4195-8fc3-0696b20260cc", "comment": "Malware payload", "value": "74854d3c07fc4e585e8ba55c869de69fb85413b3603f954d59188fa6aea59520", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725903, "uuid": "473a932c-26a1-490d-8bdd-a580a34f2e45", "comment": "Malware payload", "value": "cef818cf48b9952144008a2149c29bb30dd6bd9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725903, "uuid": "02999258-ae4b-4337-8573-522bce2f9d90", "comment": "Malware payload", "value": "742b698a75d4307b2ebbd362e6f47bc8964410413fa9082b82608d715598dfe378e910b34f168a271f3a766c205e1a74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725903, "uuid": "41309979-889f-479e-9449-5f3061179122", "value": "T1D453CF07B35368DCD91686B00AF74F33A6B1FA7425A687AD5670CFB80F12584BE2ED10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725903, "uuid": "1876e26e-1b76-4c4e-89fd-114bba4d1b27", "value": "a56e744058ac8abdd8a05d270a3339d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725903, "uuid": "62b75807-36f6-4e06-8044-901d0c6b6030", "value": "1536:msX3V8PXuDlWs5ezEwYcM+EV/ikRmckVPxIiTe:3V82DRGEz1BizckVPxIiTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725903, "uuid": "966e587b-fd26-4913-ab15-f8be0ddff880", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725903, "uuid": "63cc4bab-9a13-4167-b40a-84dade60a3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725903, "uuid": "3c02df96-8db2-402e-aae8-1cbad94ebee4", "value": "74854d3c07fc4e585e8ba55c869de69fb85413b3603f954d59188fa6aea59520_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca4a14b-3d12-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776728664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728664, "uuid": "d6189734-46bd-4d71-aedc-8a9044ea3722", "comment": "Malware payload (Mirai)", "value": "edf657d85130bbd1d303af99902d39ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728664, "uuid": "57b45a70-395a-488f-b625-041dbcdf7907", "comment": "Malware payload (Mirai)", "value": "75354bcddeb63f6cc1299398c9205d618cc6ed728b11387fe04e134ec7468883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728664, "uuid": "df595274-c405-4611-8ce3-0e9d07aa1df5", "comment": "Malware payload (Mirai)", "value": "a4645d59aea1a6150d5153ff819bef8d55d16aea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728664, "uuid": "16ae6d0c-289e-4370-b9e9-f679526521f5", "comment": "Malware payload (Mirai)", "value": "81b0184c4f2afd8d75d2d4a785c640c38907ecff2642ee93c85dd4982c91232b03e2695c56c2b43b10463ba95828e94d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728664, "uuid": "f814abc2-e67f-4082-aeee-dcd04f64f973", "value": "T1B343710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728664, "uuid": "14b1f8ed-5923-4653-951e-b7d1ef70524d", "value": "768:oLWu89xw1IlGG8SnNliYJgVyyCmQvpSlLUuth2NoOVucO4fQkVreT5tIne2el9e2:oLWu8fwg88M0Lg9gzyNS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776728664, "uuid": "1d3bcb3a-71e8-4c00-9e1c-2df99d0e5305", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776728664, "uuid": "edde8d9d-13ff-4638-8815-65c8a456563b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728664, "uuid": "bffdc8b7-a92a-4a7b-85bd-922e49708b53", "value": "00okmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be886944-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725178, "uuid": "a3dc5bdd-014d-40df-9430-d4e8d2f15f6f", "comment": "Malware payload", "value": "1ba5d4b5e94b01ccbdbb67160da92901", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725178, "uuid": "96ccae06-749d-4888-b0fe-81c607778fc1", "comment": "Malware payload", "value": "754211ac21105547002e6855b225b2d7af5c491aeb36a9505432eb69aec746ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725178, "uuid": "2d56a55a-c492-436e-96c7-02452603d4e8", "comment": "Malware payload", "value": "497f09d8f7862bdbe25ec23944233958b228808c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725178, "uuid": "33619416-ac07-4f2e-8bb9-88b2171dcfa0", "comment": "Malware payload", "value": "0aa754319465471c741c38d51cfadf1648494d36b8f7ffc72f9b1be8bc11bd065e055175afe0db6c6c63e9e7e3a407f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725178, "uuid": "c0b2698f-d272-4abe-b383-b1a30d248dc7", "value": "T150B34957B2BA10BBE1778339C4670A45E772B8414761AFEF43A0469A1F233E09D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725178, "uuid": "30cbac60-8ced-409a-a775-63afc2705938", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725178, "uuid": "95bf2496-9548-444c-9681-d5a276f0a4fe", "value": "3072:qMew8YHakpvHSwyBHqVQezDZ4C0x5q9poW/2:N8YlIwCdo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725178, "uuid": "e9363aa9-e679-49f3-8ba3-adab9fcfa41b", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725178, "uuid": "b874ad66-b478-4ecf-8339-b6e9ba377ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725178, "uuid": "c43bcd12-e544-4753-a16a-049cc86c90e1", "value": "754211ac21105547002e6855b225b2d7af5c491aeb36a9505432eb69aec746ff_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d13523-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689625, "uuid": "a736fdca-0b69-4d15-a1b0-b413373e540a", "comment": "Malware payload", "value": "77570655f244575759bd0713856e1f75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689625, "uuid": "f2bc7db0-0303-4e55-b5c0-e197c5f6d709", "comment": "Malware payload", "value": "754c23d951b37c8fdfd48995722a6f87cbfc51006e002b10e4fdb84e1df22382", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689625, "uuid": "cec9aaf6-d19f-4a36-a860-46ed83023ddf", "comment": "Malware payload", "value": "90381778b671532f39bf15e6e1485bf29e2aa874", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689625, "uuid": "17d3c0f5-e8b1-4b2e-86ce-c1fc4540c861", "comment": "Malware payload", "value": "d6a1bd3c658d5a049d24cf13c17e8654449748feb4468a8ceebd48c5f1a327de274835f30d12e0714f1c3f193f2194d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689625, "uuid": "7bd817e4-5da4-48d2-af10-7571931208d0", "value": "T19DC1C743989D7C87CA9A937EA8451B0C78AC8F75036E4C27B9363DD58C8B8163D4F60B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689625, "uuid": "cc415333-b6ff-4b93-9b55-2fa4edc9516d", "value": "96:jeiPdGUGLxiPdGUGLmiPdGUGLzdiPdGUGLviPdGUGLgiqiZM:j7Y6YfYiYgYMiqMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689625, "uuid": "961e79fa-1308-4920-b6d2-c638c5c4bb3d", "value": 6043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689625, "uuid": "b96e8257-147b-48af-844c-4ef13bd1f12d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689625, "uuid": "68836170-05f2-42d7-b190-3795b2dd3414", "value": "PDFreadArticle8784541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6651b95-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725701, "uuid": "8267b486-d0bc-4b05-9844-bb7730830d5b", "comment": "Malware payload", "value": "a00d31ca7130d96f25b8f966c617a3ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725701, "uuid": "775121f8-89e6-47e5-a663-1447c286f827", "comment": "Malware payload", "value": "755e321db26998d727d5e356ef511e7cd7dc6d511195e0c829833b4437747916", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725701, "uuid": "076cbbaf-c1e8-424d-a6a3-977ec1e3563a", "comment": "Malware payload", "value": "5d9ce637030eee2229755ca81efe2986e0e7fb36", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725701, "uuid": "5020119a-40d6-4e62-8ba0-9c5e83e4b49b", "comment": "Malware payload", "value": "bff2bccb9a68390b28f8ac6f23048d84f351de61a139c16ac7770a0829ff36f1cc223e62d2ccc4a5be4f47b81c2db529", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725701, "uuid": "65970837-f1be-4972-9e7d-1f7c6a261546", "value": "T13BA34A47A2EA00BBE2B68678C4530A4AD772B8551760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725701, "uuid": "088d5906-7b98-4170-85c9-81554d1b282b", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725701, "uuid": "5c29ef5f-a162-4fda-9c6f-507351b42412", "value": "3072:jxTeXQwDasaAmiTQhAS/xYN0A51756565rnIryHs/CwnK:5eXbuFaTcAS/0sFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725701, "uuid": "251bb509-227b-4be6-ba3e-c23b87bdeebd", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725701, "uuid": "b961c40f-2e01-4d86-a27f-4156e57cb10d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725701, "uuid": "bc77b7fd-1455-4400-ada4-5d3327159f4c", "value": "755e321db26998d727d5e356ef511e7cd7dc6d511195e0c829833b4437747916_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f88ae6-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676419, "uuid": "b7916006-fbd4-45ff-85d2-f4ab1a751f05", "comment": "Malware payload (ConnectWise)", "value": "a6792367e4773946d2f656314183704d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676419, "uuid": "f238d4f9-4c63-4f5c-9f2d-6292f82b7263", "comment": "Malware payload (ConnectWise)", "value": "762ede260b4559eb27837fa51b200fee00bbf6a03a40b04a88f7f57d7e96b52a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676419, "uuid": "a7d13869-814b-4801-b4c6-f32227a81050", "comment": "Malware payload (ConnectWise)", "value": "88b2303e62d0b0bbbdf405348544d9aeabb733b5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676419, "uuid": "cf873be1-c4b4-473a-9b11-2bf7949eb004", "comment": "Malware payload (ConnectWise)", "value": "1f80003b7e9d46fc9b8917840f79fb1ffafefe7282f3db713d6f91050d49a887f6ae7da2d5bfef76138c9e9ea85ac4e3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676419, "uuid": "b139628b-54e0-4c5f-97d4-7bc0f6033b42", "value": "T1B9D6232523FD441AF8F74A79FD3682E46D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676419, "uuid": "2cfb57a7-f6fe-4924-92b2-cce9c4259f71", "value": "196608:bWh0cGwIWh0cGdWh0cGIWh0cGaWh0cG0Wh0cGwWh0cGm:bWacmWacsWac3WacJWacVWacTWacH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676419, "uuid": "ab19d0b9-4369-4b24-a1d6-773342aeedcb", "value": 13361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676419, "uuid": "2070dcb8-f1bc-4b31-8c8d-58c4a0e0706e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676419, "uuid": "5f4f0590-2fc0-4514-8901-d9288fa2d310", "value": "762ede260b4559eb27837fa51b200fee00bbf6a03a40b04a88f7f57d7e96b52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974ec14b-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725541, "uuid": "20f3ce69-7a43-44fb-b519-67e3eb74f37f", "comment": "Malware payload", "value": "a26f217428185ab07306ce76d19da69b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725541, "uuid": "3d14c016-c5b3-4a0c-8814-7d27da483475", "comment": "Malware payload", "value": "76325b81de2828b284611691ebbe14acbd20995ce0768683844da4b8ae984142", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725541, "uuid": "99d0ccdf-0540-4978-8b77-3247350ac75f", "comment": "Malware payload", "value": "c3bbf86072ca589ccd5618293216a3d039a68463", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725541, "uuid": "75d9bd2d-95fe-4ad8-acbf-b9ff3a673fd2", "comment": "Malware payload", "value": "d82ebd0e79432ca0ad16a408cf00e4aa8b4a7156546e017e3b735b0ccf17dbfdc7a15f09c6dbb5caaf3e77e90830e7d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725541, "uuid": "9383c27b-c2df-4359-95d6-898de2b67501", "value": "T186A34A5BB3BA40BBE1B68238C8670A45D776B8455761AFEF43A0425A1F233D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725541, "uuid": "bb1be87d-d796-4c5d-bdef-6755e0070aa5", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725541, "uuid": "85d0d487-eca1-4ad5-ad4a-86bce18daf44", "value": "3072:516U5V3RNUOiGyAQbnA8i9tyoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHXvGS:qe3bUT+MnA8i7EBT26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725541, "uuid": "633a7cd7-f93c-4961-9330-5ba57b6094b2", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725541, "uuid": "9cccf76b-47f8-445d-ac77-9b1026d156fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725541, "uuid": "80a74d5e-b616-4074-8fd4-b73a162b2cdf", "value": "76325b81de2828b284611691ebbe14acbd20995ce0768683844da4b8ae984142_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903770cc-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673990, "uuid": "92bcacd8-36c9-4c8f-9698-69bedaf0e683", "comment": "Malware payload (ConnectWise)", "value": "09935eaca05d8a086862ad0367f5197a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673990, "uuid": "08501f94-0745-4e40-9f19-9283522a89c9", "comment": "Malware payload (ConnectWise)", "value": "763cd99ecc829857b0dc50b6465075b83a8610061dfeb6868a44a2a066673211", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673990, "uuid": "19cbd3f6-cfb3-45b4-bf3e-0001fc736d05", "comment": "Malware payload (ConnectWise)", "value": "fef9fe49543c7a47afc99fd33e5986ed1ff71175", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673990, "uuid": "fe41e51c-b3f6-41e7-be64-4c44e5b7eb8d", "comment": "Malware payload (ConnectWise)", "value": "a3db6e2a6c04695adab20bb06194e67675140adcd5d9745072e5c66abf4c759899addc1fd40be25241aebf4f101192af", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673990, "uuid": "814fec5f-d9e0-430d-a930-6411f1f62893", "value": "T1C6D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673990, "uuid": "09d2e632-a058-4861-a301-153cf930ad29", "value": "196608:0Hxcp9ym3nltDUJVVHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3xHk:SGplp+Gp7GpHGprGp8GpjGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673990, "uuid": "c8147535-ff62-4098-9584-32af0aaa4913", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673990, "uuid": "7d70f24f-da9e-4942-aa41-c0e402e178a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673990, "uuid": "d8ef92ef-06cf-4f50-b6c2-17c8722ce71c", "value": "763cd99ecc829857b0dc50b6465075b83a8610061dfeb6868a44a2a066673211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7790d74-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725139, "uuid": "babfe49e-5ae1-4a64-b084-ff66c9ba101a", "comment": "Malware payload", "value": "79b5672961c8f1c954e42060bab2fdd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725139, "uuid": "21a98f63-afe2-4ea7-acff-059824c40b71", "comment": "Malware payload", "value": "766d884d44b72629336e158a267fbb3f56103c7e739314061b9ecd4b7c68c091", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725139, "uuid": "f6f6edd8-0b5a-495b-9137-71ea219129b2", "comment": "Malware payload", "value": "fd204f76b86138eaeab379c6f728d4987a9bc66c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725139, "uuid": "d8212f5d-e4e6-49f2-a273-2ac18d197e53", "comment": "Malware payload", "value": "3d85abab05b6e40e5fb656c104602fb1d12cd73ea513a01eb156166069912504abfbf56bd7baae6ee3f4a303b8fcf002", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725139, "uuid": "bf2c5fd3-03d4-4f4b-a7aa-96aedf8b7850", "value": "T19A341A90B2C1FDB6EC998FB820D2531993BAF081971DEB2B6620FE3C065EE58D473545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725139, "uuid": "770767ac-81d4-4828-be45-747087303aa7", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725139, "uuid": "dcd367a2-8e68-489b-a951-eb6c96182299", "value": "6144:rmHW57CaUiS+jKnkT26KVurHy5iZM2j+uhGA:S+C5FFkKtxgpYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725139, "uuid": "84415e9c-3ea3-4ad8-8e61-cbfdfc6d97f3", "value": 238126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725139, "uuid": "67d9f273-f232-43c4-8c06-b037f76189be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725139, "uuid": "e338721f-a958-46ff-839e-9f9558378451", "value": "766d884d44b72629336e158a267fbb3f56103c7e739314061b9ecd4b7c68c091_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959ba175-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776673999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673999, "uuid": "1bb53437-0c50-47ce-91f1-951dbd0226d6", "comment": "Malware payload (ConnectWise)", "value": "db97381c3414d6e6b21e4829ef5147c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673999, "uuid": "d1374dab-4ecd-46d2-b790-d175d5f68373", "comment": "Malware payload (ConnectWise)", "value": "768761ff027b87b0718ee7424ddb4be101583a259cdc27cff7810d4df29ce5a4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673999, "uuid": "58203c97-db15-43c1-b017-4cbf3cf292ab", "comment": "Malware payload (ConnectWise)", "value": "5f4bd3d6f2e571890540a13f15be97f8fab93724", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673999, "uuid": "caa6c69c-7f50-411c-84e1-3c020748ed42", "comment": "Malware payload (ConnectWise)", "value": "cf7dfaa1e64a0fb114dc9ce1850b1af4c567aaf0a5e9acd37bf331e2f8266916928d7f87df1fb671835e9942da6f2383", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673999, "uuid": "d08e6b35-01ac-486b-9c20-98d6a9320db1", "value": "T15746E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673999, "uuid": "610a8112-e93b-4003-ac68-1092f1ba84ab", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673999, "uuid": "84dff9ce-5fe0-48d7-a2fd-3fa7ae39dd59", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlAgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673999, "uuid": "8142a608-d9d0-4bdf-afad-d3fb4d05d06e", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673999, "uuid": "62e0b44b-e9cd-43ec-a4da-d94558e56ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673999, "uuid": "e36097d7-f2ec-40b4-987a-1b8f534ec600", "value": "768761ff027b87b0718ee7424ddb4be101583a259cdc27cff7810d4df29ce5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6ad0bb-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676617, "uuid": "edac796a-b68d-4d5f-bae4-b80d8bc9cb33", "comment": "Malware payload (ConnectWise)", "value": "85e04de320496782c8f3074e07bedb63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676617, "uuid": "86c0356a-22af-4aff-8c3d-a5da8e4fa191", "comment": "Malware payload (ConnectWise)", "value": "769425ae9eeea1a3a4194ce82a72ffb4ec141f71b17616e73c6e6ae757bd2626", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676617, "uuid": "05aa7109-12e6-49be-a39b-37ae6e2369f3", "comment": "Malware payload (ConnectWise)", "value": "2245d98f73a7ae0be7a6eba6cb8ad2d1d06a0593", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676617, "uuid": "53fd4079-c9ce-44af-91e1-ac7fea30a7d6", "comment": "Malware payload (ConnectWise)", "value": "0fdfa6ab34b43d491e8a4ed2e3d203d010dac5649e4527bde635fd9ad64c5f5f9304798fb6782948877ed7484614f587", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676617, "uuid": "4c0a8fe7-1f11-4828-a02b-04288f63986d", "value": "T16B46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676617, "uuid": "2c8a61b2-f962-4897-9960-a174141231eb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676617, "uuid": "299d27a7-dbbb-4e53-b247-bc09f8f38e1b", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676617, "uuid": "f7ee7501-eaf5-4057-a37d-4f308339eae7", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676617, "uuid": "c911e217-1da8-43ea-88af-f7a53f0ea3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676617, "uuid": "7aafe982-e138-4220-b3dd-5e36fa7aa2b5", "value": "769425ae9eeea1a3a4194ce82a72ffb4ec141f71b17616e73c6e6ae757bd2626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd365ba-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727112, "uuid": "06c32371-dfc8-4833-b967-40777d425348", "comment": "Malware payload (Mirai)", "value": "89b20d4f3fbbe3c0d35167802f79e8c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727112, "uuid": "96c329e6-5744-4552-ba8d-598aafaed079", "comment": "Malware payload (Mirai)", "value": "76bc6b5ee15eeb85cccaae6e34ab350f53eee034240fe0b78228d30477c7952a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727112, "uuid": "bc921914-ba2e-4b9f-9a97-a41c5cb75928", "comment": "Malware payload (Mirai)", "value": "10e294f45535b1885260c731fbf58222b59c2775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727112, "uuid": "a4187583-efe6-4768-8103-ae485a2a4de2", "comment": "Malware payload (Mirai)", "value": "99ffc1188f5cc18eb95a99be1646467535b30ddefb4bcb2247443041764a9bcdc9956e40eb10185b33b7185a186356fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727112, "uuid": "289cfe3e-d933-4304-8c79-65690c93ef15", "value": "T1E583188BF801DD7EF80FD6B74463490EB930E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727112, "uuid": "882e6e3b-7f2f-4443-891c-b8d6fb59e7dc", "value": "1536:XQOjxmw2V2xAYV8aSlslcjYAht8f489k0rTUhrIpu1HT7ot4O9I/nPanD:XQO4QEpdht8fsnrCupQ9I/PanD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727112, "uuid": "faadf2b4-70c0-4d77-aa96-d874bf3e5f9b", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727112, "uuid": "b07245f3-9543-4613-92e8-53e940a6f341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727112, "uuid": "beba11e8-d6e6-44a1-b6e6-1528ed9d6e53", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20dd1a6-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776697669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697669, "uuid": "b5817b3a-c367-42ce-9657-90fa408584ad", "comment": "Malware payload (VIPKeylogger)", "value": "d45ef38fdd52f3db2612afe96cd0547c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697669, "uuid": "fb209e89-f8d2-43e9-9000-a41f49ce4f3e", "comment": "Malware payload (VIPKeylogger)", "value": "76e3c168ee9273a10fdfd1bd2e9cf239964ddea4a8b331a8aefbd9964bed6413", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697669, "uuid": "1076711c-7014-4ab7-9f01-92a801132b6e", "comment": "Malware payload (VIPKeylogger)", "value": "37cbcc5552492f574a1a853f5e6b5a4b68821721", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697669, "uuid": "7f108ef6-0a66-448a-859a-f698615841e4", "comment": "Malware payload (VIPKeylogger)", "value": "d3b309266ef5b2f2a10f10f228d1aefd7eec141e96aa4adf8f12a76d5f4800afb4f2c3576e67c7393f8270b05b96ac79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697669, "uuid": "cd5380cf-1e6c-4d56-876f-e714a96d155a", "value": "T16F038A16328FCB0872A25689569B03340BAFB96F1FBF41C5048DDEC98FE391598573A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697669, "uuid": "b3761792-1f76-47d8-91f5-d54fc234d852", "value": "768:IOxumppi5Oxumppix+H02dXPz4jAioubF1h:IOxumppi5OxumppixsTdL4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697669, "uuid": "d81d3e0e-cf43-4ede-8e39-f2d7e4b91215", "value": 40700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697669, "uuid": "9061f87e-f02d-46bf-81b7-dcc11ec93eb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697669, "uuid": "7ddb377e-b10b-4bf8-8810-f9e2de9729e3", "value": "Factura pendiente de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67843505-3c97-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675639, "uuid": "fb523528-9bea-45a3-ad8e-9caf3581dc59", "comment": "Malware payload (SimpleHelp)", "value": "73c93aaf87a8644508b84725de32e9a1", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675639, "uuid": "af405b8e-937d-4884-8548-f31751f51800", "comment": "Malware payload (SimpleHelp)", "value": "775d2140242f7b23996f977eebfbaca46bc4a44db094fa58e102db07eacad784", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675639, "uuid": "490e9243-3451-41c2-993f-ca4f623abeea", "comment": "Malware payload (SimpleHelp)", "value": "986c747dc2f036c17c2c83680cecaf6f8fac74da", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675639, "uuid": "c449d184-1094-4c62-b5eb-634fdcc0f079", "comment": "Malware payload (SimpleHelp)", "value": "6fd06227ec18933a6513d72d5ec81605227456343f0b5524d78fe7e47b5ea2ca121407fc5705acd59dbd1a19dfde30ea", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675639, "uuid": "3c03f56a-acb2-4065-b4e7-84429d45b428", "value": "T1C4873325F656887EEE17C4BCC2858493BA66BDA603C5413F13F1C6D24AA05D48B2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675639, "uuid": "89b3fb8a-c182-42ba-b169-af256f0ad74b", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675639, "uuid": "a48dd0e9-76b9-4d14-90f8-d190aff5a8cc", "value": "786432:b9FQqqs25uju3MKDY2rvb75PW/BMeyUJN6Fw0/i:BF2TAmHv5PWmeyuQB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675639, "uuid": "16aae7f7-4831-48db-b144-5e0cc4ab33e6", "value": 36460936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675639, "uuid": "2b57243c-42cd-4293-bc4d-8f214dc1427e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675639, "uuid": "587d3396-85d5-42d2-8fa1-e6e646d3253f", "value": "775d2140242f7b23996f977eebfbaca46bc4a44db094fa58e102db07eacad784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2edd4a-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697584, "uuid": "a0fd4fa9-44d7-429e-95f1-010a5da69bad", "comment": "Malware payload (AgentTesla)", "value": "8e92a992dbe245603cba831337302f14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697584, "uuid": "36b5b89e-70df-4ed3-8a14-b44a3861e4c4", "comment": "Malware payload (AgentTesla)", "value": "77b41fbde44f483e21141d75a4b6b18f0520b0822962005432bf219e6b41bedd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697584, "uuid": "fd08caa9-8f6b-4674-a789-6f00f8bb9ee9", "comment": "Malware payload (AgentTesla)", "value": "c162f33f3fe983f6b2d7431e668de84b4d1458f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697584, "uuid": "fd3d4875-0e39-410d-b5dc-81d1361713b1", "comment": "Malware payload (AgentTesla)", "value": "1b3cfa6c48dee9b308eb6d2d063b9c075ce7c690d26b3874f63a36b395a5739b105e882c053b30bc64f1b2ccff6bede7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697584, "uuid": "dc1b2b26-258e-4d0d-8df7-938430f59ebd", "value": "T17455021549C83FB5CB9C151A60BE151E73E0CD4A6019AA8EFFA3BD4DBFB7B04812619C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697584, "uuid": "1b65681e-294b-498b-84aa-457c427beab2", "value": "24576:09zLcRhS4abSQ2bWUDEnTYoBthvTA+Klope8Vz3Sb9K:GbybotulopCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697584, "uuid": "e6bfa893-4439-4815-ae6a-8d184670d143", "value": 1357029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697584, "uuid": "a8441a3a-0bfd-4bf8-8d3b-0bc250c8a734", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697584, "uuid": "41d2bd6a-b737-4f7d-b9b4-7ddf660c7335", "value": "Nuevo pedido urgente.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac8a0f5-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674007, "uuid": "1b0ff3fd-8d82-45c2-88d5-645223543c3b", "comment": "Malware payload (ConnectWise)", "value": "00d280aae687d97ea84447d6177575d6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674007, "uuid": "3f756f48-ce54-4934-8b06-541f3510a710", "comment": "Malware payload (ConnectWise)", "value": "791c5e8cb7b413667749d76bb50d9115011ac2bbe0bcbfea3a02e8e7d328709e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674007, "uuid": "d7774f27-abf6-45a1-aaf7-e7da872b0871", "comment": "Malware payload (ConnectWise)", "value": "3804174da1c9df00b620ed22bcd5766131ab8900", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674007, "uuid": "3c908dd8-e6e1-4e9e-a0e4-330bf5bdbdfb", "comment": "Malware payload (ConnectWise)", "value": "62b46afd51103d414359c6a506b03c6880664dc0f0a1afa612b751e228aac716d9350f0bfed06b8d996ca192f772205f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674007, "uuid": "49d851e2-00a6-4358-a470-0b24772b3be4", "value": "T1DED62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674007, "uuid": "f04a2ca6-8529-4271-a1d1-3e9e0b6a0fd4", "value": "196608:0Hxcp9ym3nltDUJV/Hxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3zHk:SGplpoGp7GpHGprGp8GpdGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674007, "uuid": "e84a98e4-b49b-4aea-8164-fc6a4f7a0045", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674007, "uuid": "872c0b0a-563a-492d-b0df-03d3b9809cbc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674007, "uuid": "dacb4030-fa37-4f2d-8807-232b131bbd78", "value": "791c5e8cb7b413667749d76bb50d9115011ac2bbe0bcbfea3a02e8e7d328709e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe8ec79-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776666070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666070, "uuid": "1fabe5c7-71ed-41b1-9d97-2b6745a2b73f", "comment": "Malware payload (MassLogger)", "value": "cade65133bfecdf1d6da5638141a4306", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666070, "uuid": "69c09f4d-2102-49cc-9cdd-00b43c9e79fe", "comment": "Malware payload (MassLogger)", "value": "79582e012802adcffa4d96ba0ae9a7138f771aeeb76f858ed5af09ff94e45f94", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666070, "uuid": "402f7271-2a87-4e56-99ea-a9f761f067f5", "comment": "Malware payload (MassLogger)", "value": "915d89adc1b5420cdd061e4af063357713a64524", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666070, "uuid": "6c69f22d-14ff-4909-9a86-de3fd6f1c93d", "comment": "Malware payload (MassLogger)", "value": "ead7022ea694fb8995bde746615b6b2e6708f2b5d550a1a94923a067c5557c74e59c387ec093c9a952b735626d211a7a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666070, "uuid": "7e0742ac-517f-4400-b223-5f7ccd6a8f9f", "value": "T147E3F022D5C82F78CE781E28E17E042E73E1C69B9266754AE353FD463F9B508922F1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666070, "uuid": "10dfbe66-8670-4429-a6eb-08dbf5990bbf", "value": "3072:hng4NsqNnjQrqsJqsVo3uo9tfVTSd/Am5CX:hhMrUsHovBSd/te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666070, "uuid": "65f824a9-f06a-4ac6-b7ff-40baab779b3b", "value": 148347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666070, "uuid": "45d4bc97-3093-4ca5-88ce-bc8ed6a4e98a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666070, "uuid": "0b40b04f-6fc0-4e63-a870-1302ca2c876b", "value": "RFQ - Purchase Order #POTT40494820.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033f8dfa-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725722, "uuid": "478fc2fd-2d74-4bb7-bd6e-4947fcd8dd43", "comment": "Malware payload", "value": "64a494c165985dfd33df3fee22f0dc1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725722, "uuid": "efad5703-648b-42f0-ba7d-da36ca68cf9c", "comment": "Malware payload", "value": "79691ce6c618034e39dcac49a46e1aeacdf06523f572c8e05bf86fb49bd09a12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725722, "uuid": "0850011d-03be-4ee6-83bb-3b347f61c653", "comment": "Malware payload", "value": "36f9c2cf030a69f75ce38cf939dbaa78046a0683", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725722, "uuid": "807d0ca1-9b0e-4f50-9cb6-fcf100c3ce88", "comment": "Malware payload", "value": "d54cbac73895db1566485baa75660afabdf2dbc64fe29c754ba62ee9d35b3ce656b19275dc6212eec58852a4b9f47e50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725722, "uuid": "b2033fd1-03bd-422b-bde5-cbe38e882cdb", "value": "T121A34957B2EA00BBE1B78238C4630A45A776B8454760AFFF43A4426A1F277D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725722, "uuid": "d4a643ed-4565-4cb4-bbec-e44cced3eceb", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725722, "uuid": "9866f16f-2bfc-4abb-8985-5bf96e774d17", "value": "3072:y3JyyH55paHQeOl0N1jcpTpIS/GWmATME5JAST/2njLhbC3G1jSzoQsLyckVPxIU:oMi5uHOl0rjcW5QsFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725722, "uuid": "9f1a95e6-5297-4ef1-88c3-59a6ad163b61", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725722, "uuid": "6535687a-5924-491f-bd99-a5a9d06b8d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725722, "uuid": "10f3938f-9682-4372-bffb-2100e273140f", "value": "79691ce6c618034e39dcac49a46e1aeacdf06523f572c8e05bf86fb49bd09a12_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eefea99-3cb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776690147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690147, "uuid": "8772c16d-4a75-44d4-bad9-110a047083bc", "comment": "Malware payload (Vidar)", "value": "f4f64ed5a5e10d7516c1b816387f206e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690147, "uuid": "d4a94a1c-92e3-41a8-ad38-621bb284c64d", "comment": "Malware payload (Vidar)", "value": "79b251d88d686f1aab22e7421bae1984fafad4800374051264c655e07a08cb6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690147, "uuid": "916abaea-9784-4b34-b7d3-d7b15f5553de", "comment": "Malware payload (Vidar)", "value": "906fe12f2b91da5f50e7bf5a61f11e649d94ce1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690147, "uuid": "5a46d30d-41ac-40b3-b720-0693dd6ce77e", "comment": "Malware payload (Vidar)", "value": "b7d06b5bc297f773c95e196a1d9310d83c2e348338c7f01a02dac780bc7f1b50cd011fcdfdfccac8e29320bec60dd560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690147, "uuid": "d2aea7f9-a705-4acb-92c1-9c5cb7c79abc", "value": "T15EB56B0AACE918F6C46E57728DB626917B70FC180B3223D31E51BA782FB6BD09D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690147, "uuid": "e31ed0cd-3d23-43bf-ac33-3bde0064b308", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690147, "uuid": "4e1570a1-60cd-48ed-9ac4-b48698988769", "value": "49152:u8QXOoFfuRtWIpt2KpnpTSz9EqNx/5tbACBHO:u8FkmRvVpUFxht8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690147, "uuid": "8954a0b1-b18f-41f2-85ab-237d58da333b", "value": 2356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690147, "uuid": "6bc44d43-8953-492e-93c4-33ccec9cc390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690147, "uuid": "8f80336f-8f19-4538-8e52-271d5d3b08b4", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a81b5c-3ce1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707505, "uuid": "606e6ac4-69ed-4d13-b934-f7e7c29d87fd", "comment": "Malware payload (Mirai)", "value": "33f2a95c1b3683194a8c0d247e454bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707505, "uuid": "7b17eda3-a9ff-4390-b068-842b4a0035d9", "comment": "Malware payload (Mirai)", "value": "7a292294addac07539a4f106b3d7790c04837ac367eaa23fff575c3768e331f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707505, "uuid": "0d12bb39-2064-44c5-96f5-d71c882771eb", "comment": "Malware payload (Mirai)", "value": "3733290c5d0afe8f00fe7d90577132d62c9cf558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707505, "uuid": "1b3ba99a-85b6-473e-8d02-72b8f4d7082a", "comment": "Malware payload (Mirai)", "value": "9b2836cb9730b9f91fa39a3c850e0b1f4829a71abe1dd6b6a5d6394df867a9952a26c68462ff3f18e98aa537013754fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707505, "uuid": "618cecaf-1dc9-47e7-9aaf-84820ca20697", "value": "T1BAA3B509BF510EBBD8AFCC3709AD1B4228CD655722A93B797634C528B64B24F29D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707505, "uuid": "1c8c78a5-6d31-45a4-90cf-898dbc724f4c", "value": "1536:bZg7m3p7NsU78JXbDKJMLJgwDlUwqH6qZ49XYT9yPbKnJGA74:bS7Op7NsJj5DlUwqaqxaqGAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707505, "uuid": "451d771a-a694-4784-b260-ecaa68d3a2f3", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707505, "uuid": "c8d1447d-cc7b-4ea3-b272-b966ae640c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707505, "uuid": "06b28b91-7005-4d95-88d7-db1fc308b7cd", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6dee6b-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644967, "uuid": "0dee96cd-4774-486a-8216-fc2f666f3e2a", "comment": "Malware payload (Mirai)", "value": "98fd6352a298b0d30b352c0939ab098b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644967, "uuid": "1b0afc61-ec7f-4358-98b4-0323fbd35d8d", "comment": "Malware payload (Mirai)", "value": "7a39216ae5b891d3efb0764f4ac57e3c92683e9108ca74d269231934b345adbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644967, "uuid": "57f75b5d-568f-40d4-98e3-f9fed345dd6d", "comment": "Malware payload (Mirai)", "value": "02cd74a7402d3f1a3774240ebc49768960da8797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644967, "uuid": "9aee78ec-a99a-499f-9757-b3495592c221", "comment": "Malware payload (Mirai)", "value": "72f1ab6cf75d057436ac381a8423464898ad052e43069d4d0ee928b93e5bf4afa6fbc9f9c271222719d58b64bcb98ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644967, "uuid": "66852fc7-e346-4822-a30d-56a3449ed61f", "value": "T1EC330A96B8818A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644967, "uuid": "f09634ea-77cf-48f0-be64-938a71b1d99a", "value": "1536:gdnM5V7dJfTYKk8nYGrCGvgLiIyi55eeQO3:nJLrvk2Ybv5eeQO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644967, "uuid": "343e586b-5d6a-47f8-9262-40bbfc857b7c", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644967, "uuid": "c16ebb20-7f71-4176-9164-5fee7c52ac75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644967, "uuid": "255f6671-9f05-458d-9fc1-630b0cee7379", "value": "00okarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084224e8-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687506, "uuid": "183d51a8-ddc7-499f-ab7d-1d77fa605dd1", "comment": "Malware payload (Mirai)", "value": "cbc9ee2dde874ebc7cedfd3fb28c285a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687506, "uuid": "eedddd1c-986c-4cd1-8eac-a88d827bc95e", "comment": "Malware payload (Mirai)", "value": "7a8fd19503d8b85380c2d0a45b32de5f2d872c5dbe26a74ca3beeb68bbd1816d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687506, "uuid": "e63d83d2-8c92-458c-af52-55102cecd289", "comment": "Malware payload (Mirai)", "value": "904cebf51ea49341f23c289372f3d1207c38a65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687506, "uuid": "3748ebe4-f652-4b4a-ab97-f16bcdbb98e7", "comment": "Malware payload (Mirai)", "value": "da12fa192b8bbae54e1e906a7fd87eb0fb7d750432fbbf28728ae7198909e5397621b1c552d77e687e9cf6d3a1be171b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687506, "uuid": "35b3f6cb-0738-4ca2-962f-e8ce54b14f6f", "value": "T16D233BD9B801AD7CF95FEABE8016490DF621335051930B2B63B7FD936C321A4AE63D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687506, "uuid": "693267bf-6a83-457f-9218-e048bac89b7c", "value": "768:yLeD1MYbZs5paE+IXEM110+fmdbuzWenXpIWxJTBE2Lc850:GAaY+5peFu1hmdCzp5IWxJ1E2w8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687506, "uuid": "0b4133be-d7c8-42f5-8009-b156498b7f0d", "value": 49804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687506, "uuid": "a8303b72-6e35-4770-ac94-c030abc4eaaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687506, "uuid": "ca42fa6b-3d6b-4538-81aa-4a6cf136df67", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24722522-3cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776703015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703015, "uuid": "a852e4bd-3aec-4661-98f8-85d8c681b69f", "comment": "Malware payload (Mirai)", "value": "6213296cc014518166dbe84bd8291a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703015, "uuid": "0a4497c4-65e1-4a5d-8b99-9ea751bcc447", "comment": "Malware payload (Mirai)", "value": "7aabe6e5f744f2636f41e32c357b3150e944847e9a790d6244a56d1af3da531a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703015, "uuid": "fe577209-8953-4dfe-a04c-494534d289ba", "comment": "Malware payload (Mirai)", "value": "096741290e7a8714b302bc685d4765bb1e3af1e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776703015, "uuid": "15e6ed04-1125-4b5e-b90c-c39a4d84c72f", "comment": "Malware payload (Mirai)", "value": "8702839b17619abe8fa2e442e3436ec1408810df0afcfb44fece0b8eee05a52dfd5166d8196bd4ce450bb8161dc12efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703015, "uuid": "d3b0bfa3-155c-417e-8ff4-76df60e13263", "value": "T17FF33A46F6418B13C0D61776BADF420533239BA4A3DB73069A28BBF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703015, "uuid": "ca8586ea-9a00-4977-9137-3b958b26d737", "value": "3072:ZI1ROyuSdaIb3BhvLDCdVU+qFlfsYwFDmNeqM/9pX8EF03:ZI1R3bdaIbRhv/CM+slftwFDmNbM/9JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776703015, "uuid": "94701c50-8d77-4def-8e1e-33b31e52c4df", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776703015, "uuid": "54c8fe68-6962-427a-a7d4-3058832127d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776703015, "uuid": "d8c6afaa-9d38-4532-a9c1-7ae93ffd933d", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2857cfa2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724926, "uuid": "c76e8aa2-4647-4110-b730-85f32336d9f2", "comment": "Malware payload", "value": "48a8f7ad75175fcf911d460da5e7b634", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724926, "uuid": "d232846d-ab0d-433e-917a-cc3e954d5d5d", "comment": "Malware payload", "value": "7aade8fe1559a270306c43a674b80edacf7c4504f41399169e21641ce3639b60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724926, "uuid": "e38adf5c-a925-4024-9453-efe96ddef6ec", "comment": "Malware payload", "value": "3cda08a02019e1383e47bce2f72fd482d80f80ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724926, "uuid": "87112bfe-e82d-4daa-bd18-116049b41980", "comment": "Malware payload", "value": "f78c8a101d79711ff45130102128480ff7d507e810143c207d84f1d296870be94f2e1ed8a245d3300631d638f8485b2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724926, "uuid": "566e09c0-112e-4652-bff1-3d5c33483508", "value": "T17CB35A47A2E501BBE177D63888A34A46D7B2B81517209FEF07A4468B5F237D18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724926, "uuid": "8a622e9f-73ee-4d60-93e5-60b7433048c7", "value": "d3dc6157e6aaf043a0b940d7cd04bf7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724926, "uuid": "bc490bf1-df8f-4127-a0cc-5a31860a8a1c", "value": "3072:WyWojhwVu6p0ZdnU/56JL5qdcKltX62qM:l3wMPm56BhKKrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724926, "uuid": "8e3e881b-e32d-4d38-b603-c219a9ba39f4", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724926, "uuid": "16f30b05-d43c-4b3f-ae1b-e67a7d1e3988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724926, "uuid": "f243f3ed-4a1b-452c-953e-c84828c46e43", "value": "7aade8fe1559a270306c43a674b80edacf7c4504f41399169e21641ce3639b60_IPHLPAPI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4096f3c2-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725825, "uuid": "f94fb063-3e5d-4a44-a6e9-697975583420", "comment": "Malware payload", "value": "fe1bbd485177181eb497e666b5d1e551", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725825, "uuid": "9247baa0-39d8-4422-bd1a-cda775186446", "comment": "Malware payload", "value": "7ac78ea5f8cd1abb74458d9e6a29d67fc4c904ac2c6c76c2a33da5f61df8d900", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725825, "uuid": "7c650174-88ab-4b1f-addb-312076bc899a", "comment": "Malware payload", "value": "9700fe9bc36f92049c4919cbfafd37daf915f88a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725825, "uuid": "c87fa10d-e87c-4d57-a457-da45170e803c", "comment": "Malware payload", "value": "bf796f2548d0425b68691b0ff7d0c420f7c522d1d40770c838c7e8ce3a4f438e8f421ae2fc10794083f98e10e69c8355", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725825, "uuid": "7923189b-d4c9-4f31-9d1d-049daab9134b", "value": "T1C0A35A4B62E640BBE1B78678C8634A09E772B84157609FEF43A4425A1F273D18D3DF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725825, "uuid": "91a45b43-34b0-4e68-b2e0-d798a153a0bf", "value": "e0cd7bdacb3541ed0b8f541f2f17065d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725825, "uuid": "48221173-b61d-4a2d-9625-491857302188", "value": "3072:pf7T1KXHpWGeZQb7QuTsWwDvrX8o7njWmAtpFrpqpKp6VIbvetWN:p16HI3M7QuT7JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725825, "uuid": "45fc9ca5-3397-4107-a6f3-866f5fb21c55", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725825, "uuid": "90fd99cd-3125-46c4-ad49-6e4be5e0498f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725825, "uuid": "5cb642ee-4b31-42ae-9a7b-3e77cac02458", "value": "7ac78ea5f8cd1abb74458d9e6a29d67fc4c904ac2c6c76c2a33da5f61df8d900_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfc310d-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724933, "uuid": "788b8241-3f02-4ea0-9e78-1084126893d4", "comment": "Malware payload", "value": "65e73a3109c3e4587573254173833538", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724933, "uuid": "4e9f6f16-a5d9-4f65-8e32-72ed5de5169c", "comment": "Malware payload", "value": "7bbec88b1318b26b7555a984e8e09245530edcd3ea9904225d32ccb9868a0914", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724933, "uuid": "e55de13a-4c26-4ffc-94c4-dbf4b6c501e4", "comment": "Malware payload", "value": "4d02fcaa5c8aba459d38c9fa1b61a99ad6948d59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724933, "uuid": "0f7310c7-3f08-4fdf-a548-a40245b417e1", "comment": "Malware payload", "value": "a616ea73dcb346af4abcbe4c5132d2450805b6406d6f5b70fe637899c4d69339de99bdb26d80128a7378c65b210ecedf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724933, "uuid": "7a27bd24-a001-44ec-8342-7f3d09a2bc56", "value": "T1B6B35A4BB3A500BBE1778678C5630A46D7B2B89117A0AFEF03A0465A1F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724933, "uuid": "452a51f5-8d63-4b13-9515-18ec19d166ed", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724933, "uuid": "609f9ced-9b99-4d47-90ea-9cb6e660119f", "value": "3072:a/azEnyFSpckqn/JqpJxSjjUTckVPxIiTRQXol:auEyY2n08EiXol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724933, "uuid": "fc0ae98e-52cc-4439-9d7a-798284c9f917", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724933, "uuid": "a2ecef5f-dbe1-4d96-ac00-9fb9c3b599a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724933, "uuid": "6085ea31-90e2-46a1-8e28-b5b5f85e0c46", "value": "7bbec88b1318b26b7555a984e8e09245530edcd3ea9904225d32ccb9868a0914_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded156b-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644941, "uuid": "a50d1380-e517-4e28-b790-47bbf3fd0986", "comment": "Malware payload (Mirai)", "value": "02974e68500bfa0c13f05d4d9d7e8616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644941, "uuid": "c19fe828-60d7-470f-80f1-068d6d232a47", "comment": "Malware payload (Mirai)", "value": "7bf39d1f2ae496d69716ca14afa887107f191884f1346e165d24cd7307777703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644941, "uuid": "772b51eb-7fa1-49c5-ba8b-4161a7dd554d", "comment": "Malware payload (Mirai)", "value": "c38e5a7244d661b340bd021ed9c912acb14174e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644941, "uuid": "16cfd1ae-d94e-4405-b95b-3fb1872ce6be", "comment": "Malware payload (Mirai)", "value": "32ee515c0d9e856f1c3318080b3cf527878eda0fb4e92ce3a6891bc8c8f82544d7d09430191e38e718bb8ac93fd48f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644941, "uuid": "6a251358-1b13-476e-a2ef-4858a706d741", "value": "T1D9234A21B9392F17C4D4A8BA22F74768B2F5165E25B8CB5E3D320E4EFF14A8095173B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644941, "uuid": "a951033f-40bc-488c-880d-4bde46e8a9fb", "value": "768:yzomnlRq91dCPgsIrU6Tabz2rlkGqfrnxoO+6E0R0:yzVnlRS1dCPgs8U6azw6nxiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644941, "uuid": "1d7e1776-43a0-49d8-a3be-b59b0461cf7f", "value": 46820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644941, "uuid": "10225381-ef23-41a8-8f9b-04557822305e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644941, "uuid": "44a66b09-d041-4234-a36d-4193a0ec9306", "value": "00okspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32eb8909-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688007, "uuid": "f79f0013-38d4-4965-a048-ada018f2150e", "comment": "Malware payload", "value": "60c6d2ca134d03b2f11167b19e52760c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688007, "uuid": "2d36aaab-bd85-43ee-93bd-f363ac382103", "comment": "Malware payload", "value": "7c0d514764c153a67eb33e38ca6e168240dd11e9efa576bf3643b423939ae7a3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688007, "uuid": "6ea03598-1029-41c6-9861-bed150434bd1", "comment": "Malware payload", "value": "1c5d0a6035de3ce79fe21e7161fe4a115aa4f807", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688007, "uuid": "b1870f92-06a9-4ca6-b954-86ad4578f97c", "comment": "Malware payload", "value": "fcaa05cab5d5d29d5df6f5366551695f594a0c53154781a2eacdef7b75afa0661018f33b06bff8dd3ebed20205731219", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688007, "uuid": "447be647-16e3-4411-8f4d-e2455e17e378", "value": "T1BAB57981EBEEC512D775A532DD12937923E2DC40FAC52B03B5AC2A383EE66615D093CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688007, "uuid": "cbc1da0f-d995-4dbd-8b90-c22facf8959a", "value": "24576:xku2EG/lhV/LYV8dytqWqXLYSD9eQmH857qwS+/HQqT:chFR7w+/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688007, "uuid": "8e0f2ca2-0821-4613-b6ff-7a84e2a8d7b3", "value": 2393600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688007, "uuid": "33c4b93e-b2fc-45d3-ac6d-69e9acadf75b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688007, "uuid": "6e926efd-8e31-4235-8e58-d53ae27021b0", "value": "SzimbaNevjegyzekv1412026 6.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b848252-3cae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776685551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685551, "uuid": "57bd368b-0471-43e9-8702-0d016fc950f8", "comment": "Malware payload (Mirai)", "value": "87d444010db4961d2ec03d37511de3eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685551, "uuid": "8faaa9ea-65f1-4bd5-8c61-e1371fe08eee", "comment": "Malware payload (Mirai)", "value": "7c42da62b0e68e1e1193526392657b026a186fdafc6adca3859c875831aa3d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685551, "uuid": "cdfe78ea-383a-41c7-aaa0-97d84baa1b15", "comment": "Malware payload (Mirai)", "value": "8308bc1c29a7b7ccc3417d69c309dd754ad6656c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685551, "uuid": "a60fae74-8539-426e-a927-69d00c07ae26", "comment": "Malware payload (Mirai)", "value": "8297276d04f88bc4a3528e8aab01ee7ef857abdc8d8210108c849d2da329e4a76e83045b79ed60b98dd9481bc8481d5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685551, "uuid": "7484e0a7-8c4e-4538-8123-74a0355ff696", "value": "T14DF30A72984CE5CBC53321BCA0E99FBA8E7E72DB2B59CD017CD151309AD5EAB3906C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685551, "uuid": "c9b16d19-4361-41c0-bae4-1028333d8073", "value": "1536:wIkN84/e9FO4Wz2Kg0TdG5H2K+pK7DKrtwp+Vp+wEi/w1lJV:wIktzlJTdG5Hsw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685551, "uuid": "60bf6070-9150-4499-bc68-8af6d0881b85", "value": 166040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685551, "uuid": "bf7f9a09-40ae-410a-aeed-5447e2649405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685551, "uuid": "ecf0f1c7-fd60-48ea-ab65-a2304b64db1c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a107f-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776725523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725523, "uuid": "f0335f56-f845-43dd-8910-0946a8ebe22f", "comment": "Malware payload (QuasarRAT)", "value": "2749914b9594babaa653025b3d17eec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725523, "uuid": "b76325ba-4347-4963-98c1-332c7206b9c3", "comment": "Malware payload (QuasarRAT)", "value": "7c5f0849bc5e6573662067365845aec75dacf7ae11ff68e12654579a1b607385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725523, "uuid": "94759af8-4d48-4e57-9076-32e08a77d87e", "comment": "Malware payload (QuasarRAT)", "value": "00c0e976e55b2b128f5181a87875bb841484d4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725523, "uuid": "0b01d3dd-8b89-4e9a-a333-aa1c29d8c95e", "comment": "Malware payload (QuasarRAT)", "value": "f5f5b6ebe69539c6a8e5b2c27f1281a7789beeff121296874c871462ef2315d17de98c8eca407dfe7cd28a1b3c7dbbaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725523, "uuid": "61917a87-5c11-4f12-9714-58f5e299e0d9", "value": "T158746B1473A8C6ABD2AF8779B931070A0BF4DD06B156E38F9A6550BD3DA3345DD802B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725523, "uuid": "0e8cb5e0-77bc-4287-ac25-0ab351a894a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725523, "uuid": "43ee9e78-91f1-4c6a-a42d-50280cf6b914", "value": "6144:QkgFoEJuquq7VzX5u3WDiOQSZ+20kI2YTbf6zesG6IJ65UJwvy:QDFVJuquqzXbBtzLI2Ycfq05UOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725523, "uuid": "75c15454-8c89-4c91-955a-76f9c85b9038", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725523, "uuid": "6edf13b8-8a9e-4051-8c98-380165a9cfe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725523, "uuid": "f6a60e05-a544-4585-b54a-50b0c66c376f", "value": "7c5f0849bc5e6573662067365845aec75dacf7ae11ff68e12654579a1b607385_aa011895-0281-41b7-ba38-400bff2d0e6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e69c233-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675222, "uuid": "b8ad4230-6964-41db-8f30-fe94f7b26706", "comment": "Malware payload (SimpleHelp)", "value": "9a92fd985aacebd679e6b9e7dd64eddf", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675222, "uuid": "68df8d15-ac72-4453-90ee-8e1ad7b832b8", "comment": "Malware payload (SimpleHelp)", "value": "7c6a87d4cfc71177ad1fa5dac197457f84cb8ac451a6d44bec5b707c46704548", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675222, "uuid": "8e6f1b41-3494-4f13-9ebf-6d5a9262a554", "comment": "Malware payload (SimpleHelp)", "value": "0e5545754f55183d01a35690c334ab430dc6401f", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675222, "uuid": "70dda6b4-afa0-4350-847b-7a8a0ef097a9", "comment": "Malware payload (SimpleHelp)", "value": "1bedb3c070d70992eb6e4c75a528d58235885e5845bc5f853b16e620f2fa0a4d7bad9e554a61920e87f59e9fa19c4ac5", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675222, "uuid": "652a3536-f7aa-4c7d-90a2-0c9a732cf709", "value": "T1E0873324F6E598BADF27D4BCC146C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675222, "uuid": "d1ef1bda-0b7d-4067-b17e-1da5d9297088", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675222, "uuid": "795a1a0b-8c17-4547-9736-9b14869e2d2f", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7Rmf:pJF2TAmHv5V7R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675222, "uuid": "50802409-74d6-4e21-a563-6683f6cdab89", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675222, "uuid": "f49ec2ee-0d25-4de0-bcf7-7a70047573a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675222, "uuid": "51c82bc2-9253-42cb-a5ff-36d17e15a6c9", "value": "7c6a87d4cfc71177ad1fa5dac197457f84cb8ac451a6d44bec5b707c46704548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae7872b-3cff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720420, "uuid": "20c82653-e8f3-455e-b9ee-13a4692bbf37", "comment": "Malware payload", "value": "2369c95ed5225450bdd9febdf28dd12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720420, "uuid": "5d256893-4f63-4772-8fb1-e3016d5006d6", "comment": "Malware payload", "value": "7c703e26ab284b1803a33688a29ea0acb3cb33e54afd840d57356128428238fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720420, "uuid": "4b6b5b8d-26a7-46ec-ac7b-2b6e9f906bf0", "comment": "Malware payload", "value": "21258da1cca649fa406f83bc12abc8045d0702f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720420, "uuid": "54f35c73-89c7-41cc-a1aa-9788bbb91690", "comment": "Malware payload", "value": "d2dbefd87b147fea83ab8a26d89549211dcb51a3b5918de70a9d570ad12033ca0df2ded52b5a3a13b26c8de992ea63af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720420, "uuid": "0e20c7f0-3250-44c6-9a22-3c81d5e4cc86", "value": "T19E72288BA7424ADAD17AD179C933553BE2B3B4115721D7CF23A08A6D0EB67D0AC32F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720420, "uuid": "4acf8138-b225-4303-8cbb-c0532c603542", "value": "744e2e84a1029bcff35410e4013b3ce5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720420, "uuid": "5ddd8c08-93d7-4bab-a306-6c883472c71d", "value": "192:Y9spqwhaDtd2AlkdqZlrjfQU34JBQcMo3Q5XfLgVRt0:Y9spqkzAlkYf3fQUEfMo3PRt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720420, "uuid": "0de61165-d714-4d14-b9d6-1d23351ba35b", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720420, "uuid": "a012c062-0751-423e-a91a-f0d2977e1fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720420, "uuid": "83cbbb33-0b61-4b87-aa3f-f42703f3037e", "value": "kernel32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e5fa22-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725185, "uuid": "a78308bc-2c26-4a9d-91ff-69ad8a145b27", "comment": "Malware payload", "value": "797add8c2ccd7b13d4cc6080b0e2bf7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725185, "uuid": "879d0317-3f16-4e56-b86c-f5aadaf51ec4", "comment": "Malware payload", "value": "7cd1d2f7303bda0596d94e312a26ffa0349c98b84b0e0f4a3562a8ffffc31e37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725185, "uuid": "680a6534-80bc-46be-a3af-2a5ae9ca8690", "comment": "Malware payload", "value": "288d5ebe329ae228aaa56d79e8ae1fea690c9fce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725185, "uuid": "85adc8c4-6c72-47f1-92a7-5891919dfed2", "comment": "Malware payload", "value": "daeb66b8b3a0c79f7a8ffca00cc8cf85c6a62da99ba5c196d0ada8f625acf6a1bf6d4bbd87681df80d711913e20df493", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725185, "uuid": "bc1f437c-2ad0-475f-8fc9-2afa417715cb", "value": "T1EBB35A5B62F500BBE1B7923885A34A06D7B2B81557609FEF07A4464B5F233E18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725185, "uuid": "fadcd89f-21b6-425e-b394-6615d9414c1e", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725185, "uuid": "5bcfd858-8551-4f54-a890-6bb076909dd2", "value": "3072:CY8oll4YSI2bdOASdo5XjZZsIV1dqT5NEWXR:BlLeAdoZbVm5GaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725185, "uuid": "4bfc940e-4006-4a17-a033-e669d1faf722", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725185, "uuid": "a97bb622-a5b5-4114-81c2-fa3033460ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725185, "uuid": "0fc23949-0ccb-49f2-9048-91e9b597dc3c", "value": "7cd1d2f7303bda0596d94e312a26ffa0349c98b84b0e0f4a3562a8ffffc31e37_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db1b09f-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674710, "uuid": "fd37a5bd-1a3a-48a8-b548-fc0e76feead2", "comment": "Malware payload (SimpleHelp)", "value": "848ec9e8d7452d27c6ee14039b63641e", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674710, "uuid": "20c5d095-bfe7-4f9d-93b5-6afad08da33f", "comment": "Malware payload (SimpleHelp)", "value": "7d9649ea6cff55ed85baf836f8915cdfab4550ba88ccd065aef018be8fe3244a", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674710, "uuid": "75218630-4833-40b2-ae28-79f5f4e3b431", "comment": "Malware payload (SimpleHelp)", "value": "b1d6382cc75f3291aba0d58fe45ed04236a019a2", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674710, "uuid": "0d0e9034-534f-438d-a0fd-51c43c3b246b", "comment": "Malware payload (SimpleHelp)", "value": "03743cf7d9fbe396b99a3e37291d4bc89e3c26219d04e26bff07854827f7fb6aeafeca8ef2bbfc9f4eb3889a17a076ae", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674710, "uuid": "700837f3-00d8-4999-990b-4a116c3e9a2a", "value": "T1BA773324FAA16DBEDF33D5FCC0464147AA5AA4A70389121727F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674710, "uuid": "d4f1eb1f-f40c-4fe8-b3b6-cfeca2e6ff81", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674710, "uuid": "801aa630-c487-4ba8-b8ac-32170a67e301", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcb:K/jkCgpPUK8PyL7M8aE1VWhroHFcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674710, "uuid": "8f164bcf-8932-4eca-8769-f39c3647b489", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674710, "uuid": "974579b0-c30d-49b2-9891-693399a94d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674710, "uuid": "97e9f1f5-df7f-4328-926c-54b53d705980", "value": "7d9649ea6cff55ed85baf836f8915cdfab4550ba88ccd065aef018be8fe3244a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce93be2-3d13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776728960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728960, "uuid": "8c4ec594-776b-40bb-8526-24bd6bb56453", "comment": "Malware payload", "value": "20faa35bb724319ffa8a8e0eb128c487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728960, "uuid": "ad3c0771-209e-4d4a-bbef-752c0de09f51", "comment": "Malware payload", "value": "7d9cb0d9d5c8d2d12afdd16e0f0cc9ed9cda5767d003f9cc553163a42a03b948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728960, "uuid": "957c5c6a-fb2c-4cca-ad2c-fc20715827a0", "comment": "Malware payload", "value": "81963586d641b38803c0063f752071dc63b27c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776728960, "uuid": "d4ec28cb-9779-406d-9801-4abc77c5e6a6", "comment": "Malware payload", "value": "27c94d72bff82b47cadbc4278897acb6d6e3c8047284c5525cc228c7fbf92efa8bfcfc7a0a64f7c3cf474910ad4d8496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728960, "uuid": "624b6d02-efba-4a4a-b7c3-9ac4381e22e4", "value": "T1E9245271D48CD983C563217DA5AC9FAFAE3F73EA6789DD027C9065304AC6E9B180BC40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728960, "uuid": "16bbbba7-2647-4964-bd39-dbb635339e2a", "value": "1536:M6nSvzpEZUZHpJc3XP3oCH9qe9aFLQxM0iZJ1gvRF1k9D5XRKAYvsTFK+pK7DKrf:wvzBZHpKfyAaJJ1gvRFWBT7BTlH7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776728960, "uuid": "62300da5-a39a-4695-aea2-095ffc350e8a", "value": 215116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776728960, "uuid": "981eca9c-53eb-4097-b796-940bb9a4a232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776728960, "uuid": "b4eb377c-1162-4183-9961-06fd40e7046f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a293a1d-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674678, "uuid": "5e2d5ab4-180b-4901-ab0f-943daa0b982f", "comment": "Malware payload (SimpleHelp)", "value": "b30a44a81b6da6a07660b0d03ff370d5", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674678, "uuid": "24970a7c-4311-4c6a-adb1-4470f9a28e87", "comment": "Malware payload (SimpleHelp)", "value": "7daab9e4034b87c5be2a4502d2dfe6d1a77d882ac84f7a35d3891e9554823cba", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674678, "uuid": "4650d5c2-dd86-4782-9b56-c036135c367c", "comment": "Malware payload (SimpleHelp)", "value": "43bad420360a17a3db12d0b74b8c7b656eb89741", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674678, "uuid": "cf0ce133-cc70-4111-9613-14c7e8f3e170", "comment": "Malware payload (SimpleHelp)", "value": "c655c23133de8941d2a9958e64ecf27f1c7a1efc6074b48c8ed0f240a8d9f9336b7c82c0fdd0e551bf7f6c1a9d5662a6", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674678, "uuid": "0524232e-f468-423b-95d3-d22fa6a708db", "value": "T13F873324F6E598BADF27D4BCC185C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674678, "uuid": "2109d88a-9916-4deb-b2db-bf37206e2e94", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674678, "uuid": "80b20164-ae63-4665-852b-4cd1fc85ff0b", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7RmX:pJF2TAmHv5V7Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674678, "uuid": "33215618-ac0e-4647-9d44-47391b618f55", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674678, "uuid": "d800a2ba-4b29-4e12-8929-d4c76cb70075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674678, "uuid": "c8ef7da8-959b-4984-aa68-491e9c994e52", "value": "7daab9e4034b87c5be2a4502d2dfe6d1a77d882ac84f7a35d3891e9554823cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc164e12-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676694, "uuid": "44fb57ec-aad2-475e-aff3-e79b1722e270", "comment": "Malware payload (ConnectWise)", "value": "2f8af02b096c3c75684861d0ef3c62cc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676694, "uuid": "e383ae47-c926-4e05-8f90-1fbdcab165ee", "comment": "Malware payload (ConnectWise)", "value": "7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676694, "uuid": "3e164e2f-4818-466b-b83f-4027dd00ab40", "comment": "Malware payload (ConnectWise)", "value": "a73a39faa2e970e5d6c1efe0d559e2b4b06e20a5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676694, "uuid": "446247aa-3dc9-4964-aae3-29c2eccf10f1", "comment": "Malware payload (ConnectWise)", "value": "a57015e6fa225e476753dcd9a62094bcda3ba14852a9e27ac08ff7776bc72c4a74810d2d509a7a6b7add222e8f1845bb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676694, "uuid": "4901163e-f00f-4b58-b3b5-be7064438e15", "value": "T19E646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676694, "uuid": "cbcfa91f-c14f-426e-ae2a-ecb5410cf5e4", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676694, "uuid": "9868acbb-d2ac-442a-bf03-0c9a02637575", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676694, "uuid": "77b0e505-d395-4d07-b944-9cc8939ce15f", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676694, "uuid": "2e5458df-33fc-4187-b033-3caff848cf3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676694, "uuid": "2ea17081-692a-4ba4-a986-2954c0928a60", "value": "7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c65f6d-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776666290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666290, "uuid": "c17e3a15-7e94-403c-baa4-001d60b231b5", "comment": "Malware payload (RemcosRAT)", "value": "4a76aebfab9737bd65499793baf9d9ec", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666290, "uuid": "31522ad8-07d9-4257-aa50-87f7a417894d", "comment": "Malware payload (RemcosRAT)", "value": "7ea3c3e235eab6d1fc2b4d2e3db909337b874a2a341b868f2f132c5661eaf528", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666290, "uuid": "6eb5d663-727f-4a17-a904-113071582fbe", "comment": "Malware payload (RemcosRAT)", "value": "ab04254af95d91185aead311e8c51589d979d62a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666290, "uuid": "91901d53-1b79-4e7e-898b-14de21e8c523", "comment": "Malware payload (RemcosRAT)", "value": "e3965c7db880d4e6d392231fb2b590256ce3ab9d7938e04207c83934b3fe9f4e0a619d9a4a0cb86583a1b036e69cbc4a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666290, "uuid": "e1152ea3-7a02-499e-a619-5edb7aaca2ff", "value": "T1FF727F98CEDDFCD0FC52169C55A03045FD22452B8A1809E22A7ABF440F327FB8959DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666290, "uuid": "8da51b1e-fc63-4662-9fc7-61a566f1b036", "value": "96:HA2wI6uYrGk7JbjCtvUR+bg/3CIBxsBM7Q/65t6vo7booNEgyOwsyYzl6Ohu1u/p:LUGC3NUCyF8P6Zza3wT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666290, "uuid": "ca276f8c-555e-4512-b357-013ee3d7aa91", "value": 16376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666290, "uuid": "f44b10cb-5986-47df-a586-8eeebd1184df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666290, "uuid": "506b6efd-7c00-4c16-9f0a-e201fa50e5ca", "value": "CI9576548464646486476774764674765353535875.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0847ee5a-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725731, "uuid": "457ae497-7ec6-4123-ab25-856effbce50f", "comment": "Malware payload", "value": "09b8131fed390fa1ef74ea2af35f91f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725731, "uuid": "9a8d70b3-0d58-4898-86cd-1b3392823a36", "comment": "Malware payload", "value": "7ebbd673f805dd1f8b8a7a58e81b51c0870a6a62ba09b3460198add11f593a28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725731, "uuid": "e65874c4-edda-4b02-9154-769fef12cd06", "comment": "Malware payload", "value": "862b2f291823b1f7e7bcbdcb869b91b530e68d44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725731, "uuid": "b3010e41-9466-452b-8021-60ed4cb56196", "comment": "Malware payload", "value": "506b39fcf02615f75d68612a8866d84eea4d108fa88aa82f83fce2311fe00e34579f5ea49af6208d5109007661fd8a6b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725731, "uuid": "4d822e7b-31c4-479f-a90e-58adfc25986e", "value": "T120B36B4B72E500BBE577C278C5670A4A9772B85113219FEF07A4425A2F637E28D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725731, "uuid": "d7fcffe5-31a0-4843-a036-a9455f407fd8", "value": "233a5431c033868c22dc3cb966d2f492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725731, "uuid": "f83f1944-f2c6-40cc-920e-cee6f07e1b80", "value": "1536:lVNo5apiHibqNYt2gBv+kIEd0TH0SmqCsNFndjW78EEvsWd3d49dl+tsjZAmxds:cR4qmtM9EdIUBANFnd7E2toUAZAmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725731, "uuid": "ec9501c8-2c43-476c-b455-58b9c8bd35a8", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725731, "uuid": "ec4cd8ec-cd6b-4400-9d64-9e824d13dae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725731, "uuid": "a5010dd2-b608-4634-bd9a-d0bb0fc12b2c", "value": "7ebbd673f805dd1f8b8a7a58e81b51c0870a6a62ba09b3460198add11f593a28_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a07539-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776724864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724864, "uuid": "aaf10152-8eb5-4cb3-af96-58a5fead360b", "comment": "Malware payload (RustyStealer)", "value": "c9b61fc76f9b36189751bbf07839fcaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724864, "uuid": "37bc00bd-d231-4e33-89f2-b172d634fb28", "comment": "Malware payload (RustyStealer)", "value": "7eccb6a38742dac9dab5d9d00750c8173ba0a7ad5fc6962a3126599cab0993ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724864, "uuid": "cdc4475c-735a-4cf3-8eb8-112c56ab10e0", "comment": "Malware payload (RustyStealer)", "value": "4f10e9e187c1d1e08f67c1da9657198a55d5229f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724864, "uuid": "1c03d893-541f-430c-a0da-954da5b26bff", "comment": "Malware payload (RustyStealer)", "value": "13141ee3d4b1ead7a0b2fcae9abf7fc9c5286d34bde49c7628cfbb4bf3bc20bdcae25fac246f56c3ca3967ea5f2757f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724864, "uuid": "9258e4bb-913b-43e7-9d8b-d918693eaa0d", "value": "T11ED47C13B6A591BCD15AC07483969272FB37B88A063179BF13E487343E9AF511F2D728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724864, "uuid": "06f51791-1094-42c0-8d09-533a242ba965", "value": "84d7cd4731107273f0fc42b8d179be11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724864, "uuid": "b11be009-3595-4194-a354-8749f793f8f7", "value": "12288:yTJ+sHD4pxOohSMjldNkdplY6IQFpP/mJ10b1:yTEsj4pxfNjljkvMQFpP+X05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724864, "uuid": "fc1b3020-ae46-48a5-93b4-68121d7717d9", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724864, "uuid": "238d0ee6-5cfb-462c-8e9c-c57b8c93c94d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724864, "uuid": "b49ed50c-21f5-45ee-82b7-bb0eaaa34bb8", "value": "7eccb6a38742dac9dab5d9d00750c8173ba0a7ad5fc6962a3126599cab0993ca_a701da80-eda9-4ef3-a0e4-0ce8b3f22d4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0179a66-3cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776697343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697343, "uuid": "1c0c4c32-89e0-4493-9f8b-85f74864254d", "comment": "Malware payload (ConnectWise)", "value": "4e018d8e1ebb1e7367a1778ee3e5269c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697343, "uuid": "edea6e34-234d-4914-a66c-34c321485070", "comment": "Malware payload (ConnectWise)", "value": "7f08bb0519eb2149b3a8724d70f2ddaa315446f8b1ac08d0a974eb770a91a265", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697343, "uuid": "ad65c5ff-d8a8-424d-9bdb-eff7666e09de", "comment": "Malware payload (ConnectWise)", "value": "2adcd0e75fe9c726c617050df3db316e472cc6ef", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697343, "uuid": "dfe035c3-14ea-416e-891c-42e44eedc2f9", "comment": "Malware payload (ConnectWise)", "value": "1f8604f2462bd0fc44ebed03a8ed14d892ac75952899b46051332e8da6c9d6fc82881bf0669c6692f463fb87dd98be96", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697343, "uuid": "81f60a4f-420b-4a20-ad09-1c1463cb434b", "value": "T196D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697343, "uuid": "bf8661c7-3a47-4103-94ab-d7ba7b01032d", "value": "196608:RHxcp9ym3nltDUJVgHxcp9ym3EHxcp9ym3zHxcp9ym32Hxcp9ym3KHxcp9ym3lH+:DGplpnGpiGpdGpEGpYGpXGpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697343, "uuid": "d3adfc6f-3c4d-49d6-af2f-218e1b1dd129", "value": 13545472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697343, "uuid": "df353061-57a2-4865-8771-e5e76693bcc7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697343, "uuid": "38db5176-f523-486b-849d-b41ebf75ac20", "value": "goodg.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c7942c-3cba-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776690827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690827, "uuid": "001a6bcf-3eeb-46ab-bcf7-b8a7f71ea4d7", "comment": "Malware payload (SalatStealer)", "value": "960e6f4fa6867465d41f1b798fa4f49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690827, "uuid": "d9c3e924-e43c-49de-9ec6-f87399e0fb49", "comment": "Malware payload (SalatStealer)", "value": "7f98ae1814dfc11291a25325ead52a4759b7d4e3aa26697baacfa2f3df434a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690827, "uuid": "4a61a32d-1701-488d-a52a-fa76d43b316a", "comment": "Malware payload (SalatStealer)", "value": "a982a0f00511d3c3349547914045e88fe8fa2aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690827, "uuid": "a8e6afbc-0c50-4115-ae7d-50de9f44b918", "comment": "Malware payload (SalatStealer)", "value": "481a6ef70d5b9b98c97c9e4f83d3b7d3b93c81959c884926d7bf62bac94a8dbe67aa1d33f9861ccc95c9d297e9859996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690827, "uuid": "a2831b09-d16e-4630-b86b-8f4ffb78b346", "value": "T1DFF53363422A4016FD27E770574376A4F3ECF6E59B28074D914806E3DABB0B8B36663D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690827, "uuid": "0367cd5c-af0b-45a6-b540-7adb4c6d797d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690827, "uuid": "0632b447-872b-40b1-98a7-d6b912b638de", "value": "49152:VnzHm342SUanlCbQRppPNb1V8WWIazLpSnTGbFWYtZV06/IiGHiQ2:pX2SvCaPl/LWIahSUPRtfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690827, "uuid": "85b61679-7e24-4d8b-848e-1d414859dfc6", "value": 3586048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690827, "uuid": "2b68c2fc-44d9-4531-81d0-cf31fa6a9a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690827, "uuid": "38d979b2-fb9a-438c-bd69-e198a825ef60", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fd05f3-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776697696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697696, "uuid": "b68cbc86-fdbb-42be-bbbc-bd819076d002", "comment": "Malware payload (AsyncRAT)", "value": "016cb7afa2a0d7d27ea64d87127ac15c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697696, "uuid": "5c57bed3-3c7c-4d4b-8ea4-d368b93df0a0", "comment": "Malware payload (AsyncRAT)", "value": "7fb6a216b21615eeb881bd16cbcb26155a590a40e7972d91bff2e21c013b1bc2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697696, "uuid": "924b1765-d535-4926-9a9a-51606ad0ba17", "comment": "Malware payload (AsyncRAT)", "value": "a079c72155a9c5b30a7d68138074c62e649c334e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697696, "uuid": "5388293a-16f5-4528-93af-6ffa18f4ffa7", "comment": "Malware payload (AsyncRAT)", "value": "83bf410b2e1232c5e0bec3fd87a6cbd86e012b8ae915bebd1997c771cec2f992397035eca3e9b8a63fe1bd183f082907", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697696, "uuid": "f6518e65-0c20-41c4-be87-436923c18436", "value": "T1F9D50E65722B17D1F859F90E97DFCEF4823B29F5EE24A92070F26F1A3B2654100B7852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697696, "uuid": "9519c28c-f30a-4b50-8480-240f72d25aa6", "value": "384:IDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD3:/1ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697696, "uuid": "4592ea5c-49a0-4de8-9226-f520ff97cc97", "value": 2834454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697696, "uuid": "6a027c2d-e369-428d-bd7e-85dea206b346", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697696, "uuid": "3f58bd26-e352-4ea3-b3a4-261a0b9ffc46", "value": "PO 4500272644.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a6e2a3-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726002, "uuid": "72151be9-0400-4967-817f-974f24253f2b", "comment": "Malware payload", "value": "a69be64e8c0cfc997c849f720a211ccf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726002, "uuid": "c597de37-0887-4786-bbda-db0dbff7cd77", "comment": "Malware payload", "value": "7fd36bb8a300025b7f2a19c1ba3717de1f4528c943847af1f45d96d05421bc71", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726002, "uuid": "5df66ee1-1923-4d3f-a897-4f33c8abcab6", "comment": "Malware payload", "value": "d57b156cc5c6e0dc020b08d81bb5f6cfd34190cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726002, "uuid": "543abee4-fc57-4678-a119-b04fa6b0fbb0", "comment": "Malware payload", "value": "9c0573ada234b4ace2434a08fa2b655c22e0f193b3b4f9bd99a148cafa8b3251cb51516b8b2eb601a555275f7cf1ab51", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726002, "uuid": "6ebae823-7571-4ae5-9c33-24b84aac6d79", "value": "T14BB34A57B2BA10BBE1768338C4674A45D7B2B8414761AFEF43A0429A1F277E08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726002, "uuid": "966f5379-96d5-4b66-88ff-ea04032393f9", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726002, "uuid": "9189dee4-a3f1-416a-b5ab-41c25ebf42e3", "value": "3072:cpZR96uepIniy8oKt6VQezDZ4Cc1x5qV+K2aK:SRMvZy1Kxdmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726002, "uuid": "208ac87e-410b-4193-ada5-c11e0dd3ec92", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726002, "uuid": "10ffc218-9176-4a88-b3db-a4a33be64be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726002, "uuid": "13e7120f-798c-4afc-86f4-ffcaf3bb807f", "value": "7fd36bb8a300025b7f2a19c1ba3717de1f4528c943847af1f45d96d05421bc71_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5651d0de-3c71-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776659290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659290, "uuid": "cc672dec-b7e0-47a0-9a34-41e0893414a6", "comment": "Malware payload (RemcosRAT)", "value": "36705f5fa8cccd997391e477cc7990d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659290, "uuid": "b0c826d1-16a0-42c1-a6d7-7a94762d906e", "comment": "Malware payload (RemcosRAT)", "value": "7fed823191f3c1381f63d43e74dee66f451c6cc6bcb1cf753996e13aaec7921d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659290, "uuid": "963b41ff-93e3-4543-89a8-d28b22a733b1", "comment": "Malware payload (RemcosRAT)", "value": "7159d789e8ea55089037cbd488cf366d86b482c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659290, "uuid": "dc893071-1c1c-479c-96fc-bfa826133825", "comment": "Malware payload (RemcosRAT)", "value": "f48d49f819def3d705618500ece0c13e34e27f97f0baa826cedf8ab9897d6824ff339ae52615fc0a05c8a0c8d667a49c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659290, "uuid": "37ec7df6-6658-4ff4-ab19-8fbdadba92bc", "value": "T17AC4F1D3FA2090E1E421A7B0CCBDD9F9272B7E299990692933EC7D0F3C31161551BA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659290, "uuid": "6bc0dc81-6adb-44e0-a00c-0296e6be6b5e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659290, "uuid": "3a1f3a6c-c07d-439e-b362-13dcd3dfb3f9", "value": "12288:mX4OKQAFtJBlNqkdgNpiplC4YlW1E+C7nAu87osPlRu:44OkZ5W02+Cr187ocW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776659290, "uuid": "2c0c714d-f9f8-415c-ae4a-bbdbaad0f2d8", "value": 585222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776659290, "uuid": "5a3b3745-48d3-4086-9701-26c109fc7e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659290, "uuid": "0473567b-f358-4863-ac5a-1b775b8d1a4b", "value": "EuropeasiaRequest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86405ef7-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725513, "uuid": "17170406-2883-4435-8176-75ed7cf35bd1", "comment": "Malware payload", "value": "39d55c5e9556dcf5b10a5707dfe2e254", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725513, "uuid": "c82dc8fb-cc70-4746-91d4-95ece4aab87d", "comment": "Malware payload", "value": "81acb18dac894589357d3e695825745b677aba5e9b848a9b21328457fdc5068a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725513, "uuid": "32ee6aa8-d6dc-4adc-9f75-cbba46966f2e", "comment": "Malware payload", "value": "5f1408609630277da0b180120d9342717bd38f9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725513, "uuid": "9112e707-3387-4ad6-a926-8fb94ffc2147", "comment": "Malware payload", "value": "1cb067a47fe262716f3ccc2ee22952bc2e79c23dfbb545488ac50fe906cdc4ecd8c2849c44f299e1903eea5f110edc89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725513, "uuid": "2446332a-b614-41e6-bfc6-dbe121cefef1", "value": "T186A34A5B77A900BBE1B79678C8570E45D772F81207619FEF03A0425A2F637E18D3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725513, "uuid": "ba3386b3-ecfd-45af-ac17-1bc0508dce5e", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725513, "uuid": "b18c31a1-91db-4855-8f6d-0a586101ed8c", "value": "3072:s27g/i4qfIsxGZJQbQAet9/4+0PpQjOAwv:U/afIa0MQAetFwMhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725513, "uuid": "65436e19-add5-42d9-9be0-a12cbac532f8", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725513, "uuid": "2defaebf-ceb0-46b3-aa28-d047170fcef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725513, "uuid": "0b2764d2-c44e-4e2f-8eac-7f6ff9184378", "value": "81acb18dac894589357d3e695825745b677aba5e9b848a9b21328457fdc5068a_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d501c54-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725310, "uuid": "af99f774-a2be-4924-9720-67644291521d", "comment": "Malware payload", "value": "f7209e0cb142664f56252bb99a433a0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725310, "uuid": "517198cd-a821-41bf-bc80-33a08d108c2e", "comment": "Malware payload", "value": "81d6b5c965dd3f4885502d41e1185b34241b01e3f9d0fb91b4b690afdc1795a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725310, "uuid": "a62078a9-fb3e-4637-9841-2438a9bb9a3c", "comment": "Malware payload", "value": "f7eb73fe9511fcefb1fa01e28b57b5f0bd1c4697", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725310, "uuid": "e8d93d76-aec4-478d-b279-b25efca01ace", "comment": "Malware payload", "value": "73170213a14c70bfea97c2ccb793ec1a9ff71c5db04324a5a45a953519a2f2dcbc6c17f1445e28aaae768170aa21b2c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725310, "uuid": "de2c418e-2609-40a0-8a19-ac46a9bc9eb9", "value": "T10AB34A57B2BA50BBE1778378C4670A45EB72B8414761AFEF43A0465A1F233E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725310, "uuid": "e9b70cce-a3f9-41a7-9f11-48e4b92241e1", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725310, "uuid": "bdaef9bf-2168-4696-98b6-ef36ceb414d8", "value": "3072:6TXxQHNopvHzzSg6cVQezDZ4C/x5qV6OkK:wxA6VzXFKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725310, "uuid": "b9df03a7-f575-466c-9685-dc8ac827c313", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725310, "uuid": "f9a69ba8-92d1-4741-bf19-9ff729b4c603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725310, "uuid": "a464aee4-9d2d-4c7d-9882-28139f01e688", "value": "81d6b5c965dd3f4885502d41e1185b34241b01e3f9d0fb91b4b690afdc1795a5_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7d30d7-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727132, "uuid": "3403e61c-482e-4ed6-89c6-6d0c47adfa28", "comment": "Malware payload (Mirai)", "value": "ff4dafe5b3a332f50243b37bbd52edcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727132, "uuid": "07e93631-13ef-4dc1-bd36-e6ed3dac4dd6", "comment": "Malware payload (Mirai)", "value": "81f8293123720203f21d650bdc89f77d4ec85c2e6cff4702fd0f75f8ae890bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727132, "uuid": "904a07bd-8ff8-45fc-876e-7dfca724f650", "comment": "Malware payload (Mirai)", "value": "80c4b2cfe4b6776182d21e07fc48002ae4fb87b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727132, "uuid": "c81b42e2-f62a-4bd5-9ea6-8e047510a6fd", "comment": "Malware payload (Mirai)", "value": "6044af78c8746961ada515aa222d98af20c69213a5cb22495a4bc6b2bc2a4ca65a583ab0bfbc69b1fec660590f2f6f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727132, "uuid": "895b4809-a142-415a-beb9-94d5c58806fc", "value": "T182634BCAF983D5B6F8970930107AEF639DB3D6BE21A8DA43C3A455369D12502F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727132, "uuid": "b9c2f082-8485-4ad9-9c63-5c479f82f5a7", "value": "1536:TtWvgqAcQQsTb6vF7lOvZOWsIyq3XkZSQ5:TtDqAasn6NJOvwfIyq85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727132, "uuid": "8a836c6c-2e23-4b26-8844-af0b36407d45", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727132, "uuid": "3fa89898-0442-4f02-9e9d-1a00bf07fca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727132, "uuid": "70864d30-7f93-4804-83d7-cc42f488ee2a", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b00ac0-3d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776726500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726500, "uuid": "24f8c6be-61a5-4a44-8d55-1d74840d53ca", "comment": "Malware payload (Smoke Loader)", "value": "f6f314a4fde16757e916a6826bf50f5d", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726500, "uuid": "62e60c40-13d4-479f-9a2e-d3f1f31d9853", "comment": "Malware payload (Smoke Loader)", "value": "825767047df77277e94c6114bfaaac9bb3b45cd850a733800cdd8f9544f5201e", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726500, "uuid": "8db42a24-6915-440e-b0b6-89db9e0aeb50", "comment": "Malware payload (Smoke Loader)", "value": "4011852e60935eb5c8a5ad13fa0add03510c286c", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726500, "uuid": "76d9b2d5-4780-47f4-8ef2-af5d164e16df", "comment": "Malware payload (Smoke Loader)", "value": "6c4dab1682df689e8ebe5389d84f08bc3af265cc4b4cd16298292b0a71e8e299f3f0de5e5012e27c2d8f28aa60af989d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726500, "uuid": "3f9451af-a466-42b4-bfd6-d3565bc0b30b", "value": "T1C9755B1BBC9144F6D0AA933388B76192BBB1B8080B3233D72E50A6793F767D46D75718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726500, "uuid": "77c18bee-c79a-437b-9dd0-4ae785b8dde0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726500, "uuid": "761af872-12a7-46c6-acd2-9b732c0cbcee", "value": "24576:/pDAzxZbsAyhEqIT9zFBZpS7riAw3spJ2QWQXbFhele5n923qixeKb0:/ps1ZhyhlkzjZpewsBXcHF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726500, "uuid": "a2103b19-4538-4bf4-b6b2-36ab4c2a2341", "value": 1670272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726500, "uuid": "118c1bce-1879-432f-9d79-703fa7a71283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726500, "uuid": "aec4d2a6-1b74-46bf-ab69-a0a03f1cf6f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1b977d-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688186, "uuid": "0dc9759f-63be-492d-a2ac-34370393ad49", "comment": "Malware payload (ACRStealer)", "value": "ebb595ebdd841514c5e606136903076a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688186, "uuid": "ac9ba3cc-330d-4b5f-b014-d1185add6242", "comment": "Malware payload (ACRStealer)", "value": "83393716b3b23f4fd16d2d81e495f745d3a4955f07869bcfbc5f915f64648f74", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688186, "uuid": "deb54121-d5ca-4edc-9f46-4ca7263fc582", "comment": "Malware payload (ACRStealer)", "value": "2727ff196a936d49634fb2e9ece3cc0dfd906cb4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688186, "uuid": "a3ba406c-a315-462e-b34c-6a4f2bfc82ca", "comment": "Malware payload (ACRStealer)", "value": "3e9119bc06f9f69b88b103092ea2652a319aafd195c01d3a77ff0fc31c05cad459509400d8b6703d84f7f1eb1f61bd92", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688186, "uuid": "9758c920-348c-4576-ba81-575049fe4178", "value": "T132169E2BFCB95C69C099F13084777615F665B8045B2267C71AB1B6642F3B3F08BBAB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688186, "uuid": "679ff59c-49ce-4a71-84f7-1244b7c70958", "value": "6d845490038d23af2c2605bb56159c73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688186, "uuid": "9a34a1de-151a-42b6-8ccf-57ddfd8ea803", "value": "49152:P71rFoNeDEaEKKomLww2LxyzTZthbyFUBUmjSQcQdGGZqMn:P71wG8UqBUUzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688186, "uuid": "c613dcbf-7666-4954-aea7-ee65a571607c", "value": 4326928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688186, "uuid": "56f84a5b-9206-466e-ab6f-93ec6a7386c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688186, "uuid": "501a72e0-b284-4627-aba7-123cac8899d9", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03462c4d-3d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776726152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726152, "uuid": "2bb0cc31-55cc-44ef-aee4-fdf4bb80e410", "comment": "Malware payload (AsyncRAT)", "value": "669d03f9d88272fe852903f4512ef0c3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726152, "uuid": "b788f8bd-c100-4b5f-a8e4-feffa705be83", "comment": "Malware payload (AsyncRAT)", "value": "8339d057c0369f28b6c71fff740206a8a2b8eca170b8e673dfecf2a782ee50a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726152, "uuid": "cdf316ac-37e7-48ce-bc57-5c71199474ed", "comment": "Malware payload (AsyncRAT)", "value": "4f038ead1be546dff055fef9f51cfba050ccb9e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726152, "uuid": "7a1bde62-9b5b-429f-887f-efd24445aabf", "comment": "Malware payload (AsyncRAT)", "value": "c83cda26b0d662cd1abd9d3df61ffe96c5e7285e9390303fb73fa91c9404f70ac2f14d4a02ff586dc32780e723b6d532", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726152, "uuid": "7067e96f-ebaa-4a30-9aba-21e92539dfce", "value": "T1B3B4AD2EEAE0CF01DA5C1D30DEAB512447B2A5863E73F79E1B9811552D032F1A91E3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726152, "uuid": "b73a8739-ce04-48f8-814c-05280abcfbab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726152, "uuid": "cca3c865-3e0c-4fea-91a4-0983f65bd3e5", "value": "12288:dd3+fStokp+2XrbndTCdwo4cF4LZT6N3istI0vs8:dp+fSt7fXew8r3Pi0U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726152, "uuid": "9d784e82-6cd9-4103-9f85-51286c7e8dc8", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726152, "uuid": "6c599f64-ac8b-4ab6-b569-e7d4b82a8e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726152, "uuid": "5c8d09c7-9f56-43d4-adf7-8bf993c8182b", "value": "8339d057c0369f28b6c71fff740206a8a2b8eca170b8e673dfecf2a782ee50a4_843d37f6-ffcb-406e-9c84-e9208667aa6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96c8641-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725196, "uuid": "5efd3c07-1bb8-4656-85e7-31b6d5fcae81", "comment": "Malware payload", "value": "1e2c36751ac2e4c8551c9b5324a7f79d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725196, "uuid": "8876fadc-9ee3-426d-89b9-4146fd5b9eac", "comment": "Malware payload", "value": "841b4476fee6d2401fba240903b35826ebc178593d4d0684ec5eba40c0fa3a59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725196, "uuid": "925ba698-7ebe-453d-845f-71d7850262ce", "comment": "Malware payload", "value": "cf1c46664b6c1672dca181389c14a6d6a319236c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725196, "uuid": "c3439630-169e-4a7f-b8f3-d3452e9d5e24", "comment": "Malware payload", "value": "c1211d4fae07240c334aea3a946eb8e6c84ba85f28268fa138e0e4780b1b721667b1f76c1e29791161d17a3a5efc116f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725196, "uuid": "6a31f88c-4aa1-49e6-bdb5-e95a8130ec90", "value": "T18AA3495BB2BA00BBE1B68638C4570A45D776B8454761AFEF43A0426A1F233E18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725196, "uuid": "58f8daf4-fa5f-43be-9722-0be9098ad8bb", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725196, "uuid": "75fb4017-969f-491e-ab86-9a3a3ee8fd05", "value": "3072:BUvNPzHPB/+WGPlQb6Ab7y31oyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHPvGv:BaHZ/LWM6Ab7kVLHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725196, "uuid": "15edecf3-0a01-4425-ba22-5c01a98e1683", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725196, "uuid": "46b7eeb9-d5cb-43c9-a5c0-d92daaa16af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725196, "uuid": "b5ef94c5-0046-4007-ba07-b4b18f3091d2", "value": "841b4476fee6d2401fba240903b35826ebc178593d4d0684ec5eba40c0fa3a59_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e3d9c0-3c6f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776658537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776658537, "uuid": "572222cf-2b1f-47d1-bd1d-779a78dec920", "comment": "Malware payload (njrat)", "value": "db9a40e057568ef93a97430e78a3ffaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776658537, "uuid": "1602bb0b-83a8-4202-8eb0-1b84102551be", "comment": "Malware payload (njrat)", "value": "843d298766809f7f6adf022be89743a1b3511bec81e4a139bdd742fbd7dfd3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776658537, "uuid": "a2684658-2f97-40b1-8c97-1c4d6ec6aa64", "comment": "Malware payload (njrat)", "value": "1789fc9125905e1cc14a021208455a491d291ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776658537, "uuid": "aee2adf9-52e1-461a-906d-c45b6a579534", "comment": "Malware payload (njrat)", "value": "7e2ab83b76208f97c8246ab6b723b60bab005fabcced2af01ed824497112422ea7722743735d15c52316336427950d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776658537, "uuid": "2f035086-9005-46a1-9a13-91314a26cb82", "value": "T1D7F23B4D73648A63C6BE47B84D71850247F1C5474527EFAE8EC450DA2EA7BE81E00EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776658537, "uuid": "8b0a5e26-16ba-4f47-8f92-20cb64b54e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776658537, "uuid": "73dac288-5484-4af3-937d-1972a607383c", "value": "768:NkwdhzCwnp/Yawbfw0T4B0w3ccrfLMCrGqsgy:9tpwVUo4B0w3cafACrygy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776658537, "uuid": "602601e1-3a51-4f4b-a50f-0436f2422417", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776658537, "uuid": "81227931-f735-44d0-aed8-9d4663fad9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776658537, "uuid": "813cc943-4460-4e93-849e-3720dd2d52d1", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe9254c-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725126, "uuid": "f021ad9f-2d38-498c-8af2-c87872891e9b", "comment": "Malware payload", "value": "740052840c102762f39add31dd73322d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725126, "uuid": "9dd380f0-f607-4c22-81cc-705d6dc8c330", "comment": "Malware payload", "value": "849f0e52323dd332d70cd043aab270a4056015526a35de082f0cd93f30e55ac8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725126, "uuid": "33e7fc2e-bf36-4ca4-94f8-c20cff570cdd", "comment": "Malware payload", "value": "f8632f187537711169e0ea1a63ce54794115f5bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725126, "uuid": "63aa8eec-eff3-4ec6-96b8-9189050b11df", "comment": "Malware payload", "value": "108bbb9646471a5d96c729c74e55544fb4a62c23175cb9b5bb2491b50c128048357dc747d4dd1b5efd361883ee9da75c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725126, "uuid": "554fab60-85f1-43aa-ae66-b750a8568b03", "value": "T109A34B5BB2B600BBE1B68638C8570A45D776B8454B61AFEF43A0425A1F233E18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725126, "uuid": "33c5297b-aefc-402f-bdcc-2ab8406aec72", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725126, "uuid": "e41c1dc4-28c0-4220-a992-2235064c8d1c", "value": "3072:cvVoDF3zO2GuzQbhASjTiFZ4Cv2GWwD80p5wCDvmXT7RLyzfWC7PlC/HZkWEsFUr:cODFzLNMhASj2PIFQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725126, "uuid": "5f7bf392-13e4-4fae-86ae-cf634988d900", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725126, "uuid": "89aeb6b2-6a6e-4d5e-b1b6-f2e8d4b97789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725126, "uuid": "cf4dde22-d671-44bb-bb8f-8e3f9ee2eccf", "value": "849f0e52323dd332d70cd043aab270a4056015526a35de082f0cd93f30e55ac8_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f34caaf-3c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776647359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647359, "uuid": "c698dfeb-62ef-4082-a87a-d9c75d604b4c", "comment": "Malware payload (Joker)", "value": "d97e00c17d1e6f750366c69555d2166b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647359, "uuid": "06ce1983-b3c7-4b7a-927f-22e5c0e86aa3", "comment": "Malware payload (Joker)", "value": "8584b2e6eef70b24e504421c0a2adca0d2a065dd63ad30ba84ee50f92d1c82ce", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647359, "uuid": "52b41502-9e24-4619-825b-b2142eca5165", "comment": "Malware payload (Joker)", "value": "e439e17a04c66a836faa7aac46277ec391be8b4d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647359, "uuid": "9324ffcc-8400-4a67-b9fc-1a89f774ea8d", "comment": "Malware payload (Joker)", "value": "b2b56d55d654babfbaf53e21e89f0689daec4f4c708c08e3bad2de6dcf1a7859b295d7bbc092ccf9ad5ca9ae61cb5283", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647359, "uuid": "1fbeaf7e-b259-4e96-a4b1-0038e5fee486", "value": "T160B7D04AE10CD932D8CEB17CFE6E0A817224591D86D6C467781D9228FFDB2F445B3B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647359, "uuid": "d830e642-6bd1-4216-aff8-e359b80e9b9b", "value": "786432:q8fv3/XwbF+VPcK7PxzCYf+6rWZhwVv8sdjCnlt+n:x/Xwx+715f+6rWZhwJ8sdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776647359, "uuid": "38c87a69-ee79-4edc-a65f-d1266a11e398", "value": 49487314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776647359, "uuid": "d5040955-cf1e-4200-aa81-2a90e1c46863", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647359, "uuid": "e034ab17-bc4e-4d12-9ed0-acabf3629646", "value": "Smart+SmS+Messages_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d7d55-3c77-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776662151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662151, "uuid": "210ac92c-b898-4bb5-9836-5d3f065d56eb", "comment": "Malware payload (NanoCore)", "value": "8318557732f72d50fb007bd79e2cd6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662151, "uuid": "1c3d4a85-140a-431a-b645-8cc05e6022b9", "comment": "Malware payload (NanoCore)", "value": "858787b627c6e7dec417e1082c6776f0f028930a5482e35fd7f2e3fd6ae9cc5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662151, "uuid": "d144df11-a629-4aa5-9d12-a93078bf004a", "comment": "Malware payload (NanoCore)", "value": "c469d12b210576ae4ac18a93dcd28296be633db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662151, "uuid": "008c31da-5f8f-4166-b7a2-7664d8ef6344", "comment": "Malware payload (NanoCore)", "value": "af1647690bee2426565aab9a6613a5950c6e412831491a06f41f3a5d766a378f08eecb87adfac0328a539219ed8ddf78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662151, "uuid": "f4426b3b-fdd2-44c0-b70f-4ea9e6717d7f", "value": "T18D64BE1137A8B52ED29D86796302617243348AD29CC3F3DA24C876FB7A7EAE105771D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662151, "uuid": "087ad111-dbce-4b65-903a-b00770ab6440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662151, "uuid": "79c02a5f-cf81-4b2d-a1d6-7dae13bfb9ce", "value": "3072:2zEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIYWD/zhzRWEV9UWlv38SAF:2LV6Bta6dtJmakIM5m/FAyUWlv3PAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662151, "uuid": "1aaa2e02-b1c5-49e2-bb6e-ed941511252e", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662151, "uuid": "15bed3c3-093d-4e28-a589-2f747f6eea37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662151, "uuid": "2c7a1c9f-9b2e-488f-86d3-838607983a56", "value": "progressivetechworld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d0e10a-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727262, "uuid": "ce352df6-b5ac-4619-a106-f0e70e0193ea", "comment": "Malware payload (Mirai)", "value": "43c63d3559f89e0786eff7db42f1de20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727262, "uuid": "67bf0b3e-7260-4d37-bdf6-7596bc897b46", "comment": "Malware payload (Mirai)", "value": "85b7ffb85399ff78e492973c4efc75cea6dcbd8840eca3c5ce5281b2a28ed309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727262, "uuid": "68d83e89-32cd-4455-ad68-8c157f4e5059", "comment": "Malware payload (Mirai)", "value": "ed6c9603058bc950e6b090e3597e9efc32238ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727262, "uuid": "1d87f656-ccc6-46e6-af37-ded9df7cd4c0", "comment": "Malware payload (Mirai)", "value": "020d6441d5bfbceb70240506a8d2db8bf1104450431c8a3f9d60277a104478e764b5227143a617f128fd2b90fadc0ddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727262, "uuid": "18e0e4ea-a5ca-4e63-996b-d87d9dc34f04", "value": "T132A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727262, "uuid": "2c829f2b-8eb7-4c52-bb23-101d2957ec54", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7qdr:J0DOpPRWu8ERZ+0u8vjhhqdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727262, "uuid": "cbf27af3-b510-49b0-9c9a-0bad8b1c06c8", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727262, "uuid": "00c948e4-086b-4ee6-955d-18c954410d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727262, "uuid": "df6be2ff-39e1-44ea-99a5-057dd827e793", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982d4ba1-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725113, "uuid": "7d58e6b9-e1b2-42d3-a0d5-c39ed0017fa6", "comment": "Malware payload", "value": "e3b811e19e1590575f9d99ddbaa733bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725113, "uuid": "6e193428-2297-4030-a87f-d4d361f1f641", "comment": "Malware payload", "value": "86029fc5a7f681c2d2f9515e1eee2e0b98febf43f60b52fe8873c86b645ccf07", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725113, "uuid": "96401a7d-a806-44e6-9974-928f3e04bc81", "comment": "Malware payload", "value": "467f7d18f6947bbbda71384212cf30f9aa1479b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725113, "uuid": "5fb32e11-b5bb-472c-9b87-5de099809f1a", "comment": "Malware payload", "value": "cfb38c6892e3c6fa022d24587f3b79eaa352bca1dcec416435333cb499ea537df962922a3ac407576b9e936f812a3572", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725113, "uuid": "76f730d2-6b21-498e-bcf1-5d1a5227b3ba", "value": "T14CB35A47A2E500BBE1779239C9670A46DBB2B8115760AFEF03A4464A5F237D28D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725113, "uuid": "01bdf053-ceb9-4eec-a64f-696a3fcbaaec", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725113, "uuid": "3f2655e9-438c-44c7-9d8c-a6ef194681b0", "value": "3072:swvz68dA1Fd4Yu46T/MlxmNkV7PLf5AB:1zVwy46rp475M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725113, "uuid": "cd65f7b8-01ef-4522-beb7-a202567bd3c3", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725113, "uuid": "384ceef4-619c-4f3b-8fab-2f9cc3c6c785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725113, "uuid": "7f015cbf-395c-4839-a726-36ee5c42c3cb", "value": "86029fc5a7f681c2d2f9515e1eee2e0b98febf43f60b52fe8873c86b645ccf07_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4c9099-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724852, "uuid": "07d69979-be0c-424f-80e1-b9ca2dc13e85", "comment": "Malware payload", "value": "841d7343e00f6692d8adfe1707dc89e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724852, "uuid": "bbd9775f-ebb9-4a33-af37-86f94becc5f4", "comment": "Malware payload", "value": "86430ead4a692bcb3619729db1009021c6cc267fe62883799ec2e1ff4ce37d88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724852, "uuid": "5cc346ef-dd2e-4ea5-affb-f03f9b6a3a49", "comment": "Malware payload", "value": "03d3d1edb5025b9422ef8adf47b5f83e641dbc63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724852, "uuid": "b767a4a9-0721-49ae-ad3b-df60c9523726", "comment": "Malware payload", "value": "d58150f83ee04d9de337d3dfb8a85f81cc211810572252334969a5d69f7edbcf0a9c3890a43fb4ed85eae914c58b8286", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724852, "uuid": "fe85543e-e25a-4f06-af72-1d6ca08e6166", "value": "T163B36A5772B900BBE5778638C4A74A09E772B8514760AFEF03A4869A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724852, "uuid": "255ffef8-0eaa-4ec5-bbca-5835c2a4a247", "value": "9e55e729fb60b8131c3d92b149585901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724852, "uuid": "e8771083-15d5-43e8-ab5f-5369d9b0fb54", "value": "3072:msj//LdmNH9hp5PZFJ94teUx6PvquTnC3yu:3Ld0HXbJ94qRLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724852, "uuid": "467aa056-0282-49e5-8c7b-8b9358dd6423", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724852, "uuid": "3d5f72aa-3f24-41f0-b77e-390f74ea683c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724852, "uuid": "ea73a1b3-ed29-4143-a993-3038160625e7", "value": "86430ead4a692bcb3619729db1009021c6cc267fe62883799ec2e1ff4ce37d88_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e019adb-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725445, "uuid": "367f96c0-4e4c-459d-8c76-4a13343bb074", "comment": "Malware payload (AsyncRAT)", "value": "51f189d205d750ac555b35c04153ab30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725445, "uuid": "a7f089e7-0ab3-491d-a180-eebb2edc3cde", "comment": "Malware payload (AsyncRAT)", "value": "8649b4dc2e8093550c8887ae88bcfb31c034046ecbb9d5318f8f0b6d90382ea6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725445, "uuid": "92f0be9b-bd17-4654-b0bf-0aad3680b49f", "comment": "Malware payload (AsyncRAT)", "value": "445872de19ec5d563a5b1e8e251f13cc9bb472da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725445, "uuid": "bf9117d6-d36c-4f04-8cb4-0a2d0330c351", "comment": "Malware payload (AsyncRAT)", "value": "f9abd9d4501a45f50c90b11727c7f64103884a9385c2c423b1f5ea7e2456930bc6d9f2cc6e06b28c1ca352151d67f70a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725445, "uuid": "ed7a1938-fd79-4660-b67b-31c07bc4631c", "value": "T1B0E24C4877E48312C5FEAFF02DF2B10A5274E11BD923EF5E0CD889962B67AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725445, "uuid": "c0eee477-aca7-4089-a0d7-73d3c30df497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725445, "uuid": "bac8d618-1cc4-4a6a-b599-9d998f0886f6", "value": "384:XpaJuqQYbqjpk972V7/AqBZB1FOmLpM4vh0FbOKTCOQKFRApkFTBLTAOZwpGd2vx:E16zY0FPC4vGFbO75KFVFo9jtOjhUbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725445, "uuid": "1f87cb36-e3ab-4631-8c61-d3947e8ad2cd", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725445, "uuid": "59d8bfb6-17d0-4dd7-9393-cce5de7a71e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725445, "uuid": "49e352a6-3909-4675-bffa-e87ca816e172", "value": "8649b4dc2e8093550c8887ae88bcfb31c034046ecbb9d5318f8f0b6d90382ea6_cbdd6ff7-54ae-4a61-b4f9-8bf244e7c9de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1179c6a-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726068, "uuid": "2f1f1995-c493-43c2-89df-3da4f1583a94", "comment": "Malware payload", "value": "819b3ae0be7eb52c00542d8970e976ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726068, "uuid": "c4961748-0d27-444f-86f3-23f0b3595feb", "comment": "Malware payload", "value": "86df162cc93277e058356e566ba9e03266893c80c24bf647a27389348b68ab71", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726068, "uuid": "c112a369-977d-4707-80a1-25be3a01d7b9", "comment": "Malware payload", "value": "2f481d5e55186ce04126ebc471eb967b94565b2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726068, "uuid": "8e9ff04c-9ce3-4dc5-bee3-62c67c04851d", "comment": "Malware payload", "value": "6adedd53d9511c0fe822afcf62e37f4078168e7505983dd6922e0b9498330e16f55d889b8748e423a8a06516d27224f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726068, "uuid": "18a2e554-f94b-4924-81cd-70ee903f1399", "value": "T1E9B3498BA3A500FBE17B8679C9630A46D3B2B85107609FEF07A0461A1F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726068, "uuid": "3de800ce-0756-47f2-81d2-9faf85e37ec7", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726068, "uuid": "d79c0af9-139a-4e7a-a05c-41db6a8dc83d", "value": "3072:Dms3xVQJHpLHQunwH4l1jd2eckVPxIiTKA:zxWRiuwUL2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726068, "uuid": "a9603920-2b4f-49d6-9892-7c075483883b", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726068, "uuid": "e2ea3622-3a61-4c55-b08f-4f35e9824d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726068, "uuid": "938e0d1f-420a-4950-a65a-e219514e4e60", "value": "86df162cc93277e058356e566ba9e03266893c80c24bf647a27389348b68ab71_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63cb7db-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725244, "uuid": "d834b2f4-08e1-4035-af1b-bc5822ea1c91", "comment": "Malware payload", "value": "1c38f7abf65f19221e9f8b1bd345e6bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725244, "uuid": "bea21101-6a45-4dfe-a2ea-a232c9b7acc0", "comment": "Malware payload", "value": "86e9024c21478f7fa59bf95aef8e7bfb869ed872e8a92e7ca19118df0f74f457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725244, "uuid": "c2d60f00-3db2-438b-9fcf-5986e77d3b58", "comment": "Malware payload", "value": "d81b50362c2255c0ac46f3ea894b0f2802372a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725244, "uuid": "dea458c5-7bb7-4d30-8e28-eec2db8721df", "comment": "Malware payload", "value": "4179b319612220db7b80959391d5176bc53ea685996d0a7519b8b6b1e9f3166c5c5a467e18fd0dae351aabdc8a8819ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725244, "uuid": "bcdb7403-b277-4c2b-b2b1-d7e7e6d034b3", "value": "T18D81850163E8452BE0B747702EF383156375FA524E76C79F7E88215EAD21340AD62BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725244, "uuid": "7a8d2581-2aa9-48ed-bccb-c0b6ad2016c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725244, "uuid": "a41ef671-63c8-4d37-820d-278c7e31b26b", "value": "48:6bITXTyN2yto/vweJtJRZwQ0dCAr9uulPVoqXSfbNtmF:M+I2yWgGj0dCAP9VAzNt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725244, "uuid": "53ead9c1-6456-4b6a-8b71-a4594d2bbdc3", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725244, "uuid": "6079efe6-c000-4e95-9afc-82581f89a3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725244, "uuid": "128a0e11-77d5-41d5-93c1-8846b22da5c8", "value": "86e9024c21478f7fa59bf95aef8e7bfb869ed872e8a92e7ca19118df0f74f457_de4e5923-9a56-4152-ae14-b9477869f2d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ead97e-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725380, "uuid": "b96e865f-245b-44dc-9c86-8219bb78953d", "comment": "Malware payload", "value": "074c70701966e2e4cc8d9fd79a6644b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725380, "uuid": "80713059-c336-4838-b308-887ec4f9c40f", "comment": "Malware payload", "value": "86fda26d8d7611e301b92bf403ed7bb9ae1cf6d4cdf282402123417d6d2df383", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725380, "uuid": "21304568-cb3a-44c3-930f-3c99543681ec", "comment": "Malware payload", "value": "6ac63e748bf6ec15fb629280f4a1e096f03bc00c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725380, "uuid": "1610a3c2-8215-4a6a-a66e-b91caa1fc926", "comment": "Malware payload", "value": "b65fca0f12b1a78ee320c35c13bc53f7a99cb980b43c0e93d6836d7cae61a56578667854a0d351f34faac0de1cb19c7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725380, "uuid": "e8c9c27a-8fbe-4638-abcc-c8f7395c02f9", "value": "T1E8B35A4BB3A500BBE1B78679C5630A4AE7B2B85117609FEF07A0461A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725380, "uuid": "b6b1b20c-33de-4141-8fe5-17e13b9e8d8a", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725380, "uuid": "ec06632a-e9bf-4927-b5bd-bd11e96a4b11", "value": "3072:k7J8UHW0N9XprHEuXoNrJxSjjODr1QBy:krWCtuu40eD2By", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725380, "uuid": "3448f343-8432-453a-a9fb-d919c9040fc5", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725380, "uuid": "032c21fa-0c2b-4445-891c-3ed8d965062c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725380, "uuid": "fa966ef8-65e0-4b8a-b89a-ef4b7e498621", "value": "86fda26d8d7611e301b92bf403ed7bb9ae1cf6d4cdf282402123417d6d2df383_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba25dec0-3cb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776686516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686516, "uuid": "4496d4a9-6e07-4236-9d55-e018ec1cb941", "comment": "Malware payload (Mirai)", "value": "df13ba1f90ac3e77e1890631bd2196b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686516, "uuid": "51ce6eeb-45fb-4452-aa02-f9cd23f75738", "comment": "Malware payload (Mirai)", "value": "8745bf04defd3055449c1f8ede1267a669b62aa814d5b0074ecf23f997cb88df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686516, "uuid": "fca74c28-1fc4-45b4-8a05-1d3904b9168a", "comment": "Malware payload (Mirai)", "value": "8555e5755fb8f8944ecc654f507e3fb1bc12379f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686516, "uuid": "f54351d7-3976-46a0-87f5-31d2bcca3922", "comment": "Malware payload (Mirai)", "value": "99064abe22554006ec6080b0340adf8401139682aacee042dcccd25eaef630ed102e480518d98e7d15544773c7dcc3bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686516, "uuid": "30792c86-eed8-45bd-b022-ddac666810e6", "value": "T1E3430282A70D1566E6A028BCFE3B0C413F42D675CDDFB86057364F78D4868DB0DA09BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686516, "uuid": "527bbba5-ce49-4dbb-b5ab-8aadd29b6458", "value": "1536:/er6i6if6GBwmC6iPK2t/qJ7ThRX8vc1C:/ejrv3aB/aHhl8vc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686516, "uuid": "452d650d-5c2c-493d-b413-5fb5163f0ba1", "value": 58596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686516, "uuid": "fac01c2c-412c-4148-94d3-90a4c96bf36a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686516, "uuid": "909299f4-0341-4547-9252-533c6d1e6d16", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b467beb7-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726020, "uuid": "5e980aec-deba-4c54-b7c8-9db976fb02f9", "comment": "Malware payload", "value": "7da8a12c378d0d274646017b4e4306ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726020, "uuid": "baf311d6-295b-486e-969e-128cacae390e", "comment": "Malware payload", "value": "87b4a42cdd6bf6d4a97e744dd67afef6f35b7ce7355ce8bd00b94613d67a8839", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726020, "uuid": "b12c818b-d15d-4883-85c6-3a2e1b14819e", "comment": "Malware payload", "value": "e07771baa0b64ddf631c427014fbcbeb2e50bd72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726020, "uuid": "2ba5f5c3-c3ed-4206-978b-ff5eeeccca40", "comment": "Malware payload", "value": "8ee301578cc5f158c91904b2f9c83e1d18e5f163bfd64124620975ee61527a9f6ff2e1fe668b9cc721316d99eae25a5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726020, "uuid": "32fcece6-343c-44ec-b51b-3b68d5674cb4", "value": "T19DA34A5B72EA40BBE1B68638C4630A09D772B8560761AFEF43A4425E1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726020, "uuid": "147e7575-7da8-4301-84b2-bd3033b79655", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726020, "uuid": "344a6fe4-8f07-4392-9960-14d2184bd9f4", "value": "3072:7td4yN6xpAqJQVAvfhxtvrB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51pym:hdJkTB4Anh/KXLoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726020, "uuid": "0708dca3-7783-464c-97b6-42d3c57899b9", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726020, "uuid": "e95db33d-a7f9-403c-9114-f60c68e7c605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726020, "uuid": "61202482-df50-4718-9536-8e078569ecd5", "value": "87b4a42cdd6bf6d4a97e744dd67afef6f35b7ce7355ce8bd00b94613d67a8839_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde1b9ba-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725203, "uuid": "d8c4d30f-caf9-4e22-a7c4-8c9817034dbe", "comment": "Malware payload", "value": "be734562c5bf6442f0c0889aadbefbf2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725203, "uuid": "cd20d037-d312-4ed3-934b-3fdbe1a25c31", "comment": "Malware payload", "value": "882330c1071cea15ce2d3525a75cadc8295c236b72826fe919fb777d8965e29c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725203, "uuid": "0a62eba8-fab0-4767-b81a-61a82c0ea153", "comment": "Malware payload", "value": "a170acc0ed5bb4e0a604b2874bd733a43a61b668", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725203, "uuid": "4a87bef0-aa60-47d2-933f-0358c6a40032", "comment": "Malware payload", "value": "0ab29cb94c5d7262749e923141e771629eef535d99784b43e6b1d69bd24ad9765bdc02233d78fcd6ad748e76cea7b1c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725203, "uuid": "d548b504-1dec-4956-b333-0f642d5d2975", "value": "T1B3A34A4B62EA40BBE2B78678C5534A49D7B6B85147209FFF03A4465A1F233D08D3DF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725203, "uuid": "a4ba7182-cb26-425e-8174-82493a32ff14", "value": "89a97c0efa41b17c5ccb77f897c17c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725203, "uuid": "e869741f-09bb-47d5-8752-17b21d94ff58", "value": "3072:KKSc8y29cpGP7QbQwqaYklAtpFrpqpqpvfkTinnQz:Kq8j9isMQwqaBpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725203, "uuid": "330e20a1-599b-461c-9611-5c017c2f7dc7", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725203, "uuid": "2bcb4d24-f3de-4ca6-8dd6-bbae90d5148e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725203, "uuid": "a4797f23-54e3-4dd2-aba9-0a186196f9ca", "value": "882330c1071cea15ce2d3525a75cadc8295c236b72826fe919fb777d8965e29c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d40ec91-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725981, "uuid": "c5bece50-3c2f-4dbd-b418-a694757da9c2", "comment": "Malware payload", "value": "99e4cb3740cc6efd3adeddd6bce27b1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725981, "uuid": "8a15cd75-8c5d-4a66-9fca-838386a345b7", "comment": "Malware payload", "value": "884118224c1aedfdf502c337c92c4ee63c87aaaf09d4f4d30800c6df66baf2fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725981, "uuid": "f325d3e1-61e6-41a7-926d-9e1afcaf13c0", "comment": "Malware payload", "value": "bff3929a425f2869ed099754be587a567e409db5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725981, "uuid": "9d2241ba-3c21-429b-929e-887dc69c8eb8", "comment": "Malware payload", "value": "8bb22d7d0b051d6641dd2e982a2ef8d128d99340f0fd14e248ecc73a89bc14673297ff7b18734993ccb0c482fd4783b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725981, "uuid": "d3bfad37-2659-4bac-8755-b11db81d344d", "value": "T15EA34A5BB2B600BBE1B68338C4570A45E776B8554761AFEF43A0425A2F233E19D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725981, "uuid": "ecc9a833-fa8d-4a0c-b921-4d9c37ca86b5", "value": "0fd9902150a10ebdcba803b76e55f48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725981, "uuid": "d9a9b815-e9bb-4ade-ba45-f95f26077067", "value": "3072:L+MwulKXezak9QbNOkzviKtDAOjzJoyfm2GgzskZpgyzfWHRzT9aiD8RB2x:dAXIMNOkzvhtCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725981, "uuid": "9ea9ec19-32db-4e74-921f-0ee7b90463af", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725981, "uuid": "5e9e90fc-5a06-4019-8f15-c4979f7f2655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725981, "uuid": "d7ffb323-1c2d-437e-bb0f-284a3fa81ba8", "value": "884118224c1aedfdf502c337c92c4ee63c87aaaf09d4f4d30800c6df66baf2fc_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06114bee-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724868, "uuid": "82f44a97-9e36-49fa-a092-62eb2a5e594c", "comment": "Malware payload", "value": "293189b67f4cd6b73bf41db4165a1666", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724868, "uuid": "7a403df7-1181-4d0d-b129-fc72bb9c228e", "comment": "Malware payload", "value": "88644a0bc935c1245bbac2ea662fb24c3e600460a0adbcdd3f3e9f7e941c1287", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724868, "uuid": "473b67a1-5bb1-488f-8788-8f9df99a8e10", "comment": "Malware payload", "value": "c28162b54840f1ccabce0a5d28dfd7b4f3cbcda3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724868, "uuid": "89287da8-d61f-47dd-960a-5bdf5eb7f43b", "comment": "Malware payload", "value": "85e12eaa3ff254dc05ab4428f8a6bb2aeff52ce9baf2ece529a67b16ac8e35e1cf72629c44e8d2ffbb6ca6cd99a2971c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724868, "uuid": "1267b6e0-39af-42b4-acf0-e8522dc5c746", "value": "T1EEB35B4BB3A500BBE17B8679C5630A4AD7B2B86117609FEF03A0461A1F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724868, "uuid": "d2e0ec00-4374-4198-9add-a9d5a76706da", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724868, "uuid": "fa09b46e-2b2d-46cb-a888-26bde4959294", "value": "1536:FzuUk1TQHWVxYekVYL6rXp/THnS3i2usEUrNdF6JxE+gsWRJdL9dlBODL1QRU+9:IU8UHW0N9XprHEuXoNuJxSjjCDL1Qey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724868, "uuid": "4ed5c10a-3a93-45af-b9e6-41cb6f0bb17d", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724868, "uuid": "135f93af-b457-42dd-8bd3-a2d7089b12a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724868, "uuid": "eb7d8d63-8b24-4f1b-a45b-88cb91fb586d", "value": "88644a0bc935c1245bbac2ea662fb24c3e600460a0adbcdd3f3e9f7e941c1287_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ee94f9-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697511, "uuid": "597b20d8-e1e3-4b8d-ab0b-13f382ad6ed2", "comment": "Malware payload (AgentTesla)", "value": "a8d3c5ecb4a10f3cf9c1704242a1e4a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697511, "uuid": "44de7146-ef36-488f-866d-099381fe1749", "comment": "Malware payload (AgentTesla)", "value": "8870c7b6a9b9d5a96623ccdbd10fbffc8679df5be52d49f52a2f0872cbb0ea97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697511, "uuid": "14d2e81d-1ce1-4076-9739-148e46e64111", "comment": "Malware payload (AgentTesla)", "value": "3671762157e8cbc6c599f218df56945dfc1ac063", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697511, "uuid": "0f6665fa-5e3f-465f-b716-ce623a93e926", "comment": "Malware payload (AgentTesla)", "value": "4cac8804de5aa035407117161e1d8304edb1e46d28b37a8fbd16585bbcf2bc900d5b84f3123ab68db97ecbe5ef11411c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697511, "uuid": "89ca368d-73ad-4be8-b14e-b23222136e92", "value": "T1CC55021185C42FB9DFAC5B1C80FD151EA3E05A8F502AB98AFB73BD07AFE79410617189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697511, "uuid": "dbb0a8bd-fb9b-47d1-83cc-04922e29ebeb", "value": "24576:IAtmONw0LNlUiMfWGMIPyQ9/52Kef6CfkAfPowIPGK6aFEz81L:IAtdNw0L7iuQ9/RimxdeKtR1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697511, "uuid": "bd1a586c-08a1-4dbd-8925-ddb3f757cf4f", "value": 1284305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697511, "uuid": "205eb222-6e4e-4f3c-a11b-1abf61e3e7c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697511, "uuid": "1b400602-424f-456a-99fd-d806d1634afd", "value": "RFQ_FR-439853330.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56795771-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776686778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686778, "uuid": "f1618047-2e37-4cc0-aa3c-5ac7afc519b0", "comment": "Malware payload (WeedHack)", "value": "006a1cb194315d5017e38851c581339d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686778, "uuid": "a9d48c26-59d1-4905-8598-061ae7b4f8a9", "comment": "Malware payload (WeedHack)", "value": "891af5ab51970111ce89f4557638cdeb87bf47fb0296e5aa6432cb78912051e5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686778, "uuid": "b95144d2-706a-47a0-b9c6-cfec9da68fc9", "comment": "Malware payload (WeedHack)", "value": "35f3a82370da014b477b3d9a8574aefc923e8d7b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686778, "uuid": "874dde34-457b-46de-b5ec-345e5bf8b1ac", "comment": "Malware payload (WeedHack)", "value": "cc13a9297a17adbbf461cd6d826c9c5b4486c1061b52b268cbb6cc43ce509bae6466067f9d188a381d11c5894d3c806c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686778, "uuid": "87c9e3d6-d187-4ff0-9f0c-18efc951f765", "value": "T1A7C2CF238B569235C84B1B77A8905D68BC6F87E950C7FC7945A8063FC9E2EEA5F0C700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686778, "uuid": "9983a4e0-1452-461c-8024-081d1c1e909e", "value": "768:A59n6a22ZzrqBzDrHTU9pBdf+Bhk070ZCs+AN:XtkzrgDrzUTDfZ070YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686778, "uuid": "532961bb-0504-4b0d-be31-c5be4d3ac46f", "value": 25798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686778, "uuid": "8652c1f6-8eaf-4e40-b9fc-d285b049e284", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686778, "uuid": "5c555968-f7a8-448f-98e8-985c8b147dd3", "value": "Lunar_Client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8312c3d1-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686853, "uuid": "010b06e8-660b-47dc-a567-3f84db09523b", "comment": "Malware payload (SpankRAT)", "value": "f633bab2f204deb1e00f1329800167de", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686853, "uuid": "39c4aa8c-dd93-4406-a2e1-3f29f84de7bd", "comment": "Malware payload (SpankRAT)", "value": "89460c154e2844bf7d15ff8ecc59b996aadf05baa2a6e494d0f5c246a8917fff", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686853, "uuid": "a3f8fee6-4031-40c5-bd09-b10bf2960db0", "comment": "Malware payload (SpankRAT)", "value": "7b81198cfd5bb1f8692d962012e00b7019a71d42", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686853, "uuid": "6a813f7d-9293-4f5e-b0c6-f50be0e84098", "comment": "Malware payload (SpankRAT)", "value": "694e10e1edfe41fe8e09a056816cdfd58d3f49522f0a842cb5802f941a9086ddd833a32ca07b3f9166b530405f416077", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686853, "uuid": "7c4bc1c3-e4e2-44a1-b67a-2134b498f213", "value": "T11E253C137E4689E9C48AC878C357CA624E2234DB0B35FADF50C5662C3F6AAF52F1D214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686853, "uuid": "b513c09b-8177-4aa8-933e-5890dcc0daff", "value": "74de2a662a72eb067ba749bd00ee0b92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686853, "uuid": "6f657ad4-d394-47a9-a5be-a97caed4a486", "value": "12288:Joclwcjdm5WZQHEXvDv4ZJChXJy/fG/4P0R24yAzrHqcjYvBsS5:JoOjI5WqHEXaJkA/IRyAPUsS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686853, "uuid": "fed7dc16-5343-46fa-ae8e-d09c0e41d220", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686853, "uuid": "fbbcf01a-a870-480f-96d5-6ea4593f3f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686853, "uuid": "f1b2e288-fe0f-4323-afe6-c484bf5fc0d5", "value": "89460c154e2844bf7d15ff8ecc59b996aadf05baa2a6e494d0f5c246a8917fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d700818-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727270, "uuid": "9449d724-af92-47c7-b34c-0c347741f788", "comment": "Malware payload (Mirai)", "value": "2fc3a0ff10bd27a39365e70420915222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727270, "uuid": "ac191085-e55c-445d-b800-d6662fc10e17", "comment": "Malware payload (Mirai)", "value": "89aa4fced12eeb72562bbd672490a48b6aa8b7ff14daa7e4fc1e3eed9a86bc48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727270, "uuid": "e9a9f129-b5e6-4c77-9ec4-5faed0eee0f6", "comment": "Malware payload (Mirai)", "value": "30575e65de7fd12f7ce16b42f7dcc5d19b2eab94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727270, "uuid": "d261be28-62bc-4cf6-8dc3-6fba404fbc09", "comment": "Malware payload (Mirai)", "value": "4552650dc64ce1921b2608d1ad12bd98b16f129ac0417dc78ef8ee75874e60eaaffebf293443f0efe2225ee4fbb4ff47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727270, "uuid": "db142901-1a2c-4740-ad8b-67489f55e655", "value": "T1B8A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727270, "uuid": "4c289f7d-6ca1-4dc9-8e1a-47d60180325b", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeINY0:lZzTJa1rZ62yqPy/ULWzjeINP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727270, "uuid": "851c258d-2448-458f-b4f4-9ea1a23f80d2", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727270, "uuid": "dd142eec-8cf6-4757-825a-bfb264b51548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727270, "uuid": "2f0521e0-0131-4f8d-910a-a60a7a7adc20", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5408d5ee-3c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776671741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671741, "uuid": "84f34e09-8bdc-493b-8738-d0d7488d740d", "comment": "Malware payload (SimpleHelp)", "value": "ec86f4d4e9d22d412177f1c1b360af33", "object_relation": "md5", "Tag": [ { "name": "carriersetup-net", "colour": "#D93FAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671741, "uuid": "de8611b3-1bae-4318-aff6-2275806d901c", "comment": "Malware payload (SimpleHelp)", "value": "8a00b3b3fd3a8f6b3ec213ae2ae4efd41dd5738b992560010ab0367fee72cd2a", "object_relation": "sha256", "Tag": [ { "name": "carriersetup-net", "colour": "#D93FAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671741, "uuid": "5bdf4307-f3bc-4a42-9315-e0bcb7e34301", "comment": "Malware payload (SimpleHelp)", "value": "2fe71ad9b98584383e29bb0daa8a2f04875ddef2", "object_relation": "sha1", "Tag": [ { "name": "carriersetup-net", "colour": "#D93FAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671741, "uuid": "53434065-d28f-4500-a220-881a8b1175ac", "comment": "Malware payload (SimpleHelp)", "value": "84aab6693f7991923d551f7bf5b67f6c7f826bd63ad9e241fdd80e9d81a0add77d8cdde3f66d20b75d4a8b7750593af4", "object_relation": "sha3-384", "Tag": [ { "name": "carriersetup-net", "colour": "#D93FAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "real-cargo-rat", "colour": "#24562C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671741, "uuid": "34f3d88f-0de8-4fdc-b36c-97f818101702", "value": "T101773324FAA15DBEDF33D5FCC0564147AA5AA4A70389211327F149E68F207D0862FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671741, "uuid": "13f2c42c-b2a1-41da-ae1b-0a4c80936563", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671741, "uuid": "835a2038-9baf-4017-b3c1-8182431ce796", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcQ:K/jkCgpPUK8PyL7M8aE1VWhroHFcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776671741, "uuid": "298610fe-c8a9-4ffd-a41a-d03ef835355b", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776671741, "uuid": "23476359-cb0f-49b4-bf57-b0c2f0434cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671741, "uuid": "bebd40f4-652c-45a7-b2b6-1f8216684181", "value": "8a00b3b3fd3a8f6b3ec213ae2ae4efd41dd5738b992560010ab0367fee72cd2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180aec32-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674218, "uuid": "a92ebc5d-f420-44e0-ae13-0e8bd0919e4e", "comment": "Malware payload (ConnectWise)", "value": "40688f31e5a002bbcb1ab58e594a4b7b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674218, "uuid": "70cabbb6-a336-4baa-a296-775b73c26aae", "comment": "Malware payload (ConnectWise)", "value": "8acd15f65eb1ff7a17b2d5615f6c27981256bd735d9eb22818e04632cf6ed6c3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674218, "uuid": "4651f93f-cd5b-43c2-b7d9-7bdd0a5d0233", "comment": "Malware payload (ConnectWise)", "value": "8bae965483b231c7dc5f1cfb40a5feb15ece912c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674218, "uuid": "c08acbd1-cab1-4d43-a99b-43501c55821a", "comment": "Malware payload (ConnectWise)", "value": "f8082af7803af0b9a8d3411522d9c2dcce90a785757b3c74ef380b19cf2f703f4f50505ef6c389c96beff5b0c73eaef8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674218, "uuid": "464553d0-c834-406d-9759-32d622fd3b3c", "value": "T1EE750110B6E9883DE6F62B32FF7A92605F39BD251E20C15E9394350D0D70A919BB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674218, "uuid": "e9fcb9ce-8b3b-4380-89d8-2fcbfac3b07f", "value": "24576:6ZPlmF0uwTKh56Z5vePu/DVeL1pVjeO2nUUGGu/aYmQurhwQUv:wmh69eWbVypVC1gGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674218, "uuid": "e49606ee-b864-487d-ad88-67bab2e234d7", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674218, "uuid": "2d0ebb50-f943-49f7-9422-814e1d67f25c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674218, "uuid": "a1a0749b-711a-4746-811b-1c1e39e72efe", "value": "8acd15f65eb1ff7a17b2d5615f6c27981256bd735d9eb22818e04632cf6ed6c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc7fa07-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687518, "uuid": "2646ea72-117a-41e5-81e8-77427bab4757", "comment": "Malware payload (Mirai)", "value": "6bf8cea2e5431b79f39e38f94e5c04f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687518, "uuid": "7695d505-35fc-4ccd-9eea-4cd80a95b4d3", "comment": "Malware payload (Mirai)", "value": "8aec5e725f34b28955043d2f6a283da35cd712626588566904702aaa79270624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687518, "uuid": "4d610cad-9315-4841-990a-e978fa41828d", "comment": "Malware payload (Mirai)", "value": "52b242689065ba3f0f59fac6d02cec44e9859d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687518, "uuid": "7e3fbc34-3cea-4788-9d57-5a14f92d38a0", "comment": "Malware payload (Mirai)", "value": "96c8e5748f7be97a4fa9f60ec79dde99350efd4bfc6d831d1007ddeec6d46845fd31005f1c3c6ab041126ca7e9fa9f74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687518, "uuid": "c9482aa8-fcdd-4378-b99c-d93a80f5a73a", "value": "T19313F796BC829A66C6E0637BFA5F418D3321A3E8D1DF3257CC112B057AC991F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687518, "uuid": "b33a7b11-33d4-4f3f-8010-956029b124f8", "value": "768:XP7T28mUGj57T7lq1dZuhfHn41GC8saIDoCerCIcW138vYPDX/heg3OgGytZPNvI:XjHm55TZ0v8sUcWh8IDX50Py1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687518, "uuid": "55d0274a-7343-40bf-a901-102bde87b656", "value": 42880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687518, "uuid": "232fe701-175c-4040-8e70-e22c82d5ff45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687518, "uuid": "6173966e-edff-4af6-abc0-8454339a959c", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ced949-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725353, "uuid": "b54b71d7-2d49-4d78-b743-19acc57c52e8", "comment": "Malware payload", "value": "e31b8894be1c970c0c3318cdc2c916c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725353, "uuid": "1b40e1d9-c8ef-48ff-9436-83ac55284b0e", "comment": "Malware payload", "value": "8b7e06b34f6eb3c496685934bbf39193444f80d4ed6be18681b0e30dd7f04f2f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725353, "uuid": "5e77f79c-eda8-47cb-bb81-18834a3d1106", "comment": "Malware payload", "value": "4d823f8ddb5d1862c3ba0be9efa3f9f7b572b13a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725353, "uuid": "dcf8ebff-d12e-4c6f-8f34-ac7446fbe810", "comment": "Malware payload", "value": "e2d7c145724290dbcf581caf3cef3d0520fd709bb31370f7a894f25df82f27c0912493946b7f0afea53ef8a7375ec534", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725353, "uuid": "51da567f-28ff-46df-bd39-d00215244412", "value": "T139340C90B181FDF5DC998FB420D26309A3B6F181971EEB2B6620FE3C025EB54D57354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725353, "uuid": "847f8924-f287-442d-bff7-f42010f90781", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725353, "uuid": "0300fc16-60f5-4421-9958-fc233639cbeb", "value": "3072:IuB0DBVl7xAakG0S+rtKnkFsT2/3KVuHHyjOiZPJHU2jeJTY:In7Cak7S+JKnk+2fKVuHHyCiZy2jeJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725353, "uuid": "a601021f-6ede-4fc9-9da6-6b64362198bc", "value": 234539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725353, "uuid": "71f72ea0-1c32-4541-b6d8-92e556dd3b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725353, "uuid": "83962174-15a5-4a20-9b02-656e1f3a622a", "value": "8b7e06b34f6eb3c496685934bbf39193444f80d4ed6be18681b0e30dd7f04f2f_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f2c067-3c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668708, "uuid": "a4462e49-9144-4586-a8af-0d6bc80655f3", "comment": "Malware payload", "value": "7876db64a15016acc51ac2cf72ff3c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668708, "uuid": "11cc965c-d12c-4efc-b629-cc9a03b6d1c4", "comment": "Malware payload", "value": "8bfafe663f309904a6d3ff191ac2a000cface948b22bdf030cf8dec3138dbf72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668708, "uuid": "2a086f5f-934b-4979-980a-1f190682e059", "comment": "Malware payload", "value": "518c4267341d49bbacfec953226c58f5b124a85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668708, "uuid": "78b2bcdb-3e73-4dba-afec-af43dbf1a81a", "comment": "Malware payload", "value": "4e84e7ed4e2842db42cb60c8ca39f66ce9f2c82d81f30d4c98f091c08e4c63f95aaa4681cb3d934ec6df06b2742f2d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668708, "uuid": "01a34ff3-2096-47ec-81d3-3cefb1962e5c", "value": "T164C79432CE450E674EF262BC69658AE3FA70A32F1380591BBDFC9A4C1F76D716042B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668708, "uuid": "2e89970d-c841-402d-b39c-9104fbbc91a6", "value": "90e661b7ca3751e7b7204b32177d7330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668708, "uuid": "dd10c7b5-7d33-4284-9865-1d8ef04ba996", "value": "98304:u2ESveGAuaZsUTaSndrU7WDrHUn24k29aEBDWIiDPn+hi1StW:u1VTae18gAoDPgtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668708, "uuid": "dd07390f-f16b-416d-9720-4e6938964e8e", "value": 53071128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668708, "uuid": "e7372645-b209-49d2-b408-3ffc3e88caf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668708, "uuid": "0751f389-2e97-4653-9cf0-da31bcfbe62e", "value": "8bfafe663f309904a6d3ff191ac2a000cface948b22bdf030cf8dec3138dbf72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87496fd2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725085, "uuid": "2a59fe03-c751-4132-bf25-697d7784797b", "comment": "Malware payload", "value": "04cb45c76b40ae83aaa5872c4a1c933f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725085, "uuid": "b2d0ec24-0a82-48fa-b92d-30ef93c8fa1e", "comment": "Malware payload", "value": "8c4c71a0b2956df61836f9aa5e1fae672f1f45d7e194a9982ac6b88872470e19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725085, "uuid": "90f5765f-f964-4976-8081-ad87d25cf566", "comment": "Malware payload", "value": "b5e9256e36d4d76d19c2d23883a1078851989ebe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725085, "uuid": "9c5c0288-b50e-4174-ad04-a20a6932d62b", "comment": "Malware payload", "value": "a90508630604928c5a72f41bea29df7ba7bb19f8eefcf63d501696eec25db8d58db157fcd00ebdb297ea10ffce62e239", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725085, "uuid": "9e523a39-5bf1-41e3-b62f-4d4b6372ef0a", "value": "T12CA35A0B76E900BBE1B79678C8970E45D776F81117619BEF43A0425E2F633E24D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725085, "uuid": "7b058457-8dff-41e6-825d-17b8a7b045ea", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725085, "uuid": "58a795dc-1558-442c-b2a1-74e8146fa3d5", "value": "3072:Q9UQIcsWYMRGuiQbwAedgCe+0PpYrtFmASJrkrtOAE6:aImYacMwAedjSKbhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725085, "uuid": "c9a7c75f-2bc9-4576-959a-17507677aa89", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725085, "uuid": "e003b080-23a7-477e-8922-cefb40745c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725085, "uuid": "8e3a9493-477e-4a0a-a37d-71128a8035d0", "value": "8c4c71a0b2956df61836f9aa5e1fae672f1f45d7e194a9982ac6b88872470e19_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42facfdf-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725829, "uuid": "278d6add-fd72-4c92-b2c3-e488ea59afd0", "comment": "Malware payload", "value": "6b293b2c174471078797bc761e9e85d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725829, "uuid": "78762fb3-94ce-4f5b-afb1-a70f1dc6908d", "comment": "Malware payload", "value": "8cce1ffa9328a8091497964538fd6098a50fd214edbc498f7ec580c711de9d11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725829, "uuid": "9e227985-5529-42ed-a002-ada9e2393216", "comment": "Malware payload", "value": "7de4694258993ac77066720d981834d571511000", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725829, "uuid": "55f083f4-87d8-4156-a735-a292486b7285", "comment": "Malware payload", "value": "224403b4cdb6eb0eef3094e91c4d7a3a32a3160056598b6f724e8da1d36e9962da7893bde071517163e2a8ded02b6d47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725829, "uuid": "3d8cbbad-e820-465b-acfb-675e23639afe", "value": "T180D5BE03F6DA50DDD029D074979F9213F671384A8F1166EF26A05A202F67FD86E3E329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725829, "uuid": "dc6512a9-046e-40d4-81e0-e05a02a93234", "value": "91b8685f04cd4eceae98e68aec559609", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725829, "uuid": "7575bdd7-1f61-4964-b5c9-ba636a8f1985", "value": "49152:ln0ZzBPpE+xOsNWoH8bVd8j+OA/7ZwddK6BfmLTqEIrrJBHZ9B:URE+x/NWXVd8jJEIBB59B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725829, "uuid": "4e3396b6-841a-452c-b7f5-9f7a344850e1", "value": 2980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725829, "uuid": "6b101050-6447-4b85-838a-86786a0b74c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725829, "uuid": "49544eb6-36ce-4db9-9fbd-64bacbd3c4a8", "value": "8cce1ffa9328a8091497964538fd6098a50fd214edbc498f7ec580c711de9d11_ffmpeg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525f277c-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725855, "uuid": "5aad3459-fa3f-4dbe-b7a0-c7ead2fcabc8", "comment": "Malware payload", "value": "9ccf8f481e94c7c8da0e54e709b36850", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725855, "uuid": "85af6b22-30f5-42bc-9997-dec961b4ca69", "comment": "Malware payload", "value": "8cf509a056060ac58ad82cc6696d80efad0b8233f67876e867d567ac220d8bf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725855, "uuid": "99bbdcd1-2f25-49f8-845f-202a291117d8", "comment": "Malware payload", "value": "c5325ea076f27b595e9adccd861c95d7fc1ebea8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725855, "uuid": "c42f0c56-fff0-4dda-8fcc-7182c68d51f6", "comment": "Malware payload", "value": "48fb77a7f2372cc6ff5fd819176a56ac18b38472d4222867a500b049629addbaab5af85c35884ff84a99d475fa8dcb45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725855, "uuid": "7297f75b-7859-41a6-9fda-0cd893c7b99d", "value": "T193B35A4B72E900BBE17B9278C5A70A469772B85117609FEF07A0425A6F237D18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725855, "uuid": "e02e5179-a32c-4a8f-ade4-eb1aea2b096f", "value": "233a5431c033868c22dc3cb966d2f492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725855, "uuid": "80df7806-11dd-4cd2-81d3-88a91ab438b6", "value": "1536:OW5oLmaKZzy32YN2Z/npOjkIkd4THESzEpSEumqxjYUfEEvsWd3d49dlNKjZATu:O8tOno/K9kdkkMPEhqhxE2toD8ZATu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725855, "uuid": "408b8b89-55e0-4066-8a12-392aa131c465", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725855, "uuid": "c686d950-a2bb-4525-b7e1-420f9ad6f1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725855, "uuid": "e86fa0d9-c07a-48d0-95e3-02c0076d40bf", "value": "8cf509a056060ac58ad82cc6696d80efad0b8233f67876e867d567ac220d8bf5_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7569caa-3c88-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776669331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776669331, "uuid": "6edbb2c1-9e92-4eff-9009-e3bad347e75b", "comment": "Malware payload (SalatStealer)", "value": "233bc78cc5264e684ab1c82bb0f55585", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776669331, "uuid": "3a9ef165-2907-436f-b5c1-ad898d45bb90", "comment": "Malware payload (SalatStealer)", "value": "8cfbc5a992c24e73310a67dff435022e8038bc958ecb7cff6aca57dd13fafb46", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776669331, "uuid": "a8610279-1a75-4bdf-af0f-7d4558ad6546", "comment": "Malware payload (SalatStealer)", "value": "a154124b946a7fe2c40498e2394a411bf2617acb", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776669331, "uuid": "0f1cabbe-c739-4f92-bc9f-c4bd669c0f8b", "comment": "Malware payload (SalatStealer)", "value": "e117b28d323a7553c30c1eb8e93b9c3f75b8df2a401c9be4bf09cc1070238ae61dbe205b8da7e67c6d235130c261b46e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776669331, "uuid": "48190efd-d8d1-4b53-842d-e7d1b94bb793", "value": "T1F426330575C188B6DABF12704C7EA7A912FDAA206F61CFDF06A058764F322C13576E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776669331, "uuid": "33b8f226-a761-4e27-8a69-24598d5039e0", "value": "5d23a9df2f44566086a85063679feffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776669331, "uuid": "c18ff9c5-ddfc-485e-b42f-55bad58321ab", "value": "98304:deUgpLU81TIanhH3+eGpJc7SCXJdF3+WcmQEr:dBJ8manseOc7SgF33cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776669331, "uuid": "ae919390-816f-4f20-b2cd-7d2387ceffa6", "value": 4695552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776669331, "uuid": "289e0767-993d-4cc6-b52e-d2ba968b31d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776669331, "uuid": "07885ec4-1911-4a54-8296-8a50e2237b99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b41365-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725881, "uuid": "2dbdc239-feab-4201-a3da-9a6468584751", "comment": "Malware payload", "value": "bb023111a5dfe62647271d08ff2debd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725881, "uuid": "b54366fe-9df2-4afe-bbee-922e91244465", "comment": "Malware payload", "value": "8ddd6e201bab408a029d92729e216654619d9fa0cdf1cc24614823a6362529a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725881, "uuid": "ca58592e-e294-48d1-a16a-19cca448d782", "comment": "Malware payload", "value": "1b35accc6b7de90255277b8479b764fba67147c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725881, "uuid": "d3d49962-94e4-44fb-a661-3286aa3a03c4", "comment": "Malware payload", "value": "5bdf08afcab1bb3e3fb6f81789e365becb247da01384d83c8cbc6bd596b322b190326a4d726040f23e168fbc1c51b65b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725881, "uuid": "ee964cb0-aa10-46c8-be90-969ea48392f3", "value": "T199B3495BB2EA00BBE177833884974A05D7B2B8455760AFEF43A5425A1F633E08D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725881, "uuid": "8ed80d37-8dd6-46e9-952b-e1194ff8085b", "value": "056c0ab36bec2df81a7d0794873452b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725881, "uuid": "a7439eaf-ac85-4324-aa6b-a311c7cd4c8f", "value": "3072:asaXw+09r822QGFAQbxp1bgLJJAOjzJoyfm2GgzskZpgyzfWHRzC9aiD1hI1ml:Ra0l82BJMxp1bWPbrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725881, "uuid": "b3698790-55e3-483d-8a14-c51ac9c6f601", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725881, "uuid": "1f26d3b8-31fb-40b7-b4bb-8bfa724b3220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725881, "uuid": "b8d17d86-bf13-4565-a17a-e8f687d8b7ff", "value": "8ddd6e201bab408a029d92729e216654619d9fa0cdf1cc24614823a6362529a7_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010a69b-3c72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776659789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659789, "uuid": "03a983a1-aa54-4fd0-a158-c31a9b33f639", "comment": "Malware payload", "value": "dd55c299d89d697862ccff2605acfcfc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659789, "uuid": "520d8b31-5409-4f2f-8b42-54acb4a0a799", "comment": "Malware payload", "value": "8e593e6e6c1a6874832ffcadc5b8d0a876a8ccae5bcf0572b14206f214db2d02", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659789, "uuid": "e874689a-e74c-4303-82b8-8e4171638996", "comment": "Malware payload", "value": "b07ac4b5f92187d0532c70ecef9221e2218aa397", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659789, "uuid": "1d3f3124-8816-45b6-935c-0f4c9cc38191", "comment": "Malware payload", "value": "b4b345e4d6983eff7e21acfcc69071a44acbd00d83513f9d4076f4d39608ed6b6f670d1e511cd126583447f9bef40f59", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659789, "uuid": "5612ed4d-69d9-437c-a2d1-964889463235", "value": "T14407DF12F2F901E8E5BBC178C6635517E7B27845172097EF16648AA92F33BE06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659789, "uuid": "d98723c4-84ef-4cee-9610-efdcd2c5358d", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659789, "uuid": "83bc6a53-738f-49e5-bd17-2489e381c66b", "value": "196608:rdvIyQs3CY9eO8OwcPFGUepZIk6GCr5Jw+bATkiGqlGRztpRA1+h:rdrz7whrLIk6GCPw+0zlGQ1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776659789, "uuid": "cb9340ae-7345-4871-a177-70a24aafa5ea", "value": 18336356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776659789, "uuid": "40afdda8-d94e-4420-a351-f90fba11795f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659789, "uuid": "9a35d906-297a-4ca9-9ed4-2e428899c043", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eafe57-3cf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776717732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776717732, "uuid": "57b90aed-68de-4dea-ab77-9e91a3493fc3", "comment": "Malware payload", "value": "b73c426c7134d23e06520766316eb3fc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776717732, "uuid": "08d26721-8d45-47eb-8f4a-4a6ec3e5a8e4", "comment": "Malware payload", "value": "8f625fe2b6cbc675335608b181fc71284d2a9df6180a65d5fbf40828a507e04b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776717732, "uuid": "ff975073-4287-4d20-9b2b-7d241d71522c", "comment": "Malware payload", "value": "3a8f758eb7d97e31ab2536f05fa99991bfd8eeef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776717732, "uuid": "cdadb134-ea78-4872-a4a4-daf05b0b7a3a", "comment": "Malware payload", "value": "422590d17ef885ef7f72807b935c3b834de0c8dfd82f91b1bedce3348e5e486192b0f72c92501ab33170e11cd79dc5ae", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776717732, "uuid": "3c21d26f-4b24-4020-85fb-4aeaadf8401e", "value": "T1A246AF21799EC532EA5E01709679EB6AE63C7DA24F7148D763E4BC9E1A305C21332F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776717732, "uuid": "5ca6242e-483e-4cc3-ace6-6bd237d015cc", "value": "98304:cHX3CzTD5F02D5czIfuxFLLIq5kXcabYVjQUfFKa3aR4a:cHXSvtF0pzIonxycabYNQUfFKGaR4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776717732, "uuid": "39e4bd9d-4b5f-43c0-bdf6-03b765add809", "value": 5775872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776717732, "uuid": "d26c6542-9d3f-4cb9-98b4-35e608d02d2e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776717732, "uuid": "2fd01e15-54f4-4e10-8618-e6a99d41a584", "value": "RuntimeInitializeOnLoads.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa6f71e-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725233, "uuid": "9da0bd60-2865-42cf-bc61-8917f8f4c00c", "comment": "Malware payload", "value": "59c1fdb48119dc4ed70f18024e085c26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725233, "uuid": "51e047a4-4c8f-4ea1-b270-81ddcb155dd0", "comment": "Malware payload", "value": "8f8999e7c257aaba1d41c85f6c36f82aaab5397b425c4542c2702fc13ee2f774", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725233, "uuid": "03cc7ed0-07fd-4e05-ad49-fd8d22d507b1", "comment": "Malware payload", "value": "e26a5c15c6859924a3cfdb7ab1e751a97da01340", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725233, "uuid": "95c569bf-c81c-4c7c-879e-4cd6003a7495", "comment": "Malware payload", "value": "51cafdb5e0e3080ebc4eef22e393ead3d0636f4e6e8e2e206590f2841824ff73a0eb93de68e79b0f6a00b47178bc0ae7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725233, "uuid": "f206e656-9e53-4c50-8808-d71f59d4c051", "value": "T189A3595BA2E600BBE1B78238C4670A45E776B8450761AFFF43A4465A1F237D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725233, "uuid": "dfd97a58-a9a4-4461-990a-ad2045616c93", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725233, "uuid": "5708d29c-1597-41fe-bca7-7c82e510467f", "value": "3072:4xxd4OwaOQbOnGZAW6YdTpIS/GWmATME5JAST/2njLhbC3G1KSzoQsv1VP:E74b6OnGZR6YbB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725233, "uuid": "f9db9dc7-12ba-42fc-b739-4254fc3a7033", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725233, "uuid": "84f79232-5deb-408a-8a22-7cfe2b24a832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725233, "uuid": "d0d1865e-7fcb-4c1f-b0f6-f198359de1e3", "value": "8f8999e7c257aaba1d41c85f6c36f82aaab5397b425c4542c2702fc13ee2f774_IPHLPAPI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0115d9b-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776696404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696404, "uuid": "6899a1ba-d2e2-4399-bec6-69e712097d8d", "comment": "Malware payload (Formbook)", "value": "1f0f614f0c9b414db0cf5148334ea7c4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696404, "uuid": "892ce9a9-4e7a-4cce-b927-7a55cc9e949e", "comment": "Malware payload (Formbook)", "value": "8fbd3f87677326a9268041ad7e6431176e01c4b5d2c621f9cadd04273dde9373", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696404, "uuid": "1c3010b4-d2f2-4ad0-8240-43af2a17ee04", "comment": "Malware payload (Formbook)", "value": "162943d6231188d0af88d56fddffd601b98bebe6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696404, "uuid": "f38d079b-0337-4c44-9f70-116a402c065b", "comment": "Malware payload (Formbook)", "value": "0fa7002b2d58317bd8dbfbd8bcc8800dada56942dfe2fe6b2524cb616394f8f9d97eccbcc30c77f1a5573883e429d453", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696404, "uuid": "d352158e-cf16-4ca4-b99e-d7cd8f111f7c", "value": "T1C5C2833AC9845FF40BAE61E2284F3E519659075376363B0EB9CED49D3B29750CBE10E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696404, "uuid": "82f7aabb-a230-4f28-bda1-789abdaec6ba", "value": "384:Kb/YZmtA+7JgcVMcpaceD3isbB5NScL5M5ZD8lT4rH6xFh+uV7e1gGLO7+j7gV/:KbAZM7Z/7KPbBLiDY+OFhPV7eHLO7Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696404, "uuid": "449c0f99-4e36-48fd-a7e7-3e2875d83263", "value": 26160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696404, "uuid": "8ea4a548-8569-4d6a-84f5-8c9d2d870683", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696404, "uuid": "e75bffe4-df85-4b99-8988-c15559bec450", "value": "fiyat tek -EK B.26 Huawei siparis Formu_2025V4 - Kopya (000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670dd3a9-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675209, "uuid": "02205bcd-4ed0-4dc6-b8ac-9016f02a25fd", "comment": "Malware payload (SimpleHelp)", "value": "5a7a18e819ffff4c3f1929e3d1c734ef", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675209, "uuid": "1d42cd6d-a1b5-49b3-a953-3d3697d613d4", "comment": "Malware payload (SimpleHelp)", "value": "8fdf0788ae200385034ed8edb9730a7aac2c75c8580f91a9a7404ebcf03f804b", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675209, "uuid": "2d21beb2-eacc-42f6-b1e5-c20bf5450b16", "comment": "Malware payload (SimpleHelp)", "value": "93e7ea63c4e4b3f2a7c58a1e780a9d481dccb3b7", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675209, "uuid": "a77861c8-e461-4079-92ed-259600630c3b", "comment": "Malware payload (SimpleHelp)", "value": "5b008eaad230e3a211e21c4222442f3c14c5a449f220488dc2adbe460140d65645620b807eca803deb007107b80dc108", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675209, "uuid": "2178f2d4-6a64-46f5-8fa5-4e2f38ba338c", "value": "T1B3873324F6E598BADF27D4BCC146C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675209, "uuid": "6d0dce42-0ef3-4602-8e4e-0c642cf48b78", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675209, "uuid": "b4fac55f-6a91-4ed3-97d0-59bbda073afb", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7RmT:pJF2TAmHv5V7Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675209, "uuid": "1e41afb6-24ab-4803-8c62-919f033ff400", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675209, "uuid": "5ca5d338-6992-46a7-8cc7-0f453e060801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675209, "uuid": "eabb23f5-be7b-4fb6-ba07-868868d4d83e", "value": "8fdf0788ae200385034ed8edb9730a7aac2c75c8580f91a9a7404ebcf03f804b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3958e652-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725384, "uuid": "5b24dd20-f935-41b5-be19-c34fa4f2cb14", "comment": "Malware payload", "value": "acc13f5825cc58d3f71298071130bf7e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725384, "uuid": "a00ae54f-f23c-4c81-8c52-6019fce74543", "comment": "Malware payload", "value": "90217d4905c8aca23cd2cfe02ad79e1683c9f1cbcda78e93d5fa33f3c77640f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725384, "uuid": "93b12828-986e-42db-a613-6a235e58111f", "comment": "Malware payload", "value": "2362a0dc0db6671680cdc6059a6e39e2ccf93583", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725384, "uuid": "5e6a7a97-0f33-4052-ab24-b81973ef1d44", "comment": "Malware payload", "value": "1444dbe40ad735c7213479267eefcdd019b7575af27cf7c8f97dc2104e80f0dd6977a77fcc4168c8cc3eb5ba13f530d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725384, "uuid": "04856605-bf57-40cc-b80a-299f130dcfe6", "value": "T19AB34957B2BA10BBE1778739C4670A46D772B8414761AFEF4390469A1F233E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725384, "uuid": "f85f7161-88f9-4226-b80a-e4d53cf2770e", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725384, "uuid": "1f9c6157-7f2d-4369-b196-44de1587f4c0", "value": "3072:1a3ew8YHakpvHSwyBH4VQezDZ4C0x5q9yUKlJ:U8YlIwCvpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725384, "uuid": "e9de87bb-61dc-42d9-a1e2-5cc7dcd1f4f1", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725384, "uuid": "e7ee0992-f29a-4917-837c-e890c7bfc6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725384, "uuid": "54a052ff-e64c-4ce3-ad81-f346c6188225", "value": "90217d4905c8aca23cd2cfe02ad79e1683c9f1cbcda78e93d5fa33f3c77640f9_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085704f3-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724872, "uuid": "3ad24b49-d034-480d-843a-41edbbf2d6b8", "comment": "Malware payload", "value": "a81356be4dd4624a95c35a0d7dc97158", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724872, "uuid": "4daa3adf-efdd-4f34-b214-318b2bfb574e", "comment": "Malware payload", "value": "908e5a3a5dcac2a6ac5d71a1194f3062e0859b4da01c092b49d9b41dcd25f01c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724872, "uuid": "c055d136-d6d0-4c2d-b8e0-b3bb560a194a", "comment": "Malware payload", "value": "b7e941d00a298496a97db05f76dd12a263b8baef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724872, "uuid": "48ddb6b8-cc52-4b24-8fac-aef0f72e26f1", "comment": "Malware payload", "value": "a221bb28c6d003027ee764160fb2440422c0004eaf22a3b169ba66350ee0da81fe0c30f54404b2742bdba49a99294ffe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724872, "uuid": "924beddd-c4ae-43ea-8f24-a40dfd42545b", "value": "T17AA3494BA3AA40BBE2778678C4934A49E772B84157219FEF03A4425A1F633D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724872, "uuid": "90a828b5-a172-4450-bd8e-5e0aa9c02583", "value": "c97070657aa79bdf949ea0ebbff73aeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724872, "uuid": "18d50f9c-93a5-4c96-8158-ee25db7da211", "value": "3072:585sSVIf03Q/GyOQb8Q/yJjG5U3vrXT/7nM4L3zm2Q9ZVbZacTphsrvRWGC:GPV403IwM8Q6JyklC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724872, "uuid": "b8b76cb1-e4d0-4438-8d85-99ef8a6e0de5", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724872, "uuid": "19012042-1434-4264-a7e0-f80f6b163b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724872, "uuid": "2d08133c-f63d-47cf-a334-4b6bb4cdadc4", "value": "908e5a3a5dcac2a6ac5d71a1194f3062e0859b4da01c092b49d9b41dcd25f01c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f500e494-3cdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776705942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705942, "uuid": "382b2141-413f-4125-9ca7-2dc41d4ad556", "comment": "Malware payload (Mirai)", "value": "5d964a7b59f1b48b97c9a721d01970b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705942, "uuid": "975c6dbf-7e70-4d8e-b9aa-35ae3a8dac91", "comment": "Malware payload (Mirai)", "value": "90a22604f8a7a4f427764e9da9bb8fa55d0dc6029d9a7d999f9266022e500795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705942, "uuid": "6ef8d4d8-96b0-4829-8941-f0d483269b0e", "comment": "Malware payload (Mirai)", "value": "48fa0db2be4e35ad51596eb83a26102816640196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705942, "uuid": "92af6257-b1cc-411f-9cf3-48bb490bd889", "comment": "Malware payload (Mirai)", "value": "89137fb4b4fdf45ded464abee433a3a512994d2e07ce17fd4db0174ec1896bda101ec853e03124d5ab07a8c048a879e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705942, "uuid": "a1a111c1-6c0a-4dcd-8f62-d87e048ea390", "value": "T179F2F13863560630C2F04C75D9DDCB0632144A7AE5BA28F2B54016AAC54FB797F72B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705942, "uuid": "89b0f357-b81b-48fe-81ba-a62af955ef5c", "value": "768:ijVtoCoxpDX1wFn1lKCSjXPZRKXl/XQqkNSQFEs3UoziC:utoCcWF1lKCMRKFXQqkdhziC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705942, "uuid": "cd00721e-ed5b-496c-839a-e8832f48180b", "value": 36948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705942, "uuid": "78ddfec7-f504-4286-8526-8a525d6eeab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705942, "uuid": "89ff8eac-a5b7-4467-9e36-ccf974d02e58", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7ca24e-3c5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776651165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651165, "uuid": "a75c2781-95cb-40b3-b0f9-493fb13e58d1", "comment": "Malware payload (Phorpiex)", "value": "e3d48a25be12ecaed6a389f1e4e4ee91", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651165, "uuid": "c3c97a3a-89c6-494e-a849-160bbc8221f4", "comment": "Malware payload (Phorpiex)", "value": "90ffd0ad811d9a85496a7985315343c412bff004d788ccf6d5fec30b2befaff4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651165, "uuid": "51b6bed2-5151-438c-bd27-1ec1dce4e6f8", "comment": "Malware payload (Phorpiex)", "value": "ca92e8ef22fd83296613910d3b41b056b955db4c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651165, "uuid": "3d7f6d56-e951-4770-8e0c-fa0b17b48274", "comment": "Malware payload (Phorpiex)", "value": "c6ce75e1ffd208ac5ed431ff6db1cbf73adb8d196acf7828e9789ec380fb724913ccace3dd03a1662805ae7a9ef51f77", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651165, "uuid": "4b331270-fde6-4426-852a-00ee2e5c5b1f", "value": "T1B7823B0FB9424216D0D200B49676867BD979A8B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651165, "uuid": "1b69c530-9d39-4fee-88a7-c319e02597d6", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651165, "uuid": "4359a9e8-69db-4ac6-ba4a-f3d8e1fdba43", "value": "384:/I78VGQic1Kwzw077u9NHu/gBhav8U9co:cAo0769Zha0Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776651165, "uuid": "62accdd1-976e-4708-aacc-121181d24db2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776651165, "uuid": "b3e02f12-c91f-42db-89e1-a9d3972d477e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651165, "uuid": "bcb29ad0-0b0c-4d91-bc21-f126e47199fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb85c35-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726008, "uuid": "959e2c7b-64c9-4b60-b6fa-92ea2e2206a8", "comment": "Malware payload", "value": "b3d6fa78ea0c865ded44fed1f76a8617", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726008, "uuid": "687df146-34c4-4d64-820e-41402ee6af62", "comment": "Malware payload", "value": "911c4dca2247dd958c8a9a43b080c9909658a77f497af907b7985ec1b438621c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726008, "uuid": "56fb4470-5e94-44b0-a0c3-265c8b251231", "comment": "Malware payload", "value": "9199f9a769e7877a77592d878ee4e2da520d4377", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726008, "uuid": "045e9889-5442-41b1-bf42-d62b6f1f6ab6", "comment": "Malware payload", "value": "5b35c7e1e27a219b3efd0e0d659e3a611f9ec4ddd81afc7cec73b348b98373adb4e9373225cfdc726dacab589144d92a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726008, "uuid": "6de2aebd-aaee-4348-8e24-102705a7c697", "value": "T1A4B36B0B62E540BBE077D63885A74A06D7B2B8510760AFEF43A4465A5F237D18D3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726008, "uuid": "b9e54fc7-0ead-4159-beb3-37a1627be681", "value": "43501fd48065720e9fd2d24a68ead8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726008, "uuid": "60f055a6-d68b-4e29-8f44-9267470d6639", "value": "3072:YZq1+3s6dpqMdOwRZIVBHIBEVJsBcHDb7:p+tdHnZIPF9jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726008, "uuid": "6811bafc-eae8-4f7c-817f-c8dcdaa10c20", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726008, "uuid": "085909cd-653b-4f31-a688-70f3082ce204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726008, "uuid": "efd7458c-a30e-4cd7-b628-dda67400b5a6", "value": "911c4dca2247dd958c8a9a43b080c9909658a77f497af907b7985ec1b438621c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aed6ab4-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725118, "uuid": "46cc8086-2dc5-4cd8-aae9-0ed934dec145", "comment": "Malware payload (AsyncRAT)", "value": "80de8979680814936c6f08b842c95b7b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725118, "uuid": "6bd83a20-dfee-4b94-90aa-086a8c69c5d0", "comment": "Malware payload (AsyncRAT)", "value": "9193d0a4fa36096e16d6b2c498dad124baa8c88aaf0360281748c07c16b13096", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725118, "uuid": "62e23a05-f854-40b1-b927-51bef574b099", "comment": "Malware payload (AsyncRAT)", "value": "a9d35855d70ec5ec3fcdd86beebb4150c8b52373", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725118, "uuid": "45b047f3-94b7-4f07-a4f8-8aadc090764f", "comment": "Malware payload (AsyncRAT)", "value": "b208e1813fa04e5dc7146131b7b086e751a274252e105cc1edb32a3754ac21e8508f1ecf255a3735b30b3ee6bdc52a3f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725118, "uuid": "0b803df4-571e-437e-862c-ff5986169c57", "value": "T114B34B57B2F600BBE17B8238C4974A09D7B2B8514761AFEF43A1425A1F633E18D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725118, "uuid": "057d990d-a16d-49f2-97ca-d3ebbb62c7ed", "value": "ceb20e06b162e1cdd50a2dfe6c5688ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725118, "uuid": "bfbe107f-7bf2-40a7-9107-d5a620b4bcaa", "value": "3072:SXrYXdCm1Gt4QbCQiJd3t7VQezDZ4Cv2GWwD80p5wCATAz1vKEobi:MYNCsZMCQiJVBYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725118, "uuid": "3edf78c0-83e6-4b96-928c-08b844e8b205", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725118, "uuid": "86c0b982-2199-42d7-88b7-4cfe1a5956cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725118, "uuid": "6f44fd8b-c89a-4b30-9d35-c63f5734fa45", "value": "9193d0a4fa36096e16d6b2c498dad124baa8c88aaf0360281748c07c16b13096_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d745426-3c9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776677260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677260, "uuid": "5d3ef94e-01c0-42df-a461-f5427764f600", "comment": "Malware payload", "value": "03c1cfdc46d2f1d2c326f60f448cfab9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677260, "uuid": "393aed8b-e2c0-490d-816a-3c7255f2b6f4", "comment": "Malware payload", "value": "91a64246e8ac2357b7e2907f635a7fc5e0f73d089859f0e60026dd4832f7d9f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677260, "uuid": "a588df0b-7f7c-4299-8e63-4e947b7a2564", "comment": "Malware payload", "value": "34e5ffed1c565cea0d44caaab384f108ad9d27ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677260, "uuid": "fb7bb598-cefc-4873-9b87-6b9e0aaccc8a", "comment": "Malware payload", "value": "3487657d665010d65c8d5437c17c2ea9c8e232653ca02f49b8529b7d8d6733595d8f19266d0a3d4ba131d6ad5b12dc18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677260, "uuid": "66a947df-54ec-4598-922e-ec72cdd3c38a", "value": "T166343B3ED6940016B0F2C614BEA60413F577BF67273D9C8812C6128D4AB354E79ADB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677260, "uuid": "be0cd209-1149-48fe-ab65-24444412f808", "value": "6144:qXx3GlLDXisvHMiZ7+ChwHLpJ/owfAnOY4hrGuV9bLqe9:gx3eSw7+ChUAnime9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776677260, "uuid": "2ecac286-0d2a-4b08-b022-d95961fb93c6", "value": 246260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776677260, "uuid": "05bacb5c-9794-4e9b-be26-3aee8152522e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677260, "uuid": "6a6219ac-daa0-423a-a49f-0c598f0e779b", "value": "P.O 2026-037250.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdb0673-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725093, "uuid": "ff49ed55-9169-4ae7-a089-7720fd7f7f5e", "comment": "Malware payload", "value": "991610df2d5d2889d1101a0cd5420c80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725093, "uuid": "55e1c617-edcf-4cfb-8254-14a5809089cb", "comment": "Malware payload", "value": "91ce38ac8a0279438c354c11e7ffb307a1a7f561f8c172ac73a5783a82c050b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725093, "uuid": "9277a3f2-1c1b-42d4-a545-f5849cb01273", "comment": "Malware payload", "value": "c93690c27b52485941ca95af9ff4227b64ac7dfc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725093, "uuid": "77f4ac90-4da7-411c-8cdd-11b5d0c94ef6", "comment": "Malware payload", "value": "cdba9c49ad8f42ae033bfdb897a8c56607d480b48e917145f9f58259c92dfec1efece7d2cdd382f6ff4d6f0dbb0cf4c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725093, "uuid": "0bfa61a6-6059-4f85-8ceb-bb74973c776c", "value": "T1DFB34A5BB2BA10BBE1B38339C4670A459772B8514761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725093, "uuid": "1cf04d92-4080-4998-8d74-c7455a9ba7f4", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725093, "uuid": "4d7e9042-b684-4990-9251-84d84d388a42", "value": "3072:j3QQah85ZpA4rwgw3LfVQezDZ4Ckx5qVBckVPxIiTlpOx:baabDw53muAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725093, "uuid": "f373ad32-d5a3-4fb1-a06e-b47867eb790c", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725093, "uuid": "c87c3d46-fc58-4b49-a517-9f61daec6468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725093, "uuid": "1c7b4941-5fe3-4556-b807-d1d9681e0e6f", "value": "91ce38ac8a0279438c354c11e7ffb307a1a7f561f8c172ac73a5783a82c050b6_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b30878-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726096, "uuid": "603aa493-a14e-4f15-8bb3-c65467a5ab47", "comment": "Malware payload", "value": "80092e5b12e04aac26032be86c9c2d08", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726096, "uuid": "9ec00f08-73ee-474a-b822-a30055f7d3d5", "comment": "Malware payload", "value": "91dd099c3cfeffe1ea23d864a796c301c80544231a7988cd656030ffd1805fc5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726096, "uuid": "c94b9ec3-b56d-4cb5-95da-5e94b54960e5", "comment": "Malware payload", "value": "029717442dac82828eca5012b4cb21c234815262", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726096, "uuid": "8366c356-b93f-40c1-9ca2-7de465ed44cd", "comment": "Malware payload", "value": "b152b2348bcbc5f53ea41dd6847b25b7c3428cd0413b12fd38574501b964390a502068f3658eaa13ab433728c8cc49b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726096, "uuid": "7d144cf8-d5b1-4c2c-a7c0-ad6f4c935829", "value": "T156B35B5BA2A510FBE5778279C4670E46E3B2B85217609FFF03A4421A1F237D18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726096, "uuid": "3d7efb71-c3a1-422b-ab5d-4f411cd0366e", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726096, "uuid": "98ba648b-0454-46cf-a398-bc634e300acd", "value": "1536:92o6trLOUnelseYw4MhLVxj5pVTH4SFcSdhn+hlLQvtEJsWTrd79dl2ZcfVLtpN:9a/Rngoyhj5plYAhn41+tqBzkZaLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726096, "uuid": "607a5978-9f5d-4cbe-8728-98d6e4e1831e", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726096, "uuid": "6b736597-f927-46f3-8653-4944ac323c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726096, "uuid": "5fca3ca3-7549-4771-832d-d34500f2989c", "value": "91dd099c3cfeffe1ea23d864a796c301c80544231a7988cd656030ffd1805fc5_IPHLPAPI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b45b537-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776697550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697550, "uuid": "1d6a8901-88c8-4ff9-9a35-7e77d1caa3dc", "comment": "Malware payload (PhantomStealer)", "value": "f6e8bdadbd01e386c2b1590c61b2a78a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697550, "uuid": "c2ced84f-0b1a-47d8-8c62-92f5f3a2f2ea", "comment": "Malware payload (PhantomStealer)", "value": "921fd2918a88f08af5f2513a9e9edfd2b954f3a562f7e237bd4f7f1b05662c6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697550, "uuid": "95608cf7-275d-44e9-8b19-89db5dd2f3b6", "comment": "Malware payload (PhantomStealer)", "value": "58bd137fa5df489bf50f6484cfe6666257d3af0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697550, "uuid": "1039dc98-8365-48b4-bb48-3522d348e4f4", "comment": "Malware payload (PhantomStealer)", "value": "112dc054e2e4e11219b2dba163c4ce73aa54395c959ff1b09b4dd5be99a38f8acf1a4b56ebd32c03b1d13d93f05451c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697550, "uuid": "3f7b253b-7284-484b-9ec9-5013c286d007", "value": "T15A342A243AFA501DB1B3AF959FE8749ADA6FFA733B07A45D1050034A0723E41DDE163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697550, "uuid": "553c8c5a-e78b-474a-9760-c4c417739c80", "value": "6144:TpD9bcjvn06R4u3gDaSJfER3hDFxEekp40FM4MAm2:TpDJcjvn0K4u3gDvJw3hDFxEfhFMed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697550, "uuid": "375018ef-a885-4f52-b915-94770aa78951", "value": 247256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697550, "uuid": "d56b5b56-d840-44e5-988c-dd6bb354e2af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697550, "uuid": "20ffa86c-55fb-4f18-8958-6f9d86322a8a", "value": "RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e755c14-3ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776681986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681986, "uuid": "85c5d233-70cd-4b0e-a19d-116dd3d1cff1", "comment": "Malware payload (Gafgyt)", "value": "df36d0614e743e2e7ea3e3e6a55d6cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681986, "uuid": "5addb2d8-2d17-4e13-8738-bdc417d97e02", "comment": "Malware payload (Gafgyt)", "value": "923c657779831cdda250ae61c6836776cf3afe9ab6e58c609e8294d875be8bc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681986, "uuid": "3cdb9457-a536-4b00-bb14-a5c7bcb1f6a3", "comment": "Malware payload (Gafgyt)", "value": "1322cf54bb802fadfa1acc387c9df33327a231e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776681986, "uuid": "9c6af15f-6b9a-474e-819e-69739bd2659a", "comment": "Malware payload (Gafgyt)", "value": "309dee9d4ed731a2375638079fa1015d802d1183ae5b65ab3490e416965c94dd0efb6df51a5ef13926735a8d8a7c2596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681986, "uuid": "112c4d88-8ec2-4233-ab68-093fd84f1319", "value": "T15E3302B3F1FCA391F1F5043D6DFA7F8A08E9D2992BFC4914EECA4616C597D0266A1140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681986, "uuid": "01aaed51-bec3-4aca-a095-299dfa75716d", "value": "1536:4/M0O0g/7NVf/HV1xvURAs1i5vfKMhkT6nouy8Nql:4/hfs7P/5Kdi5vyMhDoutgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776681986, "uuid": "4b837f1e-cced-4506-9467-372960ee17be", "value": 54572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776681986, "uuid": "0e96df28-07e4-404e-847e-3fd4bbf0361c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776681986, "uuid": "d64481e3-f9a6-49f1-a73e-20797fc08f31", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569312b1-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725862, "uuid": "b4ee6458-4f13-447d-91de-d1b6bcb7aa40", "comment": "Malware payload", "value": "7a068c3d87457fc4e295604a1f67a7e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725862, "uuid": "8408bf00-8c9d-4f74-904a-d8236b6f90ac", "comment": "Malware payload", "value": "924ec74deaa49a093b0137b721546d86008872410a74a45e496a57560f8a2b5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725862, "uuid": "959ad562-4561-48cf-8edf-fd6f3e551846", "comment": "Malware payload", "value": "24a15fd07e12c80dd4dea595273df6d13523f2a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725862, "uuid": "3f05befe-c1b2-4d05-873e-860b643320a1", "comment": "Malware payload", "value": "a4f084dcca9ff0ef07e9d8cfb65e28f1baef45f6f24965b1b8f0195b7d34b3d648ce4c378db447ea4ce839a39f9740d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725862, "uuid": "9db6db69-1c23-4816-bc23-5d6415d2c555", "value": "T1A1A35A47B2BA00BBE1B68638C8530A49D772B8454761AFEF43A4425A1F277E18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725862, "uuid": "796dc41f-b1c9-4ef4-bbb7-82d306fcc674", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725862, "uuid": "36ab56f4-2b73-4ce9-8c5c-9998ad6337f1", "value": "3072:oC/v/riAfIJGupGCBQbfQMPOGQi/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWU:VvpfSGwDMfQMP5qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725862, "uuid": "5866a355-48eb-4422-96cd-a7d189dac720", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725862, "uuid": "c7eff91e-773a-4016-a98a-cb28870e8ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725862, "uuid": "949a332c-f301-49df-94b8-9f1b7e9b42ae", "value": "924ec74deaa49a093b0137b721546d86008872410a74a45e496a57560f8a2b5e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5c6469-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725520, "uuid": "dbfe7083-5845-443e-bf90-eedadf723bdb", "comment": "Malware payload", "value": "27649e727e725f53780b287116815d84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725520, "uuid": "a7d405e4-e227-4d17-ae26-c5883240c52a", "comment": "Malware payload", "value": "9349db5d05da35c02be5525869c81f0b6ebaec0acd2f44270eb202ebbd0e3e01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725520, "uuid": "1d6c6943-dd7f-430b-a25e-6345b1662c1b", "comment": "Malware payload", "value": "fdbe3cac0006e91fd06a580758eab6d97a5aa0f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725520, "uuid": "24ef049b-11e0-41f2-a6b0-97f7b3b3f8dd", "comment": "Malware payload", "value": "e90e7b911fe4315b49973491f9065736b856995c1b0abc6665bf431d3022280ed789e803776721b7e30280247f41e0d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725520, "uuid": "9a029363-a4e2-4aa1-b80d-effd929f96dd", "value": "T1C3B35A5762F540BBE0B79238C5630A46E7B2B81147609FEF07A4465A5F237D18E3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725520, "uuid": "0314907f-2043-40e2-996a-d51de77c0570", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725520, "uuid": "55331444-1848-4a8c-aff5-d5aa5a7518b3", "value": "1536:WMyul1PcwY/2vbYFMEcpdkTH3S0WU0KDdlbSxETsWhXdU9dls4p4zLv5z3iu:RDEJE71pd4X/WKDHGxmNs2HLv5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725520, "uuid": "1309a245-2df3-4d4b-9a61-dae51a20efc5", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725520, "uuid": "f00b91f5-5f68-4450-aa4b-1b41b19c6bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725520, "uuid": "e20adf5f-2a77-4486-a181-dd2656eef27d", "value": "9349db5d05da35c02be5525869c81f0b6ebaec0acd2f44270eb202ebbd0e3e01_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2955f8c7-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725357, "uuid": "c1a7cc32-4d64-4b4e-9660-bc1fa8cc062d", "comment": "Malware payload", "value": "e6dc4c0e5774d69777767fc466709a15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725357, "uuid": "0942b49e-72d1-4348-9502-40698a3b7a2d", "comment": "Malware payload", "value": "936eedf75cb2d53d90dfd3c5f7faab94f63901a06df96d6c483b9d4d6c7613bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725357, "uuid": "ca6144a2-71b0-40a4-9f1c-e0a42c8ee429", "comment": "Malware payload", "value": "1eee3944d63d4a71594d70c2549b9beb955d085f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725357, "uuid": "660dfb8d-4611-431c-9414-7639ca970f4e", "comment": "Malware payload", "value": "dd8571959f6456b80b8a2825ad254c3a5aefcfb96a6556e1aca313501bfa9bd3b7d8f1dd62e88878da03c0e5fcf4e89f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725357, "uuid": "cb4e9341-2d32-41ad-a241-b699d478be10", "value": "T173340C90B281FDF5EC998FB820D25319E3BAF081971DEB2B6620FE3C025AB54E573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725357, "uuid": "ed02c4be-8b4d-4275-99db-a03ad9ba66c3", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725357, "uuid": "947407bd-19db-4898-a32a-0672b1820032", "value": "6144:X7CawJ7S+YbKnk92XKVuvHyIiZE2j7b7M:LCNJejGk46lH5PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725357, "uuid": "96b57a15-7867-41fd-bda2-c81f78ae633d", "value": 241069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725357, "uuid": "1ad0f240-4e8b-4745-b830-2e18a77bb175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725357, "uuid": "272dfc2b-7fe9-4ba0-b71b-62aef94646b3", "value": "936eedf75cb2d53d90dfd3c5f7faab94f63901a06df96d6c483b9d4d6c7613bc_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a8f3b6-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689055, "uuid": "417c90c0-d9ca-4ba0-bd4d-4f19c9a4b132", "comment": "Malware payload", "value": "fdcb6e1be56c91450e7774d5a7d2f41a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689055, "uuid": "ec51c8c3-2a3d-417b-b68d-4145ef07a5b8", "comment": "Malware payload", "value": "93d458ce6ebc98b2884e4a76c026d731a9f793cfcc6d514d4952ad6bf28fe8ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689055, "uuid": "aa26d983-73fe-4f7f-b81c-8cb5a45385f6", "comment": "Malware payload", "value": "9c49c4ba6db1b8ec460821d9f561dbfa83ecf616", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689055, "uuid": "67ed8853-a8ee-486e-bef3-8831b9da47a6", "comment": "Malware payload", "value": "641f0dd9d340c10b4593cb92af28e6e55d3cc0dcf3c5c316c551c0f83498558d75691f2d0f514004ff57bcdee7c46bb8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689055, "uuid": "6642ba39-2435-4963-a58d-38515a22729e", "value": "T161A37D40F4D18431E9BF597908B4DA355B3EB890DF50AEDB27C015AD4F342C2EE39A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689055, "uuid": "e4213399-1729-4ebe-8c0b-b3d80cd93cb2", "value": "4a39d28037d506187d6d7a524b7ad305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689055, "uuid": "04b6157c-22fe-42fc-a690-2f59df8b157b", "value": "3072:1YZyG+mawNnhbHQWPSyoMXZCw9GhNFkx:1YZ1JNnlw2oNFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689055, "uuid": "2dc49c16-e238-4646-a4fe-236043eeaab6", "value": 103792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689055, "uuid": "ae009491-7c99-4c32-98e7-a3190cd4b07f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689055, "uuid": "8ff8706c-707c-4c20-bc6e-f4c08850cbde", "value": "detoured.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a079b6f2-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674017, "uuid": "9591db39-eb81-48ea-a44d-90f24673c7da", "comment": "Malware payload (ConnectWise)", "value": "caae33ece34966540b680712c1e13e0a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674017, "uuid": "495c03fb-267c-4994-b839-3d3fe4511b7d", "comment": "Malware payload (ConnectWise)", "value": "93df38aad05eefd8efb0089920e35787cb4458482d6ef0c0c1432dd4f61146a4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674017, "uuid": "a8eb0a6a-5e4b-45d1-b75d-856e3d9cb228", "comment": "Malware payload (ConnectWise)", "value": "55f8ce011aa0ee352a4b4e71d813e84bcd3fc63d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674017, "uuid": "ad20c826-b2e8-478a-897a-3f1534e711de", "comment": "Malware payload (ConnectWise)", "value": "f72849b267e6d4ecd1e91c6362bb326cc68a98cd16a2d01816c8274581618d2ec856057eadb813838984b72e45b5d41e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674017, "uuid": "6ebb1411-05bc-4b78-b51b-d0881e78453b", "value": "T10DD62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674017, "uuid": "4e0b7df4-d03f-4890-bb88-f4a0a4d899df", "value": "196608:0Hxcp9ym3nltDUJV6Hxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3JHk:SGplppGp7GpHGprGp8GpbGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674017, "uuid": "94611cab-8fed-4131-84d9-eab1adc43c9f", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674017, "uuid": "0a0e9e17-506e-4c69-9687-f98743a93ecb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674017, "uuid": "7b76e0e3-6662-4e04-af62-ccf7899a48d4", "value": "93df38aad05eefd8efb0089920e35787cb4458482d6ef0c0c1432dd4f61146a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e137845-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725096, "uuid": "8541a8e6-67e3-443f-9e3d-caf55bf8b5dd", "comment": "Malware payload (AsyncRAT)", "value": "601abeb19c1895120d7ca1aced578495", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725096, "uuid": "12a5567b-47e7-4e62-aceb-1f843b955906", "comment": "Malware payload (AsyncRAT)", "value": "943cd759c65b91cf0dd91e0931d376b6ab282d732c7b6d899ced27dcdfeecf3a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725096, "uuid": "a3b61915-71d9-4347-92fb-312c2efe3880", "comment": "Malware payload (AsyncRAT)", "value": "4a5277e2df7a5be9b049970022eaa71d7de9e97c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725096, "uuid": "7aaef0fd-187f-4936-a231-fc499f8deaeb", "comment": "Malware payload (AsyncRAT)", "value": "7db042a9be1098b10d5c02caa9b5f1890e806d18ef68459858a101304cfaefccab43c60df13f5e639642538adb9d318f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725096, "uuid": "033896df-db45-48aa-8e58-2191a3ee3072", "value": "T12FA34A5BB2B600BBE1BA8338C4670A45D772B8455761AFEF43A4429A1F637D08D39F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725096, "uuid": "663560ba-1ec4-4415-98bb-f40e51562809", "value": "75bd77cb82e3a8826ea92f57fb3fc322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725096, "uuid": "bc0cae5c-295c-458b-9d84-ce3e7570ac03", "value": "3072:BwRzvdqTmFGaNQbPAwODdgSTj5YiPWm2QjcUJZQijPG3zbHTKk1pHsD+VJ:szVqTobMPAwOBOEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725096, "uuid": "0a9787ba-78e7-433e-9302-4577e2476537", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725096, "uuid": "55643f71-61e9-4a0e-81be-33397f183d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725096, "uuid": "75732df5-ad9a-4f73-959e-f15dffe17b18", "value": "943cd759c65b91cf0dd91e0931d376b6ab282d732c7b6d899ced27dcdfeecf3a_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb1c58d-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725765, "uuid": "03fd11db-0aa2-497d-8388-f5ccbfa0d455", "comment": "Malware payload", "value": "35485764901d7e57619965d3600fd37c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725765, "uuid": "7d4d721f-47b0-45b8-8031-7575277e4445", "comment": "Malware payload", "value": "944f915682809176b53242c1ffce0ab9744cd35430cd32aa029fc65873920ee0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725765, "uuid": "5a2cd376-7b7d-42b0-952d-5ca9350550c0", "comment": "Malware payload", "value": "ff85e2790cf990e0c5bf84abde81906d825442f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725765, "uuid": "f1892dae-4f7b-4bd1-835b-04071734a50a", "comment": "Malware payload", "value": "5c284a3d497120ae15ba88c087cc94c387cb91d027fc9660c179c2f3d0c204947b5727a9885dee625b2f5af7d6e2aaca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725765, "uuid": "470798a2-770f-4f86-8143-7b9a35d1ecad", "value": "T186A3485B62F640BBE1B7863884A34A59D772B8411721AFEF43A4425E1F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725765, "uuid": "e287c60c-e1a6-4621-8a13-9113936f6d24", "value": "6e40dd989a690e1c93e75286b2cb632f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725765, "uuid": "2a2ef426-db46-4dba-a30d-2003db618201", "value": "3072:UIN/yTQIhGySQbrAHlmh3evmSOo2iePG3ufWC+vr//T/7nM4L3zm2Q9ZVbq+b2+1:b/GQ+EMrAHliANser", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725765, "uuid": "f3f60698-e54a-4b4a-a4d9-57a4f408c386", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725765, "uuid": "3eb5f267-7241-4c82-afa7-8b3313a0d445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725765, "uuid": "ec0e1d36-d601-4bd6-a968-898632a840f9", "value": "944f915682809176b53242c1ffce0ab9744cd35430cd32aa029fc65873920ee0_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba7df99-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687189, "uuid": "fc31c038-053a-4af0-92dc-b7c7e24d5621", "comment": "Malware payload (SpankRAT)", "value": "ed7df1111fe8b2a86488cc047fc062dd", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687189, "uuid": "63541a85-e28a-4fee-a387-5d55e2470baf", "comment": "Malware payload (SpankRAT)", "value": "947d78b40c43cd849be4b2cad77f6d1b11757ac6fe2c1b1c43254c5f6a25367c", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687189, "uuid": "7c8631a6-ef9d-4063-abc2-b43a963a7063", "comment": "Malware payload (SpankRAT)", "value": "c7a69538550c9f3d77956f13c56cac90ea853dd9", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687189, "uuid": "3a6f37be-97de-416b-a80d-b25ec985c205", "comment": "Malware payload (SpankRAT)", "value": "a0d04220f930a38d43d7dcd6058dcb46acb3ffe4ce21aa6a4029c78837a73488de0525bfb4e9a0becd787cc10bd82ad7", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687189, "uuid": "ed7e556a-537d-4669-a55e-219a43801425", "value": "T155253C137F4689E9C5CAC8788357CA664E2330DB0B35F9DF11C626283F6AAB56F1D214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687189, "uuid": "8ca1705c-5dc8-441d-a42e-3a350883758b", "value": "74de2a662a72eb067ba749bd00ee0b92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687189, "uuid": "ba333c04-2c28-4c89-b274-c16e9d4c9b24", "value": "12288:N2TEZwLf+maCT1v7WJFqdMz8cCQ85G3CwWHmfFDhHIED1Ilr:N2Z+mdT1zWJFbH05vsFRhOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687189, "uuid": "e01c9f2c-2fe8-4809-845d-8bca6cb50bdd", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687189, "uuid": "7fef213b-b314-4262-b478-bf9274d3888f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687189, "uuid": "0bd9a4f8-17ad-4a12-bc6e-de144d0efbd8", "value": "947d78b40c43cd849be4b2cad77f6d1b11757ac6fe2c1b1c43254c5f6a25367c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db1728e-3c57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776648162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776648162, "uuid": "6650f726-c085-4657-bbaf-591327f09971", "comment": "Malware payload", "value": "7e62d287bd12d989627c8b4be312961d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776648162, "uuid": "e7752127-e956-47f9-a35b-408ae7b677cc", "comment": "Malware payload", "value": "94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776648162, "uuid": "195ce51e-63f8-4c33-91e8-2d4eeee12998", "comment": "Malware payload", "value": "231db2731cf32a73e0c74b5d1777b81693468215", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776648162, "uuid": "5b0820d9-7dc8-4296-b8f4-e78f45c2dad6", "comment": "Malware payload", "value": "65caaa27c488593e1a17425a4ec9f74e49c60ea5d63f624425afae99ef9613410f2b15451fc8e4fc0b1594fb8e00118e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776648162, "uuid": "48f4c2d3-2550-453c-b7f5-098266b1d3b4", "value": "T19B5733D6E0774FD7E42ADA31D9365EF486913C208F9988336E34B72419B3BF0663A446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776648162, "uuid": "9746219f-b2e4-4cd1-afd2-0d4dfa119a58", "value": "786432:elPJgjvnm74hR/4QzYhbYSS8PiDF2uTbXHSaC:etJGejkDFTXXHSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776648162, "uuid": "d81c8c0e-8943-48f2-a339-f964d111115f", "value": 29544448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776648162, "uuid": "fb7d0d6f-f855-4c54-8ab1-8118205aedd5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776648162, "uuid": "cdc6de5b-8f0a-4941-8d32-922e43b45b5f", "value": "Home Days.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0212f04c-3c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644975, "uuid": "47edf759-ed46-4405-9b8e-3b6b5be26f3d", "comment": "Malware payload (Mirai)", "value": "e92fb78bed113ef8d74acf7d70c08572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644975, "uuid": "da78b615-af90-4a26-aeec-6a846f83e6e0", "comment": "Malware payload (Mirai)", "value": "956a2e661a24581fbc638794fac6e6251ba8a241fed69a8fee81683e75c44b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644975, "uuid": "b7bbe3e7-e363-4ae2-a3ca-190f9c9027f6", "comment": "Malware payload (Mirai)", "value": "6da12a76f5e8dcb4de71016d4f9b37677718a5f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644975, "uuid": "8e9ed93f-4a8f-4b19-976a-ae271b39fdcc", "comment": "Malware payload (Mirai)", "value": "782fb02045d07778af45c0e4ba195fe591e3efee2dbda0a4c18058168e25fbb6ec816f4ddebedcf8c7f250382bd8e1f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644975, "uuid": "39d2ca8e-3065-4b6d-91b2-b104e0140141", "value": "T156F2F892B8929D26C6E4237AFAAE018D336163E8D1EF3217DD215F047BCA51F0D67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644975, "uuid": "b8cad4df-0c60-451f-85bd-b72fbcb5483d", "value": "768:KY8dbugYpYSaHXsL7uyMln5EPC8wa80eCSCc5TZxY4o/i/IPN:KLSgjtXrL8wQYZxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644975, "uuid": "d11d827c-0685-441b-8730-b2cc21b1f999", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644975, "uuid": "633f530d-2616-40e6-9a02-633b3785abc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644975, "uuid": "13f98050-038a-4445-96d0-8dd349495b93", "value": "00okarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9991fbaa-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725545, "uuid": "87397cb6-6f65-42da-89d0-b6c06846f6b8", "comment": "Malware payload", "value": "f4ff12e212c1ad5d4d470d42f8167df4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725545, "uuid": "d5089d7a-7067-41f8-8995-d3c786ab9b65", "comment": "Malware payload", "value": "95d0aaa646b298f2236988a7251673c9fa0f6a760b3eab17367e45ba1ef4fac2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725545, "uuid": "a1705b68-bd76-4347-a323-c2e59521eec6", "comment": "Malware payload", "value": "339630a876da7c1241e532252156e5d8abb5f9f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725545, "uuid": "63ba9894-048d-4908-8c5d-af313cb64fcc", "comment": "Malware payload", "value": "0d48d4a2548bab5fe61820d09151582a9a102b2b7c06e456bcc3fdb19c030ab9eed4c737071c7495c3136378644e55c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725545, "uuid": "17dff279-cf14-45cc-8642-a3b9c0f8dbb5", "value": "T173A3395BB3B600BBE1778239C4570A45A772B8510760AFAF43A442AA1F277E19D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725545, "uuid": "d937a7ae-1bf6-479e-acd3-494a836c9297", "value": "4ea148f32e295a7c4d07e25bf7296d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725545, "uuid": "15742f8f-359b-46f4-ad9d-3e3f77df9b4b", "value": "3072:g3qp8VeI6CQVOuHIicGm4TpIS/GWmATME5JAST/2njLhbC3G1MSzoQsmaZ0HClG+:nWVHsOuHPcT6Qw/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725545, "uuid": "eb48b57b-1c5c-46db-a2bc-0641188eec23", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725545, "uuid": "09e04b22-0e6b-488a-87e0-32a0f90c8b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725545, "uuid": "ea6a7889-5ea1-4ab9-bd44-ae5824484909", "value": "95d0aaa646b298f2236988a7251673c9fa0f6a760b3eab17367e45ba1ef4fac2_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100327f-3c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776670582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670582, "uuid": "efda1aba-f027-470f-9a89-14680163d00f", "comment": "Malware payload (NetSupport)", "value": "26df03688c6e6cf30732fdcff2038bdd", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670582, "uuid": "ffdff620-be22-43a5-8d20-239c6bb35bb1", "comment": "Malware payload (NetSupport)", "value": "95fa05ba62542d1a3c8dad6e079dddcf29849e175b9e4452c74ea43cb986e05e", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670582, "uuid": "ba6b2d0d-c971-49c3-82ae-983be6ca33fe", "comment": "Malware payload (NetSupport)", "value": "b46c7f79d3901c3f27f033fa2ff42eff3ffe28af", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670582, "uuid": "bbb29502-ef16-4132-8994-ac8e8dcece91", "comment": "Malware payload (NetSupport)", "value": "a98b6308761b2191c9b65df7883f7df219baa83392329be492f9c11ea9acbb01830751d72e9ff95e99a1b1c1d4c59211", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670582, "uuid": "7bb5ef9b-bc35-4df2-b06b-069672c92caf", "value": "T145A2E130A77CE295FB5C4AF3B7D7794C8FE810681740428AD99CE8021B4F7EF1156165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670582, "uuid": "95343ff5-e9b4-4b04-a269-2572041a04d8", "value": "384:aXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NlT:aXKuqXS69Szi/urdMt5lBUeuhJrsRxLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670582, "uuid": "6dd0599c-1dd2-43f1-bc94-5731896ef19f", "value": 22297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670582, "uuid": "8858d6d0-2ac1-4bc6-aab5-393322e4fc0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670582, "uuid": "cc14d086-77f1-458d-ae5c-4e41d416bd3f", "value": "spam.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8943c879-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704902, "uuid": "7d0a9c19-bbb2-4370-85a9-1e743fe7297a", "comment": "Malware payload (Mirai)", "value": "26297028d1b9a4c9bac5a2ec8c3117c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704902, "uuid": "85bc99f6-c8c5-45ae-87d5-fd2f8c64b2b8", "comment": "Malware payload (Mirai)", "value": "9639d5501a5439ac57b008392168aaa059a037d0b6723a554ff4c609b32766a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704902, "uuid": "4e3f7c86-35b8-46d0-9cc5-36b3c4bf2ee0", "comment": "Malware payload (Mirai)", "value": "9da9394b9c2a8c1a982a99fcbf3c57271be6c27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704902, "uuid": "6a6c4b57-88e7-41e2-b8a2-da25107d257d", "comment": "Malware payload (Mirai)", "value": "c861470d1dd9b23a5cc4a41467e0d10b1b7d8b4fdda1829c3800419fe34c6a167df2c9a288eb9518bbcfd65943aae539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704902, "uuid": "87681f12-2f3c-4a4a-8ecd-8d7ac0284da4", "value": "T1BE633BC9F983D4B6F996093010B7FF679D72D6BF2168CA03C3A955369D22503E412EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704902, "uuid": "8c8a84df-3fc7-427f-8d40-9209a905fbf4", "value": "1536:kXyNXgRVjkGIsnnF7gbvDhWs8Zq3phZS5fS:g8XMjkGxnFEbvlf8ZqifS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704902, "uuid": "cc070698-8086-4598-9ba1-b35f584ba877", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704902, "uuid": "8b3bbd58-8cb3-45e1-b882-57da600fddea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704902, "uuid": "81cb0fd6-92fb-4cce-9fc8-09b75fb56976", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b92bde-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725403, "uuid": "69e7eb3e-2943-4838-8785-8b8549837cd3", "comment": "Malware payload (EvelynStealer)", "value": "26df83060d7aa09e6adbf8db4739394d", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725403, "uuid": "a6496009-59f6-45d1-a822-44c5bfe84517", "comment": "Malware payload (EvelynStealer)", "value": "96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725403, "uuid": "6679ed47-e125-44cf-b502-330548c0b6dc", "comment": "Malware payload (EvelynStealer)", "value": "6a4105d904ad9f68454cda2fd86992cf803780a4", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725403, "uuid": "db1fd111-9e3e-4edf-ab0b-13409e308328", "comment": "Malware payload (EvelynStealer)", "value": "883b6a0f98f2b0fd5b4bd57f1806bea7e109e0d0539ade09741c8fe77fb5d19ffaa3c01daca0026a30e818e638140d4f", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725403, "uuid": "1781c16a-1082-4d17-8aad-bceaad92254a", "value": "T15EF3F906B3D720ACE577D1349ABBE173BA33BC254630AD6E655489383E21F50B938F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725403, "uuid": "1485ae1f-68e5-498b-8979-358f6ab628b5", "value": "ddba7c71bf9688b3086b26f8a636070e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725403, "uuid": "f91de6eb-70bb-4f0d-ac0f-4e8f4be306a9", "value": "1536:6sppsoWPy6wpnj3VIXQYh/shPvByWEUUq8Wsn5oNogAZ/ZPfcUv9SUKonYw1xxNx:EPyBjgmBWC8WsnGdAvt9SnonYw/giCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725403, "uuid": "b284cc93-dc65-4242-8753-56c7edc72198", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725403, "uuid": "776f768e-3442-4bfe-a505-7a1616884816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725403, "uuid": "6af89d3f-67e3-4533-a8ec-adcf475c5417", "value": "96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467a1ee4-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724976, "uuid": "bbe06113-d442-48ac-97cc-e04515cf4251", "comment": "Malware payload", "value": "ac2cffb204e0660dc6e7c8e3061e5098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724976, "uuid": "a17b2b01-29a1-4fb4-a790-a3d6365e3ca6", "comment": "Malware payload", "value": "970496f353acbff4c61487951b1531c53d5c6ac036843e81e32baca1f214b619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724976, "uuid": "905f2465-385d-4ee2-9d51-7565d9980821", "comment": "Malware payload", "value": "a3002e4a7a4d5a86c231a73c4ec7a69affef2cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724976, "uuid": "ddd39329-4efc-4d80-b00e-63566298a3bd", "comment": "Malware payload", "value": "c139057772ad06324194d47f21c8305741131a0b4b2c0e6f5b6f338a120624af502cae77d52e34364963cf6b327bb436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724976, "uuid": "eea36bab-033c-495e-ad57-5e1c1fd272ea", "value": "T176F41993A6E70CE9DDA3677C62C7D2327635BD7087368F6B9204C2312E035D06D6AB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724976, "uuid": "671d0552-55dc-4f1d-9148-b3080a74ef36", "value": "56b1e392abfd03b64a7162497fbdd201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724976, "uuid": "b6ac8d37-0caf-4d59-8a33-89f1ad4775f7", "value": "12288:vl6c5+h8eNS+IsjWe8SHhQF3xDPvbaj4n:v5+GeNSmjOxDPvbaj4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724976, "uuid": "c6870057-220a-4ba4-9c79-ba3f9a54d576", "value": 790176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724976, "uuid": "0c63240a-db32-4384-b40b-4c9a1c731e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724976, "uuid": "8b212058-eec7-46d0-b41c-1631976b6ce4", "value": "970496f353acbff4c61487951b1531c53d5c6ac036843e81e32baca1f214b619_cfe4f52c-0314-471f-aa3f-5e7e1f503c09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec27236-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675195, "uuid": "63f4d2ac-b3b1-4efa-8c66-58bdd870eb66", "comment": "Malware payload (SimpleHelp)", "value": "0078008274008fb2bbfa1b099bcb094f", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675195, "uuid": "f4376b1f-cef7-4365-992f-7f4f07e41092", "comment": "Malware payload (SimpleHelp)", "value": "9726589efb9a9524b7bb01ac8bc4c77ce637ea2bf24a517aab60ca3269b45ca1", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675195, "uuid": "775c6d66-fe46-4360-bf0d-5c21b6356cbd", "comment": "Malware payload (SimpleHelp)", "value": "8742f98b31dc5963a127dcbba4cf9f7440e848cc", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675195, "uuid": "a753fc5e-369f-4e40-8788-bba20d42f486", "comment": "Malware payload (SimpleHelp)", "value": "33757f81580e95dfffa671d63a9dd0e813c781a3ff6a722f4e9d459d994d0d1f030a4728e8d2eacf54b082fe9da254d1", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675195, "uuid": "23dd925e-7b17-4ad6-8d11-805d1f09ae0f", "value": "T13BD43B34E2E15DF9CF37A5FCD08A4497A79BB9A203C4026717F086E28B613D4542EF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675195, "uuid": "feab524c-224c-4729-94da-b3296685fb1b", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675195, "uuid": "43e5cfcd-df27-4017-beb2-7a1b76ad913e", "value": "12288:kNLU92UOpzDapJtJRoNTOZHZ1zZ1IcrHvZsz:kNLU92UOpzDeJyhOZHZ1zZ1TvZsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675195, "uuid": "9ca9585e-e484-48a7-8159-fa0690af4afe", "value": 648928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675195, "uuid": "0a81bb40-2b83-48c5-a2fb-f1ffa57cd9d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675195, "uuid": "455bd1bd-f6e4-4df3-8150-6cffaaf68f83", "value": "9726589efb9a9524b7bb01ac8bc4c77ce637ea2bf24a517aab60ca3269b45ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdad9a27-3c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1776670630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670630, "uuid": "10ca0a92-3969-4f7b-ae9a-33ce892d8fb3", "comment": "Malware payload (DarkCloud)", "value": "23d1164299343f22018bd95211a14da4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670630, "uuid": "039a6f35-7098-44ea-b757-33b1c8716cc8", "comment": "Malware payload (DarkCloud)", "value": "97713517f0ec628d36082e569f162b17a6d16fba1d14c07a7cc5f43402d80927", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670630, "uuid": "36b7354d-7e00-4577-8fcc-83b1901f90be", "comment": "Malware payload (DarkCloud)", "value": "c4281a47e65af76affc48b9de73fdcb6fe95b0e9", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670630, "uuid": "ce3b1073-f8f4-4351-85e3-9976529fcbe6", "comment": "Malware payload (DarkCloud)", "value": "9be511bbfaf98f0762af25d0b66eae7a9b708af399e550d4fd8ab9c349e2ed2600d0d2561a7088f1851095113bd37af4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670630, "uuid": "887dc090-f310-4149-9e5c-3f6d718cfb1c", "value": "T1E3451221632FC813C552477889A1D4B227B8AE8DE962C64B5FDA3FEFB4383065755383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670630, "uuid": "3a301bd2-2749-41dc-85b8-ed19f1e31c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670630, "uuid": "cfaa4ea0-ff08-4476-8c56-07092946172a", "value": "24576:PXeqWTr7/QhBudl8C6hwCGohpb7COUuITGeI9qd/rOoQf5:POq+H/QIz8CmGIpH2uITrIqe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670630, "uuid": "e7cd77c8-452d-4995-945f-106a66016d89", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670630, "uuid": "8292b6be-8c14-4985-8141-d1d72a62e149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670630, "uuid": "0fc01119-067c-4e37-a605-798743200207", "value": "RFQ-14042026_47455755.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9587f06d-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725109, "uuid": "ef78c1cd-66cc-464a-8699-46e95d28f88f", "comment": "Malware payload", "value": "5013571e104d9dd42ca2d94e81e430f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725109, "uuid": "8287d562-d95e-49d6-b68a-2e2a8bc97dbe", "comment": "Malware payload", "value": "9783cdd475c54ec21a035b5035c80329fa14be830c71c7c133de06ed98ad86d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725109, "uuid": "2ec236b8-f67a-4607-9466-9168f0607a17", "comment": "Malware payload", "value": "0e0e2b2f1688b77ebea638aa2e12f6462722fcb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725109, "uuid": "a7949c8a-f118-4d97-b82b-6227efc9d29c", "comment": "Malware payload", "value": "b1cc1882b572ee420ccba904c1651558d26c2fadbcf75e8a9ad113f7ff6355f0fe1a0fc16fed0c5bc54d6aa85e897d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725109, "uuid": "b242a56e-b603-4f3d-a2d4-dbd85340b4a4", "value": "T1F0B529557B168C89C2AAF13CFC46B909EBB3399163765AF785AE17921F132C41E3DB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725109, "uuid": "15a10b0c-adee-4c76-85bd-c855bc4561d2", "value": "316783ff6558dc4e06512defba4ab2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725109, "uuid": "da08de6a-59b3-4008-8063-0dda88abccac", "value": "24576:oKkVrHgHx4mYlt+e5N2lWByqwSFg9NJo7thp9clBb2:Huri4LltP5NSn9NJIclBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725109, "uuid": "652a8a38-d2ff-4aa7-ad36-8a3addf6eec9", "value": 2379576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725109, "uuid": "d34e44b6-a58e-4277-8b96-06f5249135c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725109, "uuid": "76aa28dd-8896-4b79-9b00-fa975882630b", "value": "9783cdd475c54ec21a035b5035c80329fa14be830c71c7c133de06ed98ad86d8_zoom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01198c0b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724860, "uuid": "da358279-34f6-4004-be78-641bccb0546c", "comment": "Malware payload", "value": "f9af1a39dc368e0c83877d78a6c9eac9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724860, "uuid": "8b5d126f-bb7c-4002-a181-f57a0cd6c0ca", "comment": "Malware payload", "value": "97ee55f9829b73bd5ddaf8766ca6f9c280512f99b0f7031f5bc0850413bd7a68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724860, "uuid": "e75d659d-c3b1-4aff-b453-f77fea28cf1b", "comment": "Malware payload", "value": "34958b72c58471cf5b9f8126fd17b0b952905f83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724860, "uuid": "e3684e95-333c-463f-ad8e-f284751f53e1", "comment": "Malware payload", "value": "a4679e886dc892bb2963cdbeb998f95e09a3357d67b2f86995daa67e5b2dcb89d028787f1fef659b0b7c3d6e8c88f46c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724860, "uuid": "953be7e0-fd0c-4217-8b26-ac974c019bb5", "value": "T19EB59E07E6D644DDC459C23487AF9232FA3178598B24B5DF2A809A152F3BFD06E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724860, "uuid": "9d149232-67d0-43f6-9e3b-56012a29b024", "value": "14338d2168d869b1b53d66354179e8c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724860, "uuid": "944bddc0-a175-4421-ad41-aa6300310a94", "value": "49152:vo4J8C121UxEjjfXYOB/yOW+SfePkVvGzVKhxy1yTjQVCU5/kJpw5ddj02bO/Bkg:rJgAOR1W+O51xQyTjQVCU5/kJco6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724860, "uuid": "6f64f295-1726-4924-9fda-0fa44a77616d", "value": 2455488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724860, "uuid": "24589821-43aa-431d-861b-8887a6011a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724860, "uuid": "8141b324-3e5d-42b7-857c-b968ca96bf19", "value": "97ee55f9829b73bd5ddaf8766ca6f9c280512f99b0f7031f5bc0850413bd7a68_ffmpeg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71426808-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725907, "uuid": "6cf0be62-0719-469d-b6e9-9f56e688dcfa", "comment": "Malware payload", "value": "0776af15eb224c875d7b350910f0112f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725907, "uuid": "1601da7b-de9c-4347-b343-71f3ce0d6ff3", "comment": "Malware payload", "value": "9889e9699fdd5811c425b1112879f56c80ae20da0e050d8cb5a6e1c84df825fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725907, "uuid": "11a44760-4abf-49f7-984e-22ea3fddfc98", "comment": "Malware payload", "value": "72a20c238da00b43e69792883e8ed334d1605579", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725907, "uuid": "c6f15bc0-6d07-4c31-b68a-980de81555b9", "comment": "Malware payload", "value": "75b22fca0b4442c9826832e1ffd8a72db4f96f445ce571047d5cd8da64860bf82a164b07d9f998d2ab595da3f8a9e494", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725907, "uuid": "219ccd48-d060-4b9d-8d9b-2a2a46d7ff0c", "value": "T15F82F80EFB4BA8BDC409F27858EF5732F572B53706266B2E1318DEFA4F00554666E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725907, "uuid": "c845280a-9ca4-4736-9e1a-93f5040fbec3", "value": "7e6047e86dfc28c96b06e3621db487ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725907, "uuid": "ce5e52cb-8037-4b6f-a941-0f8907f28877", "value": "384:YSqD9rVFMtoyJxH7Iw7H/YE7UmckVPxIiTrBX3qWLkN:Y9D9rTTWJIOHOmckVPxIiTp3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725907, "uuid": "2caeb10b-5881-4a1c-a88b-55c994146b1f", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725907, "uuid": "b02be710-00b7-4af0-a657-4e3b9b669c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725907, "uuid": "2b042e6f-064e-4aaf-9a25-32ded9514cb6", "value": "9889e9699fdd5811c425b1112879f56c80ae20da0e050d8cb5a6e1c84df825fe_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab3e04c-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776686865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686865, "uuid": "feca93ad-6adc-4b13-b5f1-2a5cc4079ab2", "comment": "Malware payload (SalatStealer)", "value": "bfd6c42f9fb19690fe97972d15291857", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686865, "uuid": "14b4582b-74f2-471a-9bbe-8e5fcb2c056e", "comment": "Malware payload (SalatStealer)", "value": "98b82faabf12d81b8c73aafc6b0291079dc1755e9ba7db36af81b23459640993", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686865, "uuid": "38fa6714-a426-48b6-b7fa-fcaec8e661d0", "comment": "Malware payload (SalatStealer)", "value": "3925c08a2bc9e28291d953a8243b7f3feb332d5e", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686865, "uuid": "8cfc15cd-0ab3-4f87-9d2f-f4af43eeecdf", "comment": "Malware payload (SalatStealer)", "value": "f4d8fddc565b9dc7329ba4b0e895948f25fcd381e10d63d9bd9a73963ab2777d8763e6aae4eb29cb9b805494ebd8a477", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686865, "uuid": "37a528ee-fccc-426e-9bd3-b10b24ef06eb", "value": "T118263302E9D1C4B7DD6B14B17834E7A44DFDAC202F12CCF76BA8587656203D14A7AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686865, "uuid": "a5848fb5-974d-4b1b-aeba-0d2fa0183b8d", "value": "5ad0614de2f5b18c443a2046f90817f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686865, "uuid": "6ba882ba-26ca-4de5-b2dd-420357bbf4bf", "value": "98304:ThBaM825K7VDVdyJKhFZN9sjK7Twhdr4qSEAzOE73vu7ExY:baM8YcVD/g2N9lP8dULEAz5u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686865, "uuid": "e9a5e492-8712-4bc1-a6f2-b239c6f49386", "value": 4704840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686865, "uuid": "3c0bd5a3-8198-459a-aa6d-1721e81a6732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686865, "uuid": "e3ad9560-4cad-4ed1-be38-973d3da0bd3d", "value": "98b82faabf12d81b8c73aafc6b0291079dc1755e9ba7db36af81b23459640993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a550284d-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674025, "uuid": "80528f0a-ac54-4616-9893-ff1ecfe420e0", "comment": "Malware payload (ConnectWise)", "value": "e44ec2b9dee0276280d5f050b8ea6c4d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674025, "uuid": "91580743-5b83-4258-876c-1d67c8c8b0e9", "comment": "Malware payload (ConnectWise)", "value": "98c112ecfac96b785430e5c33131a60283f98c27615c76205df935642a0f5c05", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674025, "uuid": "83e4cbc5-2ab9-4726-8afc-18dcbec27f66", "comment": "Malware payload (ConnectWise)", "value": "8b612e888ad93af1f8349ec8c6f3b7ae5a64d8f3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674025, "uuid": "2b6c25d7-4a9f-4e6d-942a-43b0cabd51c5", "comment": "Malware payload (ConnectWise)", "value": "1798d4f124553a7fa8d461d97c9c0aec2b177fcb41c7acf4aab600b9c47dd7ba5b4ae5a4b26eb740408bdee2b7cac461", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674025, "uuid": "446ed384-525f-427f-9a78-6751b6c81ca6", "value": "T1C046E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674025, "uuid": "f483f0f5-1e72-4546-8cd4-1f7c2288d5cd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674025, "uuid": "eccb5f24-b267-472d-a2e3-0cdf7edcd5b7", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zligLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674025, "uuid": "e976a071-7996-4597-9f9c-e0c386deee4b", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674025, "uuid": "3e5f38b4-2dcc-4f9f-b634-acb8ce63f991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674025, "uuid": "3f992e92-31e1-4611-a587-0a78c5729028", "value": "98c112ecfac96b785430e5c33131a60283f98c27615c76205df935642a0f5c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcd6beb-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644971, "uuid": "d0b60e05-f9d2-4a4a-98aa-7064d3f4d984", "comment": "Malware payload (Mirai)", "value": "cb6f88e1d269e87f8f8d9926ead17f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644971, "uuid": "ac948e2d-4ccd-4e60-993d-1835c1527ced", "comment": "Malware payload (Mirai)", "value": "98d09a1953100ec6113eac0db272966c649c628bed1ef57b583c84ae82833ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644971, "uuid": "5a865557-9843-4f16-96e5-43ec76c81798", "comment": "Malware payload (Mirai)", "value": "e09b12acaf5a02d7b01cdd54909948aa0ab2a256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644971, "uuid": "81fe180e-f574-4375-b904-1b379eca85bc", "comment": "Malware payload (Mirai)", "value": "994675b3e31a520f6973bb3c754bb2d0cc311cc02309e26261520034989cf2ae8aabd41bf8fabe609f92ca20237eb751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644971, "uuid": "6b2aec15-0494-485f-854e-3f21e1b5916c", "value": "T1A6035CC8B903DDF8FC1606F42136F77A9BB6F07A2128DD97C39995329C42A05A5062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644971, "uuid": "1700f560-5264-495d-8198-929326d66b32", "value": "768:wZT8epBPi4gJW0KMcjp49A9/YuEGatqU3EgouBnk6Py5iE9Ee4V:wZIezPi4gJW0KMgp49Ax8Rv3FxBnk6PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644971, "uuid": "2e9b3189-3385-4ed6-b5f2-37668cf41b0d", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644971, "uuid": "9cac7f52-a89f-4193-940c-3b101e89c9c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644971, "uuid": "ecceb10c-f116-4e78-84f7-4c442cb36b19", "value": "00okx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4b2946-3c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668722, "uuid": "3130d139-2f9d-4d5b-9d04-d13710d9a622", "comment": "Malware payload", "value": "ab44b0ee8765df08fb5c4f866f0017f5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668722, "uuid": "d430b043-a2d5-4144-bf58-97370cd7f503", "comment": "Malware payload", "value": "993fe5b6064ed3730565d0794593f6acbd396d6cfb25a4fabe50abe35fa9eb1a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668722, "uuid": "5826a492-8859-445b-879d-6e311c2b24fe", "comment": "Malware payload", "value": "cde0ea4dd689808ae2f64fb7096e94c7d9a90ffd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668722, "uuid": "4b990a44-1f1d-429a-b388-2453d499f251", "comment": "Malware payload", "value": "c638c6b407b24fb0d9fe468de6114195c879d9e1a9c7d2a30797602be6bf9129639df59e237c601159dc2a6cfc58afc4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668722, "uuid": "b763c828-9d1b-4eae-88cc-19037a7f27b4", "value": "T1E0B77232CE450D678AF2627C69658AE3FA70AF2F1380591BBDBCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668722, "uuid": "0e7860ac-23b5-433e-858c-6f2fc7d7578c", "value": "98304:bR8Z7cB7zzdaRgVQp/A47EACJgvDOcumhsa0Ds8HIqb1Tqov8m:btmgVDc8Mp01H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668722, "uuid": "209b465e-078a-4ec8-b3af-ce2902842aae", "value": 50282496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668722, "uuid": "d7722845-0dff-4c0b-9877-602a0f04dfdd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668722, "uuid": "de12ef8c-c7af-4726-94b7-87a20881456f", "value": "993fe5b6064ed3730565d0794593f6acbd396d6cfb25a4fabe50abe35fa9eb1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13920e6-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776697721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697721, "uuid": "6f8b0f71-1cd5-4628-ae60-4bad88b25c86", "comment": "Malware payload (PhantomStealer)", "value": "252cd4154bde69cd7379c4aade282478", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697721, "uuid": "a830e54f-6180-43af-a063-16c5f2be0917", "comment": "Malware payload (PhantomStealer)", "value": "99498a2f2f68138f9977ab8d2d571d568c2835bdbfbdce7dc1d1a58a3c6cfeb7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697721, "uuid": "9373e5c0-bafa-430c-96fe-d3974aaeef94", "comment": "Malware payload (PhantomStealer)", "value": "19dfd223b05e9ae180680a63ddafb5d659006106", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697721, "uuid": "a8c99c33-a6e5-43c4-bb82-9cffdbe7f935", "comment": "Malware payload (PhantomStealer)", "value": "92a9ff304814b965471d10f3819db95dca2b74b4ddb4d46e42b9991b960af030dc83e828f03ec7450cad0c22e457b247", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697721, "uuid": "d0bef0de-ba28-4062-8b7d-472da5acbcfa", "value": "T1CE336F74290C45EB2493EAB4B088A7E3FE6C0A5C9FFD664F525487DA163E68734C39C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697721, "uuid": "7d7118af-f012-4a0c-9da7-ed38b25189bb", "value": "384:4mjDAHKVSBd3M455g/iLfzMc/3hfx+ImXIl8P5zdBNaW4t6gxh8H:fjAMEdc4gcA+3h4Imh/aWXSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697721, "uuid": "99869391-d441-4f13-83e4-40ba8c4eee52", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697721, "uuid": "6d9129a4-0fac-44dd-950d-88053270479a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697721, "uuid": "08b11867-c96a-4920-b031-eac93afce33c", "value": "TELEX DOCUMENT COSU624829327492.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245d3277-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725348, "uuid": "dd38a2b5-7439-4cd2-8245-190b20ed3eb4", "comment": "Malware payload", "value": "7b7408a631489a5ae03c2fbffb6a1a35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725348, "uuid": "c308098d-4822-4de3-adec-cb94f5216a88", "comment": "Malware payload", "value": "998850f059f77af729887adc148053d64240fc891a7150e153a4c02e756bd469", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725348, "uuid": "3c0dc8cf-1104-4229-a46a-66eef8159260", "comment": "Malware payload", "value": "e35d47aacd5b3aa599564acb80a1b2fde25a4ebd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725348, "uuid": "1f23e65e-b7f9-4424-a53e-b13493f91d96", "comment": "Malware payload", "value": "f0a5a8d5847bca9542e6914ad41b2806ac30fbed0fe8231ab4c6d70c0af62d00ee3fc361dfd91aa163a8891d7a0658fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725348, "uuid": "b7d5ff61-b860-4c25-bd99-90ebc5ef569c", "value": "T185341C90B281FDF6EC998FB520D25309A3BAF081971DEB2B6620FE3C025EB54D573645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725348, "uuid": "5e3729b4-dbda-4061-a443-3de4703a630c", "value": "854b6781579c224e49d0da48d91ede1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725348, "uuid": "cb092409-9d03-4262-88f3-50c5c382df3b", "value": "3072:1qsSVl7xAaoU0S+utKnk6sT2l3KVuuHyJOiZPXXU2jp58Jj:/K7CaodS+OKnkt25KVuuHyoiZs2jp5Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725348, "uuid": "4b8ad3f9-aa23-4e86-8690-cab98fd79b83", "value": 236589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725348, "uuid": "bf2e253a-1a63-4527-b92f-89696cff7324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725348, "uuid": "4e280c7d-3636-42c8-87df-2c9e5f251114", "value": "998850f059f77af729887adc148053d64240fc891a7150e153a4c02e756bd469_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d48743-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776725754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725754, "uuid": "12828dda-7573-4444-8a25-8d154721ef45", "comment": "Malware payload (njrat)", "value": "c4462c9d076f107a01d72428a9fba165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725754, "uuid": "f63c6e1f-9587-4570-b997-522dea87a5db", "comment": "Malware payload (njrat)", "value": "9996c2e43037f9099838de7fb185f12b3bfe093c421975664ca6713a326e47e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725754, "uuid": "bb6cae63-1c10-415a-93c3-74f8bc21ac54", "comment": "Malware payload (njrat)", "value": "357a1efe11dc2906df444b80400cefbfacf3e406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725754, "uuid": "ca79e66c-5b44-48a4-bf2d-25f12cd5dd1b", "comment": "Malware payload (njrat)", "value": "340ba7d8f1703161a14d2d90580374332aabb18ec0ce8ba95749359ba87b2238131d8f38378d602d2ec060fd24f4baeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725754, "uuid": "b9c65908-c2c2-4ab8-9f63-62ced7c794e7", "value": "T192A4AE2CB2E04F49E2589F71C8A3462053B7E9532AF6F75D9EA816B26D423B04D4F3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725754, "uuid": "84102e4d-d5e0-430e-b059-c53c1920a79a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725754, "uuid": "fbb7f902-ef60-4b00-94d4-3dba56d7512d", "value": "6144:benAynDOX0tyLOWr1qulE01ooayvSXP61Ie8FQcf+PV5wo9GigQuCgHQSBZCcsYd:iAyEvYuGT61IHGv19l+IcBfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725754, "uuid": "0c2745f8-d1dc-4d96-b801-b1726c9115d1", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725754, "uuid": "f826c495-75dc-42b2-bdd5-ca238e24f5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725754, "uuid": "649aa991-bd76-4480-81c8-f71dd48110ba", "value": "9996c2e43037f9099838de7fb185f12b3bfe093c421975664ca6713a326e47e2_3482a375-4a5a-4012-b705-9c11ebe6d4ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41c4806-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726126, "uuid": "6daf6814-2dfd-476b-acd5-338f7e4fe1e8", "comment": "Malware payload", "value": "3022de3df62e53561874147c42a62240", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726126, "uuid": "fe4ed3fd-71ac-4d27-9fd7-81f792d9b315", "comment": "Malware payload", "value": "9a099a4c8f6fc22bbf7a76cd2d9dcfcb1563c3640f629710d3027ae126259de0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726126, "uuid": "33fc9e7e-1757-4516-b0f6-45c06c4e317a", "comment": "Malware payload", "value": "167c7812c0d1b14ebf29a453738562ab329f478f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726126, "uuid": "906935c4-fc9e-4cf6-a629-96aeebd6a49f", "comment": "Malware payload", "value": "80e86fb415c320e049f7ac807075f01ee3531e83751d4073f16094cd8da198911d50d1e631a1932dfedf824bf991d942", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726126, "uuid": "76f29c02-8bde-4a47-86d1-025bee21f56a", "value": "T155A35A5B62EA00BBE2B3863984930A49D772B8515760AFFF43A4425A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726126, "uuid": "9259fbff-6309-462f-8b63-557190068441", "value": "0b8e97d490fe2e1a78d04da382050dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726126, "uuid": "a964acb3-f327-43e9-8721-a43587b66bd9", "value": "3072:BFH9NTTYLNAcjQ9ARUjsavmSO/7njPL3cIbHD2GgNJlLJKNryouFbnk3N6VVuJ:BbNPYRhAARUIaw3MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726126, "uuid": "e4892834-e9e2-443a-bd83-a539df742c48", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726126, "uuid": "1c003dc2-9710-4f20-97cf-a7de49e6904f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726126, "uuid": "02308366-d45c-4f50-b524-51fb376a4145", "value": "9a099a4c8f6fc22bbf7a76cd2d9dcfcb1563c3640f629710d3027ae126259de0_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c59a8da-3cab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776684318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776684318, "uuid": "17e76937-0738-4222-b873-0e9e380d2385", "comment": "Malware payload (Mirai)", "value": "6a538e6837d2a80048905f2c281d48e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776684318, "uuid": "896839f6-526a-4c36-a488-1b9023c1a478", "comment": "Malware payload (Mirai)", "value": "9a2c0baeb82b54c63c6959f1dc44b72151f6089185645fd7f4c606c27264550a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776684318, "uuid": "61ff96c7-c123-4a34-ba58-deccb581cd30", "comment": "Malware payload (Mirai)", "value": "ee98b5c301893dc57db7ed013f929e1322dc0a65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776684318, "uuid": "e94244a1-49a6-48e1-b1f0-37e414a23d52", "comment": "Malware payload (Mirai)", "value": "4383f8da3309824689fe59f93dc26c64398b4d7bd5096d3426eb220ae31b1f3264f537d8d389dfdcac27d0d8353646ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776684318, "uuid": "a8495990-dd55-48bc-8750-dd04e310f205", "value": "T125246072985CC587C12262BDA0EEDF7ADD7E72CB2648CE017CD118395AD5FDB2A06D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776684318, "uuid": "2d7c33c6-d27b-43b9-be57-fe7ff06c9122", "value": "6144:dM9Ktu3XxBdFPRix6NF9L99ow8K4MHK0LIeChHfm3a6oHaV+KTZ732:dM9KA3Xl+22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776684318, "uuid": "2000f949-52bc-43d0-831d-1138d235ae5c", "value": 215148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776684318, "uuid": "77b36f8a-9bdf-45be-98a9-3cf982cdadf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776684318, "uuid": "6b2aed20-0f3f-4585-aa6d-cf37a9317674", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e054657-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689287, "uuid": "6a533079-703b-4865-b5b6-8c23dd605cc5", "comment": "Malware payload", "value": "b641cfa068281d9d2bf426f2a772450c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689287, "uuid": "ec501ffd-654c-4cbd-b3f2-099f95403d86", "comment": "Malware payload", "value": "9a7618da0c7a08a5834d48b78a42baca5bed678f31d063740380f0550ec79ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689287, "uuid": "658057bf-fe8c-4d08-a958-6cf3d084779a", "comment": "Malware payload", "value": "601bf68278a1803cbe542851086f9e33e9a978bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689287, "uuid": "7b501b48-7fce-4dc0-8a54-39ad56666eed", "comment": "Malware payload", "value": "5720e4666d2bfdda6fbd6d23c2e0d799f0e1e44393fd209100fb2680699f624369181c3fd2db7504ee43c1c05363940b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689287, "uuid": "9448b9a1-99bf-455b-a264-530f3a08c140", "value": "T103E63C6136A8D13BE1A70AFCD77388B1063A7D2E69448F4D1F31354D1A72B52BA11B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689287, "uuid": "5ed29e09-d985-478d-980a-577f06802b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689287, "uuid": "82b99c10-ff07-4634-b4b4-bf19e905004c", "value": "98304:Cb5Y9Ij1XKfPdJXJG3llZiNYH551k4ilFMyuOz:Cf1muO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689287, "uuid": "31f1e05f-03cf-4e79-ae36-f98f600482ab", "value": 14674264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689287, "uuid": "1f51cf0b-d70b-4b34-9e37-518063fbe9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689287, "uuid": "3e2359aa-d10e-4bcc-b871-a50baf1ccc46", "value": "9a7618da0c7a08a5834d48b78a42baca5bed678f31d063740380f0550ec79ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9f3193-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776688806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688806, "uuid": "0ffe1de0-48c3-4ebd-842f-f77afd8f994f", "comment": "Malware payload (RemcosRAT)", "value": "1fc2638612624b8779a9b5b9316f0fff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688806, "uuid": "2ff39cec-339a-4bee-8b7d-9fd1cfb3d7ac", "comment": "Malware payload (RemcosRAT)", "value": "9a824eccc370507893eb49881bc5222b0e76a439b78afabea228a08fb686e6aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688806, "uuid": "fa333521-cc07-45ed-b7bb-76b9b63452af", "comment": "Malware payload (RemcosRAT)", "value": "43ad4af49458d721b130170ed67337ed89d85ca7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688806, "uuid": "b86e8b51-d773-45eb-9072-9bc3a035e3d9", "comment": "Malware payload (RemcosRAT)", "value": "ebe74841125dbc2f0a303ebe0dbc5ff85c85308ed1887635736649702492266f47e232c456a43b1c701cbf57af7c45eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688806, "uuid": "3e887f17-01fa-4183-b585-acb4717edea1", "value": "T1DE644A70ED2006974F871BECBE581666C9BDE609453714B0F6DE434EA00A5ACFBFD229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688806, "uuid": "175d3437-0437-42a3-a05f-8cdc746c2a43", "value": "6144:qlplXlGl9lEl8clolJ/lPLl6lll6l+lrLltlYtlRl5lqlCTblOlRlAlrLlQlO:qlplXlGl9lEl8clolJ/lPLl6lll6l+lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688806, "uuid": "59575c71-1b21-449d-8401-76a6b7e9714c", "value": 324389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688806, "uuid": "3688ebe2-0d08-4a16-9cbe-5387d011e815", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688806, "uuid": "0a535fa4-a43c-4fc4-a299-ac63e795fd21", "value": "FedEx_Billing_Payment_Receipt_20_04_2026_000000000000000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e0a1c6-3cbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776691182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691182, "uuid": "4e7cf852-8717-4447-88c4-2fb3cb2103d5", "comment": "Malware payload", "value": "eb4f9374ac1852595f474767659faccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691182, "uuid": "48b2da94-6d3d-4f30-bb15-909f3d9dff46", "comment": "Malware payload", "value": "9a91e2139353fbd536aba24fb2346b64fa575415765612360da87563bd8adb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691182, "uuid": "d852d348-f942-4d1a-a025-a36c278eb6ff", "comment": "Malware payload", "value": "31fd07135ed8fcad7e02792506245bf3a1bb98f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691182, "uuid": "b28894c6-a4f2-4ff2-ae68-526748e95308", "comment": "Malware payload", "value": "2f8a6194ca9dee938dece224895baf0b5d398b3da0dfb7901f4b69fab583bf17ae21d4d9e019f35a43a695760d66aa9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691182, "uuid": "4fe0fdb0-1c22-4429-95ae-f4f763617e66", "value": "T13A36BE1537A9D701DCBA473B11A645C053E48406EF9AC7BFF294AE6319D23CDA32A0DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691182, "uuid": "b2c45f14-49c2-4b77-bc3d-4d476712282b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691182, "uuid": "b229a314-8bad-4918-9456-add586ec89f1", "value": "98304:VkaWxsXDqGZVXevswVhG+uN+xwDHaIPwaYcd8wzUv9ZO3L8XA:bTfXeHVk+u4qDHamYctzUvjO7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776691182, "uuid": "1416f44b-7b1b-4849-b88d-658ec1bd5830", "value": 5303296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776691182, "uuid": "521b2893-28a3-42b3-9451-640bb8a9bd48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691182, "uuid": "505bcd65-aca4-4378-bde8-809050702e2e", "value": "SoundPadInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66f2d05-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726104, "uuid": "9010ad6c-0cca-43d4-aff5-1f12dd71af2c", "comment": "Malware payload", "value": "64f9ab3ea1f1df982e11ef745db40fd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726104, "uuid": "38a7b349-e991-43a9-869d-fffdb68b084f", "comment": "Malware payload", "value": "9b1fb32254fbd31fcb8662b287d7600bf9affe5a4e2b0a753416b4351dbd9736", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726104, "uuid": "c785ec65-e350-4a0b-b6f1-d27e8b93b748", "comment": "Malware payload", "value": "6bd9cb79ddbdb75a3fb06873933e0f5512c4a8ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726104, "uuid": "39b317bf-1068-4a7d-8af6-9ff38b64a675", "comment": "Malware payload", "value": "0172b36d774ae4275efb034bc7a8b6590c9c3f9228ad891e9e6a4eddf8c5219124219d3df483ee2a7fc4b5dccef6db98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726104, "uuid": "7dac570d-0228-4fb4-a2c6-d61ef0ca1013", "value": "T153340D90B281FDF6EC598FB821D2530993BAF0819719EB3B6620FE3C025EB54D5B3645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726104, "uuid": "97273531-39c7-44b4-865e-855835973997", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726104, "uuid": "98bfcb3b-a846-4bce-b326-720b4e4d817a", "value": "3072:CBCVl7xAaoj0S+EtKnk/sT223KVurHy9OiZPrJU2jg0/WM:B7CaogS+cKnkk2MKVurHy0iZS2jg0eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726104, "uuid": "83ccf5c6-4864-4b31-a568-1a0ae16c72c4", "value": 241093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726104, "uuid": "a23f3397-32ac-48ef-b6df-fa60a9f12af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726104, "uuid": "b705f04c-0ac3-4210-99ba-7d0473fc8b46", "value": "9b1fb32254fbd31fcb8662b287d7600bf9affe5a4e2b0a753416b4351dbd9736_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa963e9-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674230, "uuid": "a15fdac1-6fba-4a18-a3eb-c56a2d43ced8", "comment": "Malware payload (ConnectWise)", "value": "187da1d41bbd9becccf675559a2131eb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674230, "uuid": "bdb3e795-1474-491f-8a6e-2cd420272fb3", "comment": "Malware payload (ConnectWise)", "value": "9b2c4dbe9e29bea80ad33462a25e757f99aac463943f68cc5a46212b0e494bbc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674230, "uuid": "0efe2e80-bfc5-4188-95c8-1aebd5bb06c3", "comment": "Malware payload (ConnectWise)", "value": "ac437c2a0c28ecd18b5d3390a3523011c7a44404", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674230, "uuid": "00dc9003-bc25-422c-bac2-31e59f17cbe7", "comment": "Malware payload (ConnectWise)", "value": "abfe512b1d4610ff7abf83bf59489692a7f5bf079200c9562f4bdd429ccd591305cbd9f868501efe22af8af865c1e256", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674230, "uuid": "fa27eda7-0005-4276-a36f-57b98f6f9cbf", "value": "T155750110B6E9883DE6F62B32FF7A92605E39FD251E20C15E9394351D0D70A919BB2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674230, "uuid": "f95f7e08-92d4-45dc-a948-a2e343359703", "value": "24576:dZPlmF0uwTKh56Z5vePu/DVeL1pVjeOgnUUGGu/aYmQurhwQUv:Bmh69eWbVypVCDgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674230, "uuid": "c3090631-117b-4eb6-842d-22448538f037", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674230, "uuid": "c08b4b67-f6c1-496c-8186-3dcc2c3e1257", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674230, "uuid": "f867e98c-e4a0-4e32-93cd-9ba33201ba58", "value": "9b2c4dbe9e29bea80ad33462a25e757f99aac463943f68cc5a46212b0e494bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0fd165-3ccb-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776697820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697820, "uuid": "6cab6083-74f7-424e-b5bc-93861451b538", "comment": "Malware payload (NanoCore)", "value": "c202756cd862a2421b0d67f3474769e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697820, "uuid": "19656e93-ecc1-4df0-bac5-954cab592819", "comment": "Malware payload (NanoCore)", "value": "9b434276b0af0ea43fdf71a09ca7687c0a45254ba1a0955a1cf04372d69de36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697820, "uuid": "53023723-cefe-41db-9ec5-2f25225866c7", "comment": "Malware payload (NanoCore)", "value": "acd7c3557ec0fe6ccdadecee0763e5a8f0c8a89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697820, "uuid": "92a9eb86-8d1b-49b2-a761-5287f40cf90c", "comment": "Malware payload (NanoCore)", "value": "ad3b7147e36e950f1964d0ae62daf1e7e8ed15095717629c06072a52fb784379c0f68cbc68f5faef4e9f518be4f09ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697820, "uuid": "0603fd03-504b-454d-b5e8-71762ea759b6", "value": "T14E64AE1577A4B82ED28D467467115172437889E2ACC3F3DA28D872FB7A7EAE101371E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697820, "uuid": "0aaaefe7-6b38-4856-a0b5-76c9fa214ee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697820, "uuid": "48fc4cee-a2b9-44ab-9513-681e234c2ee0", "value": "6144:WLV6Bta6dtJmakIM5el2bTnvHbLOupQe4li2+Y:WLV6BtpmkxizzLVpEs2+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697820, "uuid": "ae847196-93a6-4c4c-8ce6-6a4fba5bb245", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697820, "uuid": "302e749a-8ab7-47ca-88a4-784f731d004d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697820, "uuid": "4b2de8bb-7a66-4014-b175-ef319530a95e", "value": "selipta4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74988caf-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674802, "uuid": "0bf3fd11-6c70-4a48-895a-b53308e1bfa6", "comment": "Malware payload (SimpleHelp)", "value": "f90b8fb6b0fb7add578a5b23353e62f5", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674802, "uuid": "ebec18e6-7ef9-4c7b-b2d1-9a89a2168fbf", "comment": "Malware payload (SimpleHelp)", "value": "9b66d787a38854d79f7788bb1b357759b716de60dc974bb30e02043cb93ffa11", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674802, "uuid": "d8f1a17a-c8f3-4a8c-9f8e-03150260b9c2", "comment": "Malware payload (SimpleHelp)", "value": "d400027166fba4de1177672173c7dd010fa44241", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674802, "uuid": "26c4aaf7-de91-457c-8732-deb123c41a4d", "comment": "Malware payload (SimpleHelp)", "value": "8256af27146bb3577ec491fdebeb0854814fed792610aa8fc226be7182a5c27c2439665a102a75362ac54bec665ac64f", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674802, "uuid": "6694b099-c206-4dee-9067-3b9dde078e65", "value": "T143773324FAA16DBEDF33D5FCC0464147AA5AA4A70389121727F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674802, "uuid": "c72d576f-d4d0-4a7a-892d-8c6692f10b90", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674802, "uuid": "594719be-048f-411e-9a8b-95ec06969d7b", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcU:K/jkCgpPUK8PyL7M8aE1VWhroHFcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674802, "uuid": "dfc17f69-61c8-47ae-94c6-43929f7211dd", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674802, "uuid": "c15cbba2-9dc1-477a-9418-fb847a8d50d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674802, "uuid": "60e7876a-735b-403a-a774-85d2bb1400dd", "value": "9b66d787a38854d79f7788bb1b357759b716de60dc974bb30e02043cb93ffa11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a063dd-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776665976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "4e32d598-4a2e-4fc4-a066-580fb89d0ffc", "comment": "Malware payload (Vidar)", "value": "6429d82ace3e7c9c8ba7ce702916ee0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "905e3415-01bc-49d0-b41b-deb5cd14651f", "comment": "Malware payload (Vidar)", "value": "9b76c9b665d3d48a68e7acbc608a96226273a8e1230d4e2bb11def04e4ffebc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "ef35deb7-0000-4872-8c7e-b0c6992bc296", "comment": "Malware payload (Vidar)", "value": "af843e19771ad3c459b3c6d107905b9e27ad36c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "2796882d-b39a-4d80-9efc-82880f29ec53", "comment": "Malware payload (Vidar)", "value": "4a210bde615c6b8b5155fc68549c40f3f79be71b96af4e0430284d559bf639246b758c2fc46b0c3768ea862933bbe624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "3db47169-5159-47bc-afda-07ceb81a5a6f", "value": "T117A59D16BCD144F6D06AA33288F652A27A71F8194B3233D72E50AB783FB63D05E79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "efe19b73-777f-4bc0-8b91-9dabe927a109", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "b963e9a3-9393-4b14-ac2b-4cb1216f95be", "value": "49152:FtxoXaSdGdenn8nnnnnn6nnpKzvHN1Cx6tKQRcnnnnnnnnnnnnnnnnnnnnnnnn9Z:FIJGdZhEx6ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665976, "uuid": "44355b48-1781-4780-8a68-e2d0fabfc648", "value": 2151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665976, "uuid": "619a900e-5063-412c-b87e-a054cb52f853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "1643f21f-28f7-4ba5-87a7-0247de60c9a5", "value": "boot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca126d40-3ca0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776679670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679670, "uuid": "3f4df553-66d8-4e8a-929d-1179c6449bb5", "comment": "Malware payload", "value": "0da57f3a271807e8b2158579eeb3f1d0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679670, "uuid": "de50c456-d1be-4cdc-9c55-0dd8b289ee97", "comment": "Malware payload", "value": "9bf76a94a6c433ec056f54a635ef9f37aa5ea619c4d91a2875f8e22c70a46014", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679670, "uuid": "a9801a7e-34c5-4a64-97a2-14dfc045bef7", "comment": "Malware payload", "value": "14d833e650d118b1fd261a6c5c0dca08ad2ddf1a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679670, "uuid": "2fd9b688-0fce-472c-a82f-cedd3cb02364", "comment": "Malware payload", "value": "989ce497bca84acab6269b5845e8277b88610d06836c3f811d61e369790f08261cff910e5f7a7164ac8af7346e07efe6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679670, "uuid": "444db8d4-684c-485d-894d-b9631b5260fd", "value": "T1AEA4127EA5E677FCD47AE23C664320D2F2B3B1C506105F6B9344A0143A32AA85E7EF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679670, "uuid": "1371dbdf-22c9-4fc8-a1da-3e3d66649d5a", "value": "ff187e9c33ca1d4e71b2277cca5c4e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679670, "uuid": "99bd6728-debc-424b-9c73-808ca60691ef", "value": "12288:O57tL7OFyehvEgZQvrO83g5Wqg3MN0+zChuOuFQiTyJ:GR3OFyehvXZQvrOvDg3M+Hhju9Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776679670, "uuid": "78edfa45-caac-4489-a8ec-74b565e13203", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776679670, "uuid": "1f3a3b77-c5a3-468a-bd8f-0ec5f4694cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679670, "uuid": "7632d71c-ff69-40c7-ac07-b34e22a0e899", "value": "z3lsse0k.gge.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa4639a-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688001, "uuid": "a79b8a95-7365-4d3f-a876-89942f9d374b", "comment": "Malware payload", "value": "a03b3504da978273df1a93b15ed11388", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688001, "uuid": "eff175a8-6f8a-4cbd-8dc3-10417d7b0103", "comment": "Malware payload", "value": "9c389274c8da0d54f31747bf5af1988bb790dead674c9fa1b6fb2fdfb38aee30", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688001, "uuid": "6bde017d-7809-4d71-88e7-c989a22575d5", "comment": "Malware payload", "value": "6f303e74c50573cf5b083d3bb6b15c03c49e1821", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688001, "uuid": "72053bc9-b57a-46cf-b050-9d55ff9f606e", "comment": "Malware payload", "value": "7add15b8bfe3f7dbf3b4efbe75a0c6d7fab1a59ba7b19b84f0b897f92aeba1ae5fd310553bc7d0b9487db120d1855aeb", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688001, "uuid": "0871b807-e956-4d9c-9d89-9ab143d679fd", "value": "T167B4D09173E1CB2BFA8D5630CEA2C6DD1713FC678E57860F7256731E5DB25A1280322A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688001, "uuid": "10574a72-ecea-4847-adec-13f24aadaac7", "value": "6144:NZ+RwPONXoRjDhIcp0fDlavx+W/WEtguL1nH7DTdmsWciHnFpP/g7HoBe0VzsBgO:Hgw1n7EyiHLP/gzIbignpL+g35JvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688001, "uuid": "4924e2a7-efaf-4bb7-b785-44b0bc965792", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688001, "uuid": "71b94b9e-a8f3-4e52-af62-9a6d7079dff3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688001, "uuid": "236643fb-5c50-429a-9050-ca30be751e81", "value": "ORDEN DE COMPRA Y MUESTRAS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9fe753-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725252, "uuid": "f85c2061-feb7-4535-a0e5-eae497ad1820", "comment": "Malware payload (AsyncRAT)", "value": "ec2ecc241d66904950300acc47e85539", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725252, "uuid": "09c465dc-c1c1-4efa-aa6e-584a81ff5d6a", "comment": "Malware payload (AsyncRAT)", "value": "9cc3119b718cf6736f07cfb3b0a91661ffaad013dcfd5e0283bd3162986755d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725252, "uuid": "291892c9-29a9-4a0f-b4ed-bd8c41b1e384", "comment": "Malware payload (AsyncRAT)", "value": "2afce614f23bfdeb629893d38213f599372ae9a7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725252, "uuid": "b44f69e4-5637-4ca0-bf24-7a9a1f6f6ef4", "comment": "Malware payload (AsyncRAT)", "value": "243300341a93389fe051e6da7e0ccb8ac1730457b16c88f2cd950a75743f99abfb7232d343d0a7fbeefb17f24554f274", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725252, "uuid": "fb196871-1df4-4c5f-a98d-65eb871e305e", "value": "T1BCE24C4877E48312C5FEAFF02DF2B10A5274E11B9923EF5E0CD889962B67AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725252, "uuid": "bf5258a3-396e-48f5-bf3a-f52f0933f3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725252, "uuid": "92a1ed13-76cf-4270-b754-ea5e7956c785", "value": "384:cpaJuqQYbqjpk972V7/AqBZB1FOmLpMhvh0FbOKTCOQKFRApkFTBLTAOZwpGd2vQ:R16zY0FPChvGFbO75KFVFo9j8OjhwbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725252, "uuid": "001bbb21-6b6e-4e8f-95d4-67d4d536d67c", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725252, "uuid": "cf6ccca5-d937-4d6e-9c4a-97cc65a55882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725252, "uuid": "ed47a0c0-f54f-4cb1-9fba-40c336d0a139", "value": "9cc3119b718cf6736f07cfb3b0a91661ffaad013dcfd5e0283bd3162986755d1_872ee781-1502-41a7-a2d7-3a6b5111dbb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243a5276-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674238, "uuid": "9359eeb0-94fc-4c11-96bb-6ddbd2e27d38", "comment": "Malware payload (ConnectWise)", "value": "9e68ae5b0e47545c491b74d7818f3844", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674238, "uuid": "009a11c3-33f9-4d50-a2c6-1dcbba0895ce", "comment": "Malware payload (ConnectWise)", "value": "9d04005b9ee0d9980286550999e19cd530f31dd594008a0808f8d47a130db47e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674238, "uuid": "cb0b22d8-2213-442a-8baf-ec528ae879fd", "comment": "Malware payload (ConnectWise)", "value": "3b9d27670552a533823bbc08655422bfefdebb69", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674238, "uuid": "ad131e37-788a-427d-a0f5-300e2373ca2f", "comment": "Malware payload (ConnectWise)", "value": "3ea21d98088aae574bc0a0d0416afc299239ab28798026e83180d44a9df0b7d9c88a8d626646ffa31a767955f3ba96b8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674238, "uuid": "0e3dc742-0631-4759-9256-2086e3bd4cf7", "value": "T141E5EF01B3E4413AD5FF0635DDBA66229B75BC190364C7AF578879692E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674238, "uuid": "5476e232-f06d-4a01-ae44-34cd97cce89c", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674238, "uuid": "474ac569-7e36-4839-9a8a-9878eaed77de", "value": "49152:OjET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1g2:sb16Co69eWb0pnGpYmnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674238, "uuid": "cbe1355e-a2f2-4414-88f7-e2cfc6019bac", "value": 3192088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674238, "uuid": "f35df39a-fbc5-4e5d-8c0f-1e6a0df50ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674238, "uuid": "a6fb55f9-72a5-442d-81da-e8ad041d77a4", "value": "9d04005b9ee0d9980286550999e19cd530f31dd594008a0808f8d47a130db47e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7366e5e5-3ce1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707442, "uuid": "f9d3b24a-3f87-4b8c-8987-c7e416652e10", "comment": "Malware payload (Mirai)", "value": "3eb949f34f47cf410c2b9049148faa7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707442, "uuid": "6cf97383-1521-4401-ad97-a163c7b28509", "comment": "Malware payload (Mirai)", "value": "9d540ee9af602b12d6be81822088aac1bae080ae19927dfcd438ae8bc9ef0b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707442, "uuid": "6f336427-6290-4e38-90c8-d4fffe5e8887", "comment": "Malware payload (Mirai)", "value": "13a38c5d3f24280082e1630671b4ebdabc38223d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707442, "uuid": "7de5fade-0c29-49cd-9146-11a8b9a03155", "comment": "Malware payload (Mirai)", "value": "39da93e3e8582c3c77c4f06ae5659d7d2b406abb3db86c16227257a596643d44c2438375ecf4a51e24a385817f004ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707442, "uuid": "8a9cfc1d-b97d-4690-90ec-4d9de2bc3275", "value": "T150130807B94680FDC0ADC374477AB63AD53335BE1239B3B63BD8FA129986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707442, "uuid": "6ace2db0-d63c-410c-9413-d9faa0dd59e4", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4/oTgjSAnW4t/TWufBT74hM:C4jKy5klH5lYFsTbUoTB+xt/TWuFsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707442, "uuid": "bf88739f-efa0-496a-8b40-a801dc6ef02d", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707442, "uuid": "4428ae31-c712-46f7-8e73-4777177d1cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707442, "uuid": "bce432f7-bd4d-47d3-81dc-80e316bca238", "value": "00okx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867398c2-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676550, "uuid": "38d2ceb5-c50f-4dd8-922a-a4348537b6bb", "comment": "Malware payload (ConnectWise)", "value": "c113744ef2ec71c30a1dab69e9f75eb7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676550, "uuid": "92bb7aff-ee18-42dd-be58-cc256b1de139", "comment": "Malware payload (ConnectWise)", "value": "9e026a226ea772de8f4d25edd652a65ff4c2b955ebf9fee545cef91909112971", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676550, "uuid": "cfef1b08-9d39-4894-abea-187d5d829bcc", "comment": "Malware payload (ConnectWise)", "value": "1be293ff568ea4071245df3c43b6f1da800d7759", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676550, "uuid": "d3bf9029-01e7-48ea-887f-9c42ba61a3c3", "comment": "Malware payload (ConnectWise)", "value": "8d5418e01654c63817fb282604994253b9872c0d00f3b8ba86c9f2e6584ae2097628b26bccc93c302b4f479d09cfef65", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676550, "uuid": "c5e3b2e8-31ac-45d1-8665-78b965a9ed75", "value": "T10146E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676550, "uuid": "0177159c-efc4-45b3-992f-f5069a8b2bb3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676550, "uuid": "ed9e2fba-e651-4acf-846d-e4c83a50acd9", "value": "49152:mEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:jEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676550, "uuid": "41e1fd48-e8d4-40a3-8ce2-e7395d23d548", "value": 5622640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676550, "uuid": "20da6045-28c2-46db-9ec9-7b839f154b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676550, "uuid": "c935d91b-dd83-4173-be4b-9d8855ef2e74", "value": "9e026a226ea772de8f4d25edd652a65ff4c2b955ebf9fee545cef91909112971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e877830-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725043, "uuid": "cc69ad1c-b8f6-4287-b76b-22741ddddda2", "comment": "Malware payload", "value": "b4de0185a584960f68188d81e0a77349", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725043, "uuid": "f92929c6-a164-42d0-a6a0-c863406db23b", "comment": "Malware payload", "value": "9e4643f2ba1125bc87838bb70d50effefb93d4935c34b8ed96dc8fa123113c1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725043, "uuid": "17d463b6-395e-4b59-86d0-14403b2bd7d1", "comment": "Malware payload", "value": "b57e6ae09f66e05dc4fc99e9657880db674c164a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725043, "uuid": "d858b894-c051-451c-b833-486e885dc0f3", "comment": "Malware payload", "value": "604a7ad0b44ecf773049ddba49dd2b2fc19e6bc3dd4311dac98d2d9e08f7c11bdeaa6028aa41eab216b97f7dbff70dbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725043, "uuid": "f32ce550-6758-4ba4-af37-9f7d8a0d5fd9", "value": "T155A34A5B77A900BBE1B79678C8970E45D772F81207619FEF03A0425A2F237E14D3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725043, "uuid": "38ee13f8-f641-4941-ac97-9954cee601ba", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725043, "uuid": "ceeb4a54-8fa2-4210-91c2-fab779744e98", "value": "3072:tE7g/i4qfIsxGZJQbQAet9/4+0PpqeOAYv:T/afIa0MQAetFwjhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725043, "uuid": "5e9daf30-033f-4754-a8a0-b3cb15d21375", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725043, "uuid": "359656f8-daa4-4a58-8388-568f7735a9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725043, "uuid": "a7d32fa5-0ea6-4773-8915-eb5136d0e559", "value": "9e4643f2ba1125bc87838bb70d50effefb93d4935c34b8ed96dc8fa123113c1d_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f76c08-3cad-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776685304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685304, "uuid": "3de1f980-37e6-4b07-8de2-86faa94b3ae4", "comment": "Malware payload (Socks5Systemz)", "value": "4ef3b7c694e150926eaf577bdd541928", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685304, "uuid": "6dddec5b-d2c5-4b38-b5cd-065c4838d14c", "comment": "Malware payload (Socks5Systemz)", "value": "9e522234699bb82fd711748be62b74b76a5cfbf7b5d35fddf962ddc12f2ae869", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685304, "uuid": "12da9ee4-7d53-4bee-92e2-deda05aced0a", "comment": "Malware payload (Socks5Systemz)", "value": "efd4b8d6caf9b3191b1b4c9f96c57fa2d0601f3c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685304, "uuid": "ee70a46b-fdce-494f-b8be-82d9c5b098f0", "comment": "Malware payload (Socks5Systemz)", "value": "e24ab702942726af9899d7d339c84a61dedeaaee8f1f8df43456bb447960d039c6ac440d7faacd190b3b52b83f18e9be", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685304, "uuid": "115be5cf-65e4-478c-a8dd-b008b7b9803f", "value": "T183F53388FEE29D38D1B24BF44D02E559CD3B5F058DB371C8FA2A4D691B622907E223D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685304, "uuid": "e4d5614f-6a1e-4974-83ef-bd22822d0caf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685304, "uuid": "bca52cab-8a93-4b9c-91bd-a30d967f7c62", "value": "49152:1v/3I+NTOCFJLlxpSL/JlfxpLJKEoa2C0yihkjPCLfm+g2o7jqrJB35pcXNRTwEV:NfDsCFJLDpSrvxpLHoa2CqVbL/3vcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685304, "uuid": "56625905-59ab-4bce-89ed-08b684718682", "value": 3633226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685304, "uuid": "ce906fa2-7620-40bb-a3e8-cbf064c979f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685304, "uuid": "bfeba772-d172-402c-918d-b2acc1fc0528", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cfde00-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776724836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724836, "uuid": "046bd95f-f6b7-47e3-a16b-5e696f42fb86", "comment": "Malware payload (QuasarRAT)", "value": "0482525721e47a8b20e05383eda6422d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724836, "uuid": "5dae2597-4828-4456-9b50-5446b2746a4a", "comment": "Malware payload (QuasarRAT)", "value": "9e7a53f3764e9b8d3c0d214ac0412c0883188085c573a5d0442af6e368bf15cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724836, "uuid": "31439d38-dfef-4429-930a-c25880f056f2", "comment": "Malware payload (QuasarRAT)", "value": "d0214f74be687453b062b96c88a98610b151002f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724836, "uuid": "b822ec10-7cc6-423e-bccb-3b1c224f5f75", "comment": "Malware payload (QuasarRAT)", "value": "91553422576136ae6ddb1b1d0a515a5467105b75af4f3aca8ce2c78e70a46fbed5b165f90f3f25fec03c2d1b140dcd1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724836, "uuid": "021e8949-4c71-4118-be93-add3d46f72a3", "value": "T158746D1433A887ABD2AD87B9F4310B164BF0ED46B566E38F096654BD3C93385DD812B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724836, "uuid": "b3d6c554-e27c-471d-8379-bd9162c6e0e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724836, "uuid": "9ff9cf98-2b76-47f6-80c5-8b2e306d92eb", "value": "6144:skgFoNhTCxqsBkvpecbL+17lQAN87SZ+VDzXbZCTCkQgETj9PVAQ+y:sDFEhTCxZkgcmgAN8G6DzQCHjwTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724836, "uuid": "08010224-c567-4e4d-a343-2c82ad64423d", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724836, "uuid": "a5c34e1e-78b8-420f-9dc7-dfcc85d18b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724836, "uuid": "16a1bada-8e34-450a-b7b7-78b96dfd5714", "value": "9e7a53f3764e9b8d3c0d214ac0412c0883188085c573a5d0442af6e368bf15cd_5f154823-a364-46d8-8de6-385d8f6adc09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329a440a-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725372, "uuid": "71cc179f-c0fa-4537-ba7a-132073268cc5", "comment": "Malware payload", "value": "37a2ac8df821dc0918a2720652b8dd43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725372, "uuid": "e5f92d18-2df2-4124-b79d-86302f0e5e62", "comment": "Malware payload", "value": "9fcdd95cbd6694ef289de24b49fd99031c264333899fffe8b04e20076a6d5bac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725372, "uuid": "84366458-b593-43b7-afbd-c7f1f225e931", "comment": "Malware payload", "value": "478876434204de681243b0a27836cac7a7987d27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725372, "uuid": "7c38b88c-a988-4b4f-a7dc-759e2a44bce6", "comment": "Malware payload", "value": "afdee68e52011d7b814d2d4df203501a374942add4939b3f28762e0b61bb4171cda8782894321652495bcb1dac1f8912", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725372, "uuid": "1acb78b6-de26-45b5-b456-6aff3cf303bc", "value": "T16AB35B5BA2A600FBE1778678C5670E46E7B2B85107609FEF43A4461A1F233D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725372, "uuid": "ec7c04e7-1524-48bf-9106-6d24197d48f3", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725372, "uuid": "c4be55f9-a63b-45e3-96a6-a0db1b223297", "value": "3072:9AVcERSr0epeg7sbCmCnWditqBzN4jnWYLd:6ZR6RZsbd2WIb5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725372, "uuid": "206086e7-580b-4efe-b615-0dcb3e6b28a7", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725372, "uuid": "ff1a213d-5447-4f26-a8c5-510d4cd9ff01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725372, "uuid": "9c7f8fe4-4f0f-4114-b069-055a0002578d", "value": "9fcdd95cbd6694ef289de24b49fd99031c264333899fffe8b04e20076a6d5bac_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54830d62-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725859, "uuid": "efe7f1b0-21db-4c13-8b7d-e9d994dc0e7e", "comment": "Malware payload", "value": "a0695750cc3e82c49c7b33049e07e0b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725859, "uuid": "127cda11-52c2-4f66-9b4d-88a1e4f7384e", "comment": "Malware payload", "value": "a071cb93a7e151f23227e0f45c66f1f47431ed981608790c4f30b664f02ea3d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725859, "uuid": "535ce31c-378c-4137-aaf4-154a7ded4052", "comment": "Malware payload", "value": "2f188aad6f664c6290e9c2bc6ea19fced4d26f79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725859, "uuid": "6b16b2f3-29ca-4cad-a3cb-685f99a0ae19", "comment": "Malware payload", "value": "cc00288c298cb09a72ef21b3fa8e50d6e33da45a517fbe1912f039728abdbcf5e26d5f82251957c6f48c2367a875e170", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725859, "uuid": "c5182735-1364-483f-97f4-c71535ff2f80", "value": "T147A34A5B72B600BBE1B6863884574A49D772B8454B21AFEF43A4425E2F273D18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725859, "uuid": "30338b8b-fd1b-4df6-a066-9137a9741b15", "value": "1db8242845956bba39a653cbe367a0dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725859, "uuid": "4e082d02-8f0c-4d3d-b18b-a8f86e55d4c0", "value": "3072:doUuUp3i2PbGuIQb6A8b+ICATME5JAC/T/2njLhbCDvmSOo2iePG3ufWC+vrXT/q:aUZi2zmM6A8bf7u4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725859, "uuid": "c9e33293-e5a6-4d7a-bed6-3d1608de0639", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725859, "uuid": "7c98b8f5-8c5f-49a2-9e9a-5395cd3c074d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725859, "uuid": "ffa54a01-dcab-4920-a21f-5bdfb41db7b7", "value": "a071cb93a7e151f23227e0f45c66f1f47431ed981608790c4f30b664f02ea3d7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4297afa3-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724540, "uuid": "f1692d76-70fe-4a62-87c8-33437b5400b0", "comment": "Malware payload", "value": "2e6a753ad93ace4757b30ada20a6cfa8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724540, "uuid": "1022870a-4bd3-456f-bd9a-e5bd4f610006", "comment": "Malware payload", "value": "a09d2266fc33a6806ec7cd693ce07acf38f7cb74751299ad8da8aa7d0b8b76ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724540, "uuid": "34ed90b2-23e5-4817-b130-00042cfdc994", "comment": "Malware payload", "value": "42df2ea3288f47ed33c8ba8e0629dc2782240f56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724540, "uuid": "4c4deef2-d0e2-4bf4-8696-716782b346cf", "comment": "Malware payload", "value": "57af415cdd061bc0329b2887bfab772cf870231583a34942642421dc2397ade604808159885f422c3bfdbccf8c28e9f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724540, "uuid": "794097b8-5624-43f6-bb85-596490e3fcf9", "value": "T1A2A34A5B76E900BBE1B7963888670E45D772F81617619FEF03A0425E2F633E18D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724540, "uuid": "46917f67-0626-4bb8-8d38-7de3f0154fab", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724540, "uuid": "4447dc92-b7ba-43a1-a9b6-f2bf5f521077", "value": "3072:i/AwoPt0PRG7nQbwAwZDuf+0PpgqgOAFw:yol0pAMwAwZS/Qh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724540, "uuid": "06dcb211-142a-4c3c-be48-488f9b8ce972", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724540, "uuid": "2ff9e542-8715-4fa2-ac4c-198c2f01a47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724540, "uuid": "92fbff5b-1b5c-4a3b-94e9-0c5983af3f9f", "value": "a09d2266fc33a6806ec7cd693ce07acf38f7cb74751299ad8da8aa7d0b8b76ed_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42a956a-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725241, "uuid": "a421d1f7-872f-43ea-9ef0-c92a4e59ba09", "comment": "Malware payload", "value": "a6f0ea7e429b75a32a778f99ffc5e6f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725241, "uuid": "0af7a6a9-66c7-4833-8d4e-69a22d3d71bc", "comment": "Malware payload", "value": "a0c609860951adb21a2ee0d821b3c0ab7f37c6a2d189967e1787cce5132d93e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725241, "uuid": "57636219-dee5-4861-acb9-8a5eb0ba662e", "comment": "Malware payload", "value": "125dfc9e4edaf3754bae560dd321d398a7ee7268", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725241, "uuid": "284c23d3-d3c2-4b6c-88fe-9ba93c54161b", "comment": "Malware payload", "value": "6679842da87f2738c305548133794aa5082bf2e5c77b0eec88c89c21b99a52b615985e923bcdb2ffdd58a1ae17a248f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725241, "uuid": "b16afe69-e962-4838-bc99-eb1989e116ca", "value": "T1DCB36B47A2EA01BBF17B8639C5670A01E772B82157609FEF43A4465A1F237D18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725241, "uuid": "08efaf5a-e923-4003-8cff-38cbe6c1d270", "value": "fe6afface4d702d2e462b67c0e2f91e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725241, "uuid": "6e2106b1-8e91-4b48-b4a8-0b10ac291bf2", "value": "1536:0xO5whItDrelY12fVVS8+vdJTHkSReVWaEVOeq7teEo8IsWcZdW9dlTrUxoULi:Tu0qOSqzvdxEeJaEVOeGtegzuVrUxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725241, "uuid": "9b79892b-7317-440f-a46d-1744acd411dd", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725241, "uuid": "402bac69-c24e-499f-ad6c-fcf37afc613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725241, "uuid": "8306cf17-3f5b-4cd6-a571-c8f751752c69", "value": "a0c609860951adb21a2ee0d821b3c0ab7f37c6a2d189967e1787cce5132d93e6_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515de997-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724994, "uuid": "974544b5-c94f-4880-80b4-2ffe56cdf5f7", "comment": "Malware payload", "value": "dc223032a7e44ff5e40120a22d6ed298", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724994, "uuid": "e13dc06a-0a27-4c83-bc99-e5eda716ed6e", "comment": "Malware payload", "value": "a0e7660fe975889b9cd7f333e79affab8c9e58e2e677e66588cc33478f34f787", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724994, "uuid": "2f6d9d31-2b8f-41dc-bdea-16cd38fa55bd", "comment": "Malware payload", "value": "320fc181d10de88142df271a6c319a1b742ba83d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724994, "uuid": "42212c28-956b-4a8b-b665-d0a575f4e91d", "comment": "Malware payload", "value": "827e20b51d2f33c4992ac497c0ffd4b30930ee36c0ea02e30766cf437ca008bafeb68a8d3ec49d5d19aa7692d464a5ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724994, "uuid": "3b7746ae-0871-400a-8eb8-c1294df287c7", "value": "T1F2A35A4B62E600BBE2BA9678C4530A49D772B8551760AFEF43A4461E2F233D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724994, "uuid": "aef3a06e-68c7-47c1-90b7-d0631fb422c6", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724994, "uuid": "0a1d10af-868a-4c77-adc7-846f266739d3", "value": "3072:VJuaAAjfxOAGQQiAPePBAH51756565rDIryHtmckVPxIiT7DYF:H1AAfoYfAPeZAsmUYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724994, "uuid": "e375c16d-3afe-456d-a150-c63de21776a3", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724994, "uuid": "f6577eeb-0aa8-4d82-a985-2290ab2295de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724994, "uuid": "bf1f3d71-a1d8-4b59-9de1-210bd590e815", "value": "a0e7660fe975889b9cd7f333e79affab8c9e58e2e677e66588cc33478f34f787_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121c9429-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776674208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674208, "uuid": "7b85913a-62e7-487e-a21c-c9bc8433a41a", "comment": "Malware payload", "value": "5986c8b860376165fdf29d6ce38be4d4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674208, "uuid": "01590e8c-0c5a-493c-bee4-8da6cdf599bb", "comment": "Malware payload", "value": "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674208, "uuid": "92840fbf-346a-443d-b8ca-612371b83f4e", "comment": "Malware payload", "value": "31bfc7f26d6c7aebfc62ce648a6f93d0ace761e2", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674208, "uuid": "ebab6ffd-beeb-4752-9273-371a6ba53cdd", "comment": "Malware payload", "value": "e42ecf52feaecd5e6e13e5cbc26b0de41e8c139f3b01e5a9fdd0d00b2e60e26b6e827ce5e41ff8a44b9f610bf6839add", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674208, "uuid": "0c585541-ccce-42d8-9a2c-5cade513cd32", "value": "T13D65230A13E41467EE39A734D9F200A3A53279F68F7586BF1AD9C07C4BB29C15434FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674208, "uuid": "6f740f92-2823-4008-9118-4385f692d819", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674208, "uuid": "dccc2c72-2f16-4083-b08b-1ab57ccbc8d2", "value": "24576:+jPzyZYXlJaHrvoRcau1invFtHhnpifPj0hHW4BWO5pKOtunXhirK6OsuOk464GA:+jBaHrvDYTwHjKWUBvjqgOTOk4iH91Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674208, "uuid": "34f0ac66-c67b-40e5-b937-4f64c68c37e9", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674208, "uuid": "47595d08-0c07-413e-9bc4-088639db0e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674208, "uuid": "834b578d-a087-49c5-b08f-3ee687df4a09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919c7f3-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687131, "uuid": "8d1f20d4-2d61-4c4e-bcf5-20d22886ef72", "comment": "Malware payload (SpankRAT)", "value": "1282e8a600cdcdb6bf29e7d792d597ce", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687131, "uuid": "3c5c1171-b575-4487-b407-71abae83cf4f", "comment": "Malware payload (SpankRAT)", "value": "a15dedfc015bd4d15ba889fd5e8c7921e44a77c4f24e62814917ed75b92ca921", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687131, "uuid": "43588b38-909a-45ae-9525-3eda3b1c85ae", "comment": "Malware payload (SpankRAT)", "value": "3433f4a72040d3a490c3a69788b95bda06766b99", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687131, "uuid": "e2e968d2-2287-4f5d-bbff-edae62e9664f", "comment": "Malware payload (SpankRAT)", "value": "c811d5f7c5e67c71c1ce1a5016b6e556e47e84404ac6d43c2bcc694c9a52eab8f49974f485eac12bdc0eff4a1bc56819", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687131, "uuid": "c132724f-cc7b-42fd-a35c-8a5513cf5f68", "value": "T1FDD46B03BA98456DD05AC078835B9772EA36BC8E05307A7F07E46B307FA9F646B1D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687131, "uuid": "f90718c5-ef41-4501-9dfc-789b966eec86", "value": "e600a4747e1b0095a97865f86f06e4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687131, "uuid": "fc5a524c-f844-47d4-8c7d-15e43eea2c1f", "value": "12288:6ByAxY/KNXgNNfKgR9MFUS2AmrmvQ6aQFjScLfMOw:WyAxY/agNg69MeADQZaMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687131, "uuid": "caf8315e-dee8-4e2a-a31a-be909295a4df", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687131, "uuid": "20914541-ddba-4c4d-a6c0-dc96bd60e19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687131, "uuid": "5f0c561e-1f15-4f6e-be87-eccc3fefa0ef", "value": "a15dedfc015bd4d15ba889fd5e8c7921e44a77c4f24e62814917ed75b92ca921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe20fd30-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725714, "uuid": "5f8dca61-2589-4602-9ab9-ba8877779c93", "comment": "Malware payload (RemcosRAT)", "value": "5a8b1fe97f536b78a8f8faed1d168b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725714, "uuid": "cd5e3708-68ca-4663-995f-30bebdb95975", "comment": "Malware payload (RemcosRAT)", "value": "a1a15f6d3c172e29e991bcb274f6c47a2ee45614224ffbccfcec39113a3bd078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725714, "uuid": "5e13ccd0-bb2a-45f0-b6c7-b5ca458ade6d", "comment": "Malware payload (RemcosRAT)", "value": "96f1dce0a70aa856916c71f4188576854343318a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725714, "uuid": "c735ba96-4400-493b-9882-dccd6dd84cbc", "comment": "Malware payload (RemcosRAT)", "value": "80e47eb85c61697cce132ad1a902b71e7e21a1a3056d41f5a677783b8707d6f863efbc18f475100477f3fd9d2e47b6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725714, "uuid": "a8c935de-793a-4d1d-b2eb-69d0bcc80f70", "value": "T11CD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725714, "uuid": "1b9c403b-1b72-446e-b85e-c56b59d947de", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725714, "uuid": "6da7e277-098e-4240-90eb-3eef32ba93b5", "value": "12288:ySGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:nGuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725714, "uuid": "bf9f3217-d33b-4103-9d18-3bee0d299b12", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725714, "uuid": "618524ae-361c-45b0-97f5-2f0e6623bda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725714, "uuid": "4f989940-61cf-4c34-a9e6-069a48aad9ee", "value": "a1a15f6d3c172e29e991bcb274f6c47a2ee45614224ffbccfcec39113a3bd078_a3d63d87-23c2-4454-98e1-ea556e129b19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef70e83-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725769, "uuid": "b9b83413-7059-4533-8c06-ade1f3133d9b", "comment": "Malware payload", "value": "428ae39c3dca3ced630b041003f70220", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725769, "uuid": "a00f3f21-7250-4d60-84a4-0cb4a437085a", "comment": "Malware payload", "value": "a1d756d36217004315e38ad797ddee0e8475673d18eaa4c5df6c1c98220d0d7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725769, "uuid": "d76a9589-5b44-4aec-9f4f-921008a1bb50", "comment": "Malware payload", "value": "27bd025b4d78c00fac105b4ca56d7ba6cc899359", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725769, "uuid": "34170b06-3d79-43d5-99b9-c4e05491b6d1", "comment": "Malware payload", "value": "cdd1aa620848bd3cc714ab1b46f2738683147fb1ecbf6eb4df3cfd64c37d7c54dcbf6272ee89896b0e334a9216e3a445", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725769, "uuid": "f29f29cf-eab9-4e13-9f40-cd4e2f4b6a77", "value": "T1A3A35A4BA2E600BBE2B78678C4930A49E772B85557619FFF03A4425A1F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725769, "uuid": "38db7fa2-abf9-4093-9ef8-ae3c2b8aa501", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725769, "uuid": "e788596a-872b-4d05-bd90-3c2e50c7b5be", "value": "3072:KvBGrVNNR2AJNQKAfRAtDvrXT/7nM4L3zm2Q9ZVbZacTShsrHTBRjtd:2G5HoqXAfRY8RRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725769, "uuid": "ae39e21a-2d4b-4e01-b2c8-95a2b79c8b65", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725769, "uuid": "82921f38-7536-4237-92ac-3a43dbfd8df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725769, "uuid": "2e6ad61c-c1f1-45c1-a802-3d1e8eee7463", "value": "a1d756d36217004315e38ad797ddee0e8475673d18eaa4c5df6c1c98220d0d7c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29067085-3c75-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776660932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776660932, "uuid": "59be3391-8a30-47ce-89f2-e95086c943ee", "comment": "Malware payload (Phorpiex)", "value": "03c24ec6ad9dc5a8d4ae69897f4dd55c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776660932, "uuid": "d2fe094d-3608-4e02-a81c-f4a78f4cee25", "comment": "Malware payload (Phorpiex)", "value": "a1eac33d6afb57d4e2d7ab89520f22323649dc227c541545aa35020ace5d5cb2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776660932, "uuid": "4354c677-a8ac-43ed-b025-2148fd96a14e", "comment": "Malware payload (Phorpiex)", "value": "4b79d4ceedb46b605ac2c23942a0277f1465e707", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776660932, "uuid": "456451fa-3228-40c3-84a9-b4f88c1764d1", "comment": "Malware payload (Phorpiex)", "value": "91150233abae217fe1a3e282d1b22b0d1aeea541b83644c1f2347ba3b6061cbfbbf060c52c4d0e40e49cadba2ac96c5e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776660932, "uuid": "10a9c384-a95f-4c7a-b0d5-4153449185c8", "value": "T111F1090ADB428162E38D0DF02FB281998BBD486327D761FFFBB345D94FE42909456266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776660932, "uuid": "aac6a8a4-ea50-429d-9d68-0842f5647280", "value": "31e89670877dfc32b6a26a763ebe8e0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776660932, "uuid": "8a49fa16-4f6d-4170-b77c-6c77067aff9b", "value": "96:pEqt1CDsL2xdRX8ODt5Fl2lTNWpPWthJxGENUOG2qpqC7tCEk0Od:pEDsL2PHl2JAp+thJxTNUOGtpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776660932, "uuid": "a72961dc-b444-48b2-82c8-404e9764631f", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776660932, "uuid": "e79c6802-ebb4-49de-840d-91c370ffbae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776660932, "uuid": "0dca8c27-4e92-432b-985c-0fb1380fd65a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfe951d-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674036, "uuid": "6997743a-604c-4fdd-b58c-3aa24fc0897f", "comment": "Malware payload (ConnectWise)", "value": "0d3b4954aa5462fdedf155a6895acc3a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674036, "uuid": "e8213c36-36a7-4c4a-9bb7-dcfee34ba16a", "comment": "Malware payload (ConnectWise)", "value": "a25616fd8c01cb15ff5141632b9b2b47d537ca46fa39179d1b4b5d76c6eaa16a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674036, "uuid": "cc7feb24-d4fa-4142-8205-f93dde48951c", "comment": "Malware payload (ConnectWise)", "value": "f41ef67faf473ee95f93a9d154f494472de656ae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674036, "uuid": "a3f7aa3b-0958-42c5-a733-ea8940c62c7b", "comment": "Malware payload (ConnectWise)", "value": "87fff1e2e228dca5ce324e2fa0cb754b5ad8bb61f63ed5b3fb8891b9c18212baf02bb50855b32a7defca9da7857e81d6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674036, "uuid": "f70616eb-d08b-4d12-b8d8-9e374f33c072", "value": "T124D62311ABFCA668F0F62A35EC7A6470A1767C169D27D12E2324790E2D71E80C973377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674036, "uuid": "f27fefde-d2ec-4750-a103-d64c79bb4f34", "value": "196608:WHxcp9ym3nltDUJVwHxcp9ym3sHxcp9ym3UHxcp9ym3zHxcp9ym3tHxcp9ym3nHk:kGplpXGpKGpyGpdGpfGpRGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674036, "uuid": "9944bff4-18d2-4504-a1ee-417081eeffa0", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674036, "uuid": "f729718c-7302-49d2-9193-695c985178c7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674036, "uuid": "d17fdcba-e31e-4513-9d0e-83bd4b19ca7b", "value": "a25616fd8c01cb15ff5141632b9b2b47d537ca46fa39179d1b4b5d76c6eaa16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1e0932-3cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776697253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697253, "uuid": "8a9cf897-11c8-43eb-b78d-2c72ce9ba7d2", "comment": "Malware payload (ConnectWise)", "value": "19e0e8481bff19db59c69f36d41f38ff", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697253, "uuid": "c90a8f67-3e5c-485d-8715-f4dde3db0441", "comment": "Malware payload (ConnectWise)", "value": "a28f9e6bb6b28c58a6c23d2bfe9a8b81777103e7ab8e720bac133f4567f79e19", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697253, "uuid": "4d767bfa-4aa8-4274-b8d7-c98d98ab49f1", "comment": "Malware payload (ConnectWise)", "value": "fbb87a6fdb3a516e4febb5bbde01e7584b4fbeb7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697253, "uuid": "35db27fd-2a06-4ba3-8291-7ea557e14fb0", "comment": "Malware payload (ConnectWise)", "value": "e036d10575c220f93fbe332d6f82a937fa8c9da4272abdbf3ac6e2c27129c5fc2b48218288f07c0442706020b27aceef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697253, "uuid": "d0c68a4a-aa29-4554-b51b-a1f6495adebd", "value": "T1AB118408E9275D26C717763A64AFA39971A30208FAB33093502FC5430CDDC462936902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697253, "uuid": "4213e2e4-066d-481e-9471-f278257dc7d4", "value": "24:9nK/os6vi5A6sMH6bm9lTcgI7WchwS/DhzoXm/r:9KAs6voabmSbRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697253, "uuid": "f665ad7b-0724-4827-bda9-7129a72c805c", "value": 959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697253, "uuid": "25635867-691f-4010-9927-8e71781ad078", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697253, "uuid": "e12ece86-deec-47da-9472-ffc817e528ac", "value": "Statement_Viewer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4758addf-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725407, "uuid": "a0fb51dc-fb93-47ee-8149-14af0c96f5f7", "comment": "Malware payload", "value": "c13bef7c1e0a41871f9a298c2354c52b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725407, "uuid": "d5e2276a-0997-4e52-a452-896afe7410c0", "comment": "Malware payload", "value": "a2ab9dbc0401a247f8c116558e6939aa054de57febcf4d7aacfe8f7e9e6c48f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725407, "uuid": "c2136445-9c73-44df-b08f-b9fce552cd1f", "comment": "Malware payload", "value": "3d493f77bab9cb0ed4d21e1fbf0d82fb92467c5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725407, "uuid": "d5aecdbf-4608-4bc8-bc86-3fbef6a94d8c", "comment": "Malware payload", "value": "85fb0e11bb30d1e25c0e53b7edeb9838dcc16222fdc4f214b58d859bf481cbdc1c1e3581e91fba4a9ae4cc9a4deaadcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725407, "uuid": "81a001dc-0307-440c-beda-7026c7413fcc", "value": "T165A35A4BB2B600BBE1B68638C8530A49D772B8454761AFEF43A4425A1F277E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725407, "uuid": "ef974873-7e21-4b4f-9850-e89366372043", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725407, "uuid": "f189ad77-3cb8-4c4e-8d22-e0c182f846b3", "value": "3072:SEGVriAfIJGupGCBQbfQMPOGQe/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCe:YfSGwDMfQMP5eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725407, "uuid": "cb1d8be4-c4e8-439b-8f1a-93b170265eaf", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725407, "uuid": "2bb148ce-6224-4570-801d-86faf86d8319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725407, "uuid": "09202cf2-6ecd-417c-8775-de8d572ed81c", "value": "a2ab9dbc0401a247f8c116558e6939aa054de57febcf4d7aacfe8f7e9e6c48f1_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4672ab7-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725214, "uuid": "11a89679-bbec-46e7-af9a-84369dd15147", "comment": "Malware payload (RemcosRAT)", "value": "0098b848b7ec4db7740ca1e720c345eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725214, "uuid": "8de79e8b-add7-4a93-a360-57f5e2ef6fe5", "comment": "Malware payload (RemcosRAT)", "value": "a2b4b3d95ce8e954fd1d7f4a1d9535bba004cb2978a041420e2dbb4a32f0c2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725214, "uuid": "33ba2ded-950e-44c9-8361-1d7fc8e3d3bf", "comment": "Malware payload (RemcosRAT)", "value": "9e5f995febeb94da814a9c438d9675b198317af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725214, "uuid": "bfb10fbe-7bae-427b-937f-4e4b160d630d", "comment": "Malware payload (RemcosRAT)", "value": "a147e280a9f98bb06ad680405289e8d5561aafc613312cce1d4cee62a9c0b7dc2bb069ebe6a2c0d445414672755a29fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725214, "uuid": "d1941ab2-b6e4-47f4-aeda-1fc89c918e4a", "value": "T1C7B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725214, "uuid": "9a91f9a3-8a24-4b32-939a-7b5fd613cab4", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725214, "uuid": "5938982e-9ae8-4fe9-b5f9-0e0f29c910a3", "value": "12288:C6pxxGI8gvGOHJpAbDYGxLhZ+sPZtWmPFN:C6pxxx8U+bDYGxLhZtZPPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725214, "uuid": "da71581a-c8cf-4ff8-a797-0db76678f010", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725214, "uuid": "2fe9e3c0-62f9-4a14-85ed-0c657220b970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725214, "uuid": "a1807898-24d8-40ba-a573-b28821c3efda", "value": "a2b4b3d95ce8e954fd1d7f4a1d9535bba004cb2978a041420e2dbb4a32f0c2ac_7c935a6b-1bc6-44d0-ab8d-3f6297298121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e67066-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725143, "uuid": "6f4fc39f-8c84-4dd8-9d39-1aa682bb0c03", "comment": "Malware payload", "value": "c5149a9dc7d745e85685b26fbf0e9e87", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725143, "uuid": "2edd1515-3f5c-4415-8be1-aa6b6d495fe3", "comment": "Malware payload", "value": "a2e4fba0b8898d4b5ae98334633bbfc201cc22795479019bb74fe372da8e070c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725143, "uuid": "50589590-46b9-4135-ab00-468620ea117a", "comment": "Malware payload", "value": "d59a9b4064e383f290fd82ad841a4bb372f823e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725143, "uuid": "80b52d3b-b37b-4563-945e-3fd76b8495ae", "comment": "Malware payload", "value": "8db18cb81549e7f770002d5ae3fdccf9047b0850c7e4e89cb7aa0d5e409f0c55a8546563d5d6892ea4b1d8b88ae51061", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725143, "uuid": "e6168aaf-f370-46a2-9261-f3c4462e908a", "value": "T182A34A47A2EA00BBE2B68678C4530A4AD772B8551761AFEF43A4425E1F273D08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725143, "uuid": "f6828d16-5e32-4e5e-805c-510560f94d7d", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725143, "uuid": "4146125b-c511-4027-85a9-b6768c33a6f7", "value": "3072:VRTeXQwDasaAmiTQhAS/xYN0951756565rnIryHY/CCjK:zeXbuFaTcAS/03vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725143, "uuid": "927acd93-21fd-4392-8231-4a6cfd978667", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725143, "uuid": "33283fda-c5ed-4c01-8dc7-8951c1451c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725143, "uuid": "0993001e-e0d6-43d7-b26b-244cf0df2c7f", "value": "a2e4fba0b8898d4b5ae98334633bbfc201cc22795479019bb74fe372da8e070c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d235d8-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725488, "uuid": "b9489742-a6f7-4d95-9a0d-2a2c8e67e437", "comment": "Malware payload", "value": "eac787c3cbbe8bc99969284922798ab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725488, "uuid": "726170b4-d029-4598-8522-277c820b5fe7", "comment": "Malware payload", "value": "a382e94c77e0c29a1e36b816d68030966446ea154026731d576a93c80caa0420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725488, "uuid": "e6cb61ba-7ef2-49a7-9963-489b8c049e2d", "comment": "Malware payload", "value": "8fe73336aaa832a552d2476432d21d73f5b027d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725488, "uuid": "550660d6-f49b-4077-bf4b-574c0c32f165", "comment": "Malware payload", "value": "cba6b866074dd5e53c028bce69dee68667982030976df74af68f0be7d673131b8e4ca7b30222bea3828b7decf6228677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725488, "uuid": "558f6486-8686-47cf-b4fe-bdff1fb4c098", "value": "T195C47D06F69458E1D665933D94924106E3B87C40BB7285CF02A9F79B9E3B6D0ED3B332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725488, "uuid": "a6dc1795-34d8-469c-9e2a-07aaf8c6a099", "value": "03a8e4b980060a842f9ba7f5a62696d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725488, "uuid": "851d5b42-358f-428e-9fdd-5a25ada16621", "value": "6144:aKLGDdIXdRqpuL3OGaj52Gx1i3AGBd18wpArwPCUEGK6VcApGz8:jLGKXdkpuCGAM3AsHfKrwPhlcAM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725488, "uuid": "c38ed3a3-e1de-4d0c-acac-475d248ce5d1", "value": 546832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725488, "uuid": "01e38c39-ef3f-4dc5-b94a-ee3ef5d69dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725488, "uuid": "7d9ad086-1a3a-4169-8d6a-6b691b2a270a", "value": "a382e94c77e0c29a1e36b816d68030966446ea154026731d576a93c80caa0420_Microsoft.SharePoint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3685492-3c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776670640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670640, "uuid": "03429ed1-2bf4-4f49-a3d7-b5f33b20a9e6", "comment": "Malware payload (PhantomStealer)", "value": "1a70db59944419fbdbd1e22bc1cdd4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670640, "uuid": "d377b79c-4e1a-4cb2-ba5e-550a423b2482", "comment": "Malware payload (PhantomStealer)", "value": "a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670640, "uuid": "1871036f-200f-49fd-8f22-b70f21040607", "comment": "Malware payload (PhantomStealer)", "value": "02c08e2ac2ab50f23de3eafc7533cd9129bef8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670640, "uuid": "dbb2e054-d5b6-4545-9947-495792e2de46", "comment": "Malware payload (PhantomStealer)", "value": "2e8cabcf6bcee1803ce77f10768c1e56fa119b5b44d5a08a6f72eb521910b2a462927c8e242a542fb09ac213014aea1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670640, "uuid": "e52af6b7-13a4-4c26-812e-fe7ef710bb1f", "value": "T181F49D116E421B05E2EA0F7EC2A5164523F4DED6535BEA1B6EFCB1E04E73BC1CA27805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670640, "uuid": "557827f2-2e8c-4def-9ea0-75268e9285d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670640, "uuid": "0667a88c-b999-4f69-a6fa-3ceb67425410", "value": "12288:nU4bEMbDzcmgtwEIGR9ObL3ZF8L9BgfHHZUKGt6ruxI03jM3+:nU4AEDzXGwEIGR9ObtuKnZzY6rt0zM3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670640, "uuid": "abf36dd6-1dee-4298-8aa9-213d3ee1827e", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670640, "uuid": "76cb4a03-2b0b-4d92-8a4e-66daee4ffd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670640, "uuid": "84d16ad4-dd52-4472-9c38-7b21eb6e805f", "value": "Shipping-Informacion.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928873fe-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776688167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688167, "uuid": "392e356a-f989-4460-b6f0-7543ae82fd40", "comment": "Malware payload (RemcosRAT)", "value": "e5a1e728566e715a47df3c66c2c45b43", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688167, "uuid": "46331ed3-9465-418c-aa02-5d44c083437e", "comment": "Malware payload (RemcosRAT)", "value": "a3f9ad64f22eca94d40b53a77665dbe5dcc6439bb6dfc610318517ecc0e9e3fd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688167, "uuid": "9e507987-dbf6-455b-b3ba-d3afcd3347e3", "comment": "Malware payload (RemcosRAT)", "value": "32e278fc66ff1a61f2907a7e8c68ecb2e35b6566", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688167, "uuid": "61a9f34f-e18e-412c-b714-ae828446270a", "comment": "Malware payload (RemcosRAT)", "value": "37ad115f3eaf4ace6941c3ccc9e319f6b29214fb9426c419156cdc01fff72b8989a012535f10cca8aab24b642f6e78d0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688167, "uuid": "e8866285-4e5d-4425-9ca6-4eddd7a674f5", "value": "T1DAB4D09173E2CB2BF68E5630CEA2C6DC2717FC278E57860B7256775E5C72560284323A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688167, "uuid": "b0d62766-100e-43bb-8e89-39278e24e711", "value": "12288:7gw1n7EyiHLP/gzIbignp9ijd+4TIQ2p2ZtrPIdamD:7gwd7DgD/7bFPdQ2KtrPIkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688167, "uuid": "346f92e5-21cc-4989-8854-fb839798c306", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688167, "uuid": "f328c099-48fb-47f7-a349-e6bb4742ed35", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688167, "uuid": "bf66d66d-9f0d-48e3-8646-ccff0ed4e474", "value": "RFQ# 51239.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0154d3f-3c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668003, "uuid": "4a83cfc4-4ff9-45c2-8497-d4bb53a8bf70", "comment": "Malware payload", "value": "6347a69099509e2c15cbd30fa1c58f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668003, "uuid": "0f6e44e9-9ddc-4275-9a85-a035aa4f5857", "comment": "Malware payload", "value": "a4375c0a35f692ba19eb35a14d970aff83a285d46dd4ca2744fa9fc1dc2fbf2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668003, "uuid": "64aca409-70a0-4ab6-a74a-9812329e059c", "comment": "Malware payload", "value": "36627e4b95358cba030f4f6f241154b3e06f28c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668003, "uuid": "7cfe4b7f-54a6-4946-955e-f1ed3073cb83", "comment": "Malware payload", "value": "44579bb3db29beffeb5024c34e583a3fbaeaada20acfa0f2959581b28406a47becd64399d88830c7906597a1d0040b74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668003, "uuid": "a6cf685a-95b2-43f9-8804-4b47df4994b1", "value": "T15E76F7636A28EB0ED62832341DB1CAC86B6D1C8645D6A417E391F318F9F307D496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668003, "uuid": "aa6bccf9-6f3e-4d5c-8514-d5b094eccd08", "value": "49152:98FyFUa36RF72PriQg0u/6HRph7MXlrKxcSdh3/1WCB67LxUpqRENRZm+JY39mGn:wCal1Upp0Pohn4jEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668003, "uuid": "7146b627-9f8b-473d-90ec-0a0cca536eb5", "value": 7143617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668003, "uuid": "8b0c028c-1bc0-4b45-9499-4000a411796d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668003, "uuid": "4c706c8c-f362-4a5d-9b80-945c387c28da", "value": "krane_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a5d249-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688174, "uuid": "02f30ae7-2b38-4d72-a623-e6d09f25b14c", "comment": "Malware payload (ACRStealer)", "value": "1c159e563555fb4cf7650c7ffc6d9cbf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688174, "uuid": "1cc10493-900e-486a-a230-5f0959934ec5", "comment": "Malware payload (ACRStealer)", "value": "a4506494fdbdd262262d6e954f0a7563560cd968cdb515d608b86648e0ba5fc4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688174, "uuid": "ea0ccb1a-7f26-4bfc-b4ed-d65fe72a77eb", "comment": "Malware payload (ACRStealer)", "value": "6eaaf6f5343ec9ec84386695ebd0abdb463e3efb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688174, "uuid": "6295d6a5-65ec-449b-9646-8ada39f6cfdb", "comment": "Malware payload (ACRStealer)", "value": "50f663f07ef1ff7f646ad94b7448811220b69ac38d5fad4e13dfdc9d3fdf732fd409e8c9cbeea2c10555c1cb869e1e1f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688174, "uuid": "34b2aa1a-b284-43ed-a506-8ba531fb807c", "value": "T132168D1BBCB95C6AC09AB13484736605F665B8441B2317C71AB0B6382F3B3F15BF9B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688174, "uuid": "2a73aa54-dcdc-44e1-97cf-1d6c99176d37", "value": "2933a9cd50b01d442600e145b1a257e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688174, "uuid": "d09107b0-0d2d-4b85-afd3-a6a898d748e0", "value": "49152:djZ9yzZ0mmZxvm2VsYCWq4AK14dzLLBYRjmQch4Ua:dnmseX50p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688174, "uuid": "8e1cbab0-bfe8-4b5e-a390-1aa194e3fddb", "value": 4334568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688174, "uuid": "94ec13d5-069a-4778-a621-2852f51e56fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688174, "uuid": "27a991b2-9055-4f8f-93d6-4269c418f076", "value": "a4506494fdbdd262262d6e954f0a7563560cd968cdb515d608b86648e0ba5fc4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac313863-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725147, "uuid": "df7e41ef-815a-48e3-8a8b-511f8c8df643", "comment": "Malware payload", "value": "cb6294c6c19cdb7f35930b2569415159", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725147, "uuid": "4827c29f-71cb-4077-874c-3796b06b7c4e", "comment": "Malware payload", "value": "a4b590be9e9c39b328b69285182e9b0c1dc742d8df854a147bf709a2b74b15c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725147, "uuid": "9ad5f637-b5dd-49d4-9112-926fed0a1372", "comment": "Malware payload", "value": "9d01b30b4e235c918e6148d7bab7bb84553b2a6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725147, "uuid": "ba041810-cfc4-47b0-a6a4-9ad341c4a8f3", "comment": "Malware payload", "value": "bdaecf475e1e7112122f71649b78232f120dd1a8831961efe3c93fd8eadecf08fe8926a8009def323d45f439c76f2941", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725147, "uuid": "d3fa0438-c6a1-42ee-b59c-28e185a6e599", "value": "T1EF72F90EE78BA87DC509E1B409FF5B31B4B17E3506796B2D1354DFB74F10A88622E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725147, "uuid": "76b197bf-5f6f-451e-ae7e-686aa48a5a31", "value": "e42678787d5b7aff9b39c41d548b8e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725147, "uuid": "79dfa4d6-5616-423c-8c50-3839413967f7", "value": "384:p40D9pNoFOyxS9ozwrtw8dlk1/mckVPxIiTgALMyl:p4A9DuOoSKzo9ImckVPxIiTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725147, "uuid": "fec4fae4-e4f5-496b-ba11-6c164072ade9", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725147, "uuid": "e1b758e3-1825-4676-a38a-a53da42b1b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725147, "uuid": "f147abeb-1a03-485b-a320-0966dca0c048", "value": "a4b590be9e9c39b328b69285182e9b0c1dc742d8df854a147bf709a2b74b15c6_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281fe403-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725784, "uuid": "6f68b6f8-c4fe-4c1b-9f9f-e2d2e3373825", "comment": "Malware payload", "value": "2058818e377aec2f1074c4114f4ff34e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725784, "uuid": "e2193e87-5382-436d-af0d-be61c565d550", "comment": "Malware payload", "value": "a4d6225e5d17d86d97e286ca6ebd1c49a5dc24e8a43902fbab172ab3c33a0d5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725784, "uuid": "52dbb0da-49e4-4952-878d-ac65d4e3e54f", "comment": "Malware payload", "value": "77b2c777f35c4a5af83cbe63ec0afd07e07531ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725784, "uuid": "214ff170-8478-4f16-8581-8e86cb4e66bc", "comment": "Malware payload", "value": "33ea3c6fb7b269522277c03daaf300d4ccbbbbe7e56822d7599f746590e6be744d5e3087b34696d7c9633d095adb3464", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725784, "uuid": "e04d117c-35b4-41c4-ad45-87311bc91eca", "value": "T106B36B0B62E540BBE0B7D23885A34A46E7B2B81107619FEF07A4465B5F237D18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725784, "uuid": "d11771cd-a86b-4809-b200-71c215386975", "value": "43501fd48065720e9fd2d24a68ead8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725784, "uuid": "eaaa165f-0f14-4e9d-b817-76644bd3e873", "value": "3072:rdw50aYcaKf0duwCqeYKhXHBEVJsxSDb3CT:y5FY60M3Ya+9jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725784, "uuid": "efb21b45-0761-4f23-82dd-8b615d84c4e8", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725784, "uuid": "b89180a1-a320-4c69-8f37-1ddaad429a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725784, "uuid": "69ad46f5-1b72-4190-9a87-5dfadc2af3ae", "value": "a4d6225e5d17d86d97e286ca6ebd1c49a5dc24e8a43902fbab172ab3c33a0d5e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a3bdbf-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776687255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687255, "uuid": "fcaf54e4-42ec-4e3d-9ed9-7e8ea32b4eb7", "comment": "Malware payload (MassLogger)", "value": "12438ef3c7a03ec9b926261b8588deaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687255, "uuid": "b6165b29-908b-4663-a2ca-4f192784ee5d", "comment": "Malware payload (MassLogger)", "value": "a4eeb9128d194452e080fb025d7126904f1f99b124075cbbb84bf54e2e78fd43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687255, "uuid": "38667267-8372-4683-a570-187734552867", "comment": "Malware payload (MassLogger)", "value": "3d60edb0e89bc7aa82937193471594ef86d88d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687255, "uuid": "d575f006-7ad5-41b8-a2e9-3108eba42979", "comment": "Malware payload (MassLogger)", "value": "1e66cddb9c6e336fb8cc90d93e5683e322adfde8f1e6d527c75f9c787a388cf9846e486532fe1f72dab348d85e63d8be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687255, "uuid": "ef62dd69-efc9-4fc6-b8e8-c804e6774d2c", "value": "T19CE276CC3AC6B4900B1130FB297BB1D9B52E4C80740D7544F6D5A8BCB96B768C1BAB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687255, "uuid": "fc1d6db0-6eef-490c-b421-eab94700e805", "value": "768:5Ssyy9srKVwqCBXtyaODyCBoLjyFTpCWLJjYnWeQ:5IZ22J9yaKyCBoLGuW9g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687255, "uuid": "93ea9f7e-8160-4bf8-8e4e-623895fb0098", "value": 31947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687255, "uuid": "1667aac0-4036-4ef3-b8b3-1ad98b0e566e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687255, "uuid": "5169d70e-3b0f-4137-930c-3401648a7226", "value": "gtgktvifpqldtxjn7rzcsdwqldtxjn7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0dd203-3cdf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776706599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706599, "uuid": "d58b536b-cc19-4d1b-8b5f-4f8f835b2876", "comment": "Malware payload (Mirai)", "value": "7f5944b571473dab85b3a276a28e50a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706599, "uuid": "e256bdaf-ced2-4ea0-84ba-dbe76051763c", "comment": "Malware payload (Mirai)", "value": "a51fae8739f9c43a530b57115b8a4bebd8a0cd2dce7b99724bf4d82a93cee4f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706599, "uuid": "1dd031e4-24ee-49d2-99ec-0d83a4adfd98", "comment": "Malware payload (Mirai)", "value": "10f9245c493be101fa522047a8f937a3f13fd3d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706599, "uuid": "5fba995a-c4fc-4a26-8b8b-2686c54a251f", "comment": "Malware payload (Mirai)", "value": "e97644eb32c372aa4313bb746db2b53c6b3509f02110b7b54ca0cdeb6624f6ad6930efe60e2db05c47e7c258099c7fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706599, "uuid": "4f4f6b15-c092-4f25-b51b-081d4c80ae2a", "value": "T1C5330A96B8818A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706599, "uuid": "4e0be681-6e49-438d-af46-73695176c4b4", "value": "1536:gdnM5V7dJfTYKk8nYGrCGvgLiIyi55eeQO3:nJLrvk2Ybv5eeQO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776706599, "uuid": "352a58c4-1267-4216-bde8-82db77938e93", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776706599, "uuid": "728a2f6d-e7a8-4b45-9165-ef6b5169283d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706599, "uuid": "b564bc71-3503-4178-b2a3-0670fddab08d", "value": "00okarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c72f14-3cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776713974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713974, "uuid": "c5c3d46d-ccd3-4c95-be59-f1f53ef20c17", "comment": "Malware payload", "value": "2a00e02cc99359831557f8e8a7c86075", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713974, "uuid": "b484139c-30e4-4cc4-b0ba-5ed4832182d0", "comment": "Malware payload", "value": "a5d006dba3ec1debb2c917dc9311bb429125f2d518c117f7c1ab27ca1a16523d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713974, "uuid": "11a07e30-cdc8-4951-9a60-888d652b2f81", "comment": "Malware payload", "value": "b1785796589ef5add806c800d5a60db0507af8f4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713974, "uuid": "bfda0529-df51-42c5-bf8c-d2a7cfba1c0b", "comment": "Malware payload", "value": "0dac88ab6c2a8395231ecd0ffe67d471b63c1daf1c2e85504a5a84b954c2fabe4ef495be3a9d3c61c00bd58edb1c8f28", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713974, "uuid": "bfc21d4a-cad7-4e83-ad3f-21f7ade667c0", "value": "T1F5A423EF4D09770F24BDFAB049F8AC8791810B020026C5567DB6BD102F567BB6A792F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713974, "uuid": "1355758b-d9e1-4719-89c2-1b7d444a8aa6", "value": "12288:azQrf75rjcCZYScMf+MPSquuE4U+sH1MmW/SUV5QP5Dr31N3/h:sQRvpf+ZuE4fa1MtKtr33h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776713974, "uuid": "00452249-b5f6-4b54-9799-74ad4008d877", "value": 449906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776713974, "uuid": "47b405d0-b74e-49d9-9182-6a6bbdcb894b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713974, "uuid": "e5a147d0-471f-46aa-bc0e-2981812ecac3", "value": "NEXO OFICIAL DE REGISTRO DE CARTERA_indetectable.svg.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40775a2b-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676433, "uuid": "0f4ce9a1-11bc-47b9-9dc6-b04c76e2101f", "comment": "Malware payload (ConnectWise)", "value": "2e269661ce7e53c88aa1867b08df3a57", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676433, "uuid": "a34f278d-d426-4e8f-9236-689afcb05998", "comment": "Malware payload (ConnectWise)", "value": "a63a308fc9e37da3e69dcfe8d11920e15be109c041365020c5cbdd08e1cd188d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676433, "uuid": "d8253380-0be3-40a1-b7e7-41ebe503b862", "comment": "Malware payload (ConnectWise)", "value": "6ab96a220121997db5ff18136295c5e490d677b7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676433, "uuid": "b88799df-2c67-4638-bdce-23d7ea128c9a", "comment": "Malware payload (ConnectWise)", "value": "65220ef8a33974afad799b4123c7cd3e7f3a4e53ef6ae616f015187c8de24b548fa4f9885ad135516188bd2484ec68c1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676433, "uuid": "7fb6a393-35f8-4774-ab54-ab10fa54fc85", "value": "T15DD6232523FD441AF8F74A79FD3682E46D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676433, "uuid": "0dce491d-ebdf-467b-8e4a-beed6f56ee46", "value": "196608:bWh0cGwoWh0cGdWh0cGIWh0cGaWh0cG0Wh0cGjWh0cGm:bWacKWacsWac3WacJWacVWac8WacH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676433, "uuid": "549860f1-4f39-4142-a452-99e7b42c4dfc", "value": 13361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676433, "uuid": "d3c2aadd-d29c-4f88-a95e-c4fe8168668a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676433, "uuid": "bc0eea01-470d-475b-8438-94c46422a44f", "value": "a63a308fc9e37da3e69dcfe8d11920e15be109c041365020c5cbdd08e1cd188d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6418ec-3cb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776690249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690249, "uuid": "10742559-14f2-4267-82e4-736f6f1ffc50", "comment": "Malware payload (Vidar)", "value": "e130afe300fc8dad62b37afa5a82dfcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690249, "uuid": "00a277b8-5bfa-4360-a26e-e03d9c7b52e6", "comment": "Malware payload (Vidar)", "value": "a63a4bef804fd6e29dfb03780c4b68d353b848d952573465d4a019b452c56e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690249, "uuid": "b471a42a-e97a-4316-b8e2-4ba29be59c9e", "comment": "Malware payload (Vidar)", "value": "2e357aaa105ce7e5b7cd988fda1fb6d450a04913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690249, "uuid": "b602d897-0dda-4d6c-85a4-99d97b7af0aa", "comment": "Malware payload (Vidar)", "value": "8d8ede93062f0b579063c5720ae116bbe60fb17079db798b2762f930897f556c1d1984e55778c4acdcc67fd6e0a1a48f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690249, "uuid": "965833e0-d5d4-4a77-b782-c57d0a538464", "value": "T112C58C0AADD04876C4AAA3368CB752967735F8581B3723C72E236A782FF37D05975390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690249, "uuid": "72948e95-0955-437e-927d-8cb5046d062e", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690249, "uuid": "f2f27f2d-ceb8-4b3b-9bb1-3a5e91b504ab", "value": "24576:084lQWyOUzPx49lMUe0/tLbSKaRMiND8OAVDV9GizX5NNyJkueB:0XuWy1xizeGVaMpVDVb0eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690249, "uuid": "fbad0817-bc5c-4bca-9e8b-a60f2fd7025c", "value": 2513200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690249, "uuid": "eb84de46-3777-4b8f-9dbf-5fdee9cf529c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690249, "uuid": "aabeba0d-5add-472f-a6ee-39329c7b2def", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62f961a-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726130, "uuid": "91f01d73-8798-4fd4-a6f9-6c70585abec1", "comment": "Malware payload", "value": "72e66120adb7fb6987887552836692b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726130, "uuid": "933d9952-a367-4593-82f5-7ec538a3bd00", "comment": "Malware payload", "value": "a6d6fd1b4116e79e4ef53ea4fa84e50b34cf719a5a94786101b90c946b95243b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726130, "uuid": "12a287f5-fcfe-461c-b29f-2726fad752fb", "comment": "Malware payload", "value": "a410a782678670b444af52b230800f4ec3888388", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726130, "uuid": "56007dbc-5444-4435-b5bd-e924cc312cb2", "comment": "Malware payload", "value": "037f4447f7baa0f774a29162ac6f52205a1f515bff6c122197e6ef91faa996c91f357e478ec11a8949ad0ebe74c60b0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726130, "uuid": "f8236d94-d992-4ca5-a40a-0b75e4760c2c", "value": "T19BB35B5B72BA00BBE5778638C4A74A09D772B8554761AFEF03A4429A1F633D08D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726130, "uuid": "8408cae9-543b-46a6-aa29-b6f9078ee33e", "value": "9e55e729fb60b8131c3d92b149585901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726130, "uuid": "d5ea08a9-1fd1-49ce-ab46-84b937714f9e", "value": "1536:/XsA65lb8nWwTkY3kPX2ahmhpMTHPSVbJteHy+IOQPIxE5sW5P1da9dlJ2dT76vO:/56rIWwZKXAhpAvgtIypOLx6PvqqT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726130, "uuid": "91e706d5-5b62-4401-a6c8-86d993ddfd67", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726130, "uuid": "b73e10c6-2938-40b5-a563-6f49428ef845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726130, "uuid": "a698e93a-9ee3-4e2e-b0a5-7c57c99fe47d", "value": "a6d6fd1b4116e79e4ef53ea4fa84e50b34cf719a5a94786101b90c946b95243b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b88109c-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674438, "uuid": "c153992a-9b3f-43b6-9b22-9112547f2725", "comment": "Malware payload (ConnectWise)", "value": "6edda482f76ee4ccfdd9213d4ff95bc2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674438, "uuid": "d5f98ec1-abe1-4871-845a-64b63bf7f0bf", "comment": "Malware payload (ConnectWise)", "value": "a6dd4e6099a3051fa1216307b4bdffde61a75949fd87f0279003c5e53be6105d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674438, "uuid": "bdbe632d-ce53-4535-8523-8446bb8e3efa", "comment": "Malware payload (ConnectWise)", "value": "4879ed848df545f49505a39fc79ef96aa141b8d4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674438, "uuid": "8fa1c336-98d1-403e-a32a-b22b5efbafbf", "comment": "Malware payload (ConnectWise)", "value": "2cee2c8b0a80c8ba6a5d622666e191aabbdd1912fe65f80603e9eaa78ede1f779e80627f693df39809c394e9f8c7e268", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "officews101-com", "colour": "#5D57B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674438, "uuid": "73146526-710b-425c-a38d-32f8b9134976", "value": "T1BA750110B6E9883DE6F62B32FF7A92605E39FD251E20C15E9394350D0D70A919BB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674438, "uuid": "18fe6aba-7de4-4739-bf67-88249f8213a0", "value": "24576:CZPlmF0uwTKh56Z5vePu/DVeL1pVjeOCnUUGGu/aYmQurhwQUv:Imh69eWbVypVCJgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674438, "uuid": "4419fa12-925a-4933-8085-1f01c2409bc5", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674438, "uuid": "7e824178-16fb-419c-8735-4ee5f4269587", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674438, "uuid": "0545aed4-5875-4cc0-98dd-5c8df4e9478c", "value": "a6dd4e6099a3051fa1216307b4bdffde61a75949fd87f0279003c5e53be6105d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2648b5-3c92-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776673718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673718, "uuid": "e9031c8c-6f1d-40a2-853b-60acf8c733dd", "comment": "Malware payload (CoinMiner)", "value": "bc65f1f3d7fc8e139daa77d83ed249e7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673718, "uuid": "361989ae-7049-427d-bc7f-813193366a62", "comment": "Malware payload (CoinMiner)", "value": "a6f128ead9c40a8737d5d03496763087da7663642b969fb2c893f061d03010c9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673718, "uuid": "74999bcf-7a7e-49fb-a48f-38bdbb63cbc4", "comment": "Malware payload (CoinMiner)", "value": "c03141bff44433e4b261b32ffd27352cd520f4db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673718, "uuid": "90b3cc78-5230-42bc-b348-ef4b3f698b15", "comment": "Malware payload (CoinMiner)", "value": "a65070ab809e6d03b0be9f2ee566a8c6780d92511e608286e63a36f5ed86f04be167cac9c1b0b72031f265b63fc98c28", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673718, "uuid": "97419581-0ce2-4c9a-be09-e5eba5878207", "value": "T13F32911E2A470321DE5049B4F6B1464A553D1EE3B782FEDBE633D1CB0AD6E4584C0AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673718, "uuid": "6575b774-a55d-4467-af8d-954ea402df97", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673718, "uuid": "ef51820e-da93-40cf-9139-adad45717a25", "value": "96:BdwoZzYz/J4hSbOB4SdiTND7rxyQ79zDCTBwePFJxGE9mZ2FFhfC7tCEeAQCXFh:woyFbOB4VxymDOPFJxTEZmFhkeArXFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673718, "uuid": "2dba3a28-9b09-4d21-9625-c361d68d1993", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673718, "uuid": "ec5ba654-b398-48a8-b2dd-ecdb7581eb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673718, "uuid": "86d6649b-170b-419d-9552-51b2fd5129a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858591ef-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776666670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666670, "uuid": "304a87df-0bdd-45a4-8be3-181529ed8856", "comment": "Malware payload (Vidar)", "value": "b6e6f1774af6a9c3c7292b2a42945365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666670, "uuid": "f779b6a6-3db7-40a3-96b7-b742ff4dde24", "comment": "Malware payload (Vidar)", "value": "a71a76b6215d10831239323c84bb0f99a1d915c91767e995550ae2324fd8bcec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666670, "uuid": "371bac11-0abb-43b4-bd9b-1201fc77090c", "comment": "Malware payload (Vidar)", "value": "c3ddc8c96cce712b4920dad25a0ac5268fbae5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666670, "uuid": "d9b1c40b-1851-4532-92f1-b2718d3786b8", "comment": "Malware payload (Vidar)", "value": "7786e10f608c5b1ad7e9afd166f460debfa35c623c8eb5196a76c48664a3aa7f93bc313de49636b1fa822e568f3ba9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666670, "uuid": "7a5d1bc7-e651-4698-81b1-6ef8318b5aa7", "value": "T14DB57C0BADD508FAC46A97728DB762927730F8590B3263D31E40BAB86FB67D05CB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666670, "uuid": "c80ec33e-11d0-4378-b203-c0ea92ffcef3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666670, "uuid": "8d8a1488-eeaf-4a40-ad99-a02c1e09a103", "value": "49152:+wGm0TW4UHNXIW2gGHI5DM9OJs3NhQc8t8nSB1KE0I5ga:+w4ypv2weOsNhQtt8nSB1XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666670, "uuid": "f5855842-b911-44d5-b425-bb433343257c", "value": 2361008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666670, "uuid": "3c80a315-51f4-42b7-b49c-689d02760223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666670, "uuid": "49767bb4-d2aa-44c3-92fd-43165ac4a2d7", "value": "FixBootsrappper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f571e09-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725877, "uuid": "429b5482-7184-4616-9819-63fdf475b5c4", "comment": "Malware payload", "value": "e66058ca8e6b05aa766ada6b4599be47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725877, "uuid": "19f5907c-76ec-4a1b-a4de-a6d2bafacdd3", "comment": "Malware payload", "value": "a76cde194a75c015813ff92a2e2ad809b0be10b72b0ec1209d14187b3434ad62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725877, "uuid": "483d753b-81d9-411e-9724-a4bd38a2a30c", "comment": "Malware payload", "value": "3eee2641e54694d4e437e4bf517f1683748349fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725877, "uuid": "81c1d225-979e-441a-bc77-7df2c8e19fac", "comment": "Malware payload", "value": "af7fe0ba00e2c4ac88203efbe5b886517344e747e81727e640affc0639135b38269b043e1ad688e4886855f5c85a405e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725877, "uuid": "2b707ec1-8e17-416e-a160-8f9306a5aec4", "value": "T1A6341B50B681FEB6DC998FB420D3530993BAF081971DEB2B6660FE3C025EB58D473949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725877, "uuid": "ac2a7d11-94f2-437b-b8d4-fcd9837e9a4e", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725877, "uuid": "19e38314-f449-48a4-a26e-f20bd8e14928", "value": "6144:jSWZ7CaMVS+QKnkZ28KVu/HyeiZ62j5yd7A:FC5UgkcrJBPYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725877, "uuid": "701fd212-eb27-4cb9-a3ff-6bc701b59bd1", "value": 238639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725877, "uuid": "2125963d-61b7-4bf5-be3f-147d98e87aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725877, "uuid": "9a46085a-fe4e-426c-a314-247b81624827", "value": "a76cde194a75c015813ff92a2e2ad809b0be10b72b0ec1209d14187b3434ad62_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099a27e2-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676341, "uuid": "c51ba46e-b719-4053-9991-4fd32bb96727", "comment": "Malware payload (ConnectWise)", "value": "c2aa1928307608eadac9ef08e4afb8cc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676341, "uuid": "e838a92d-1350-492e-817a-be244170d51c", "comment": "Malware payload (ConnectWise)", "value": "a7704aaa1731d096d35d2b0c9d8ca6af6a933d269f7395491ce4fec61975c305", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676341, "uuid": "40b17b22-ab0f-49f0-a7dd-29e2e9255ef5", "comment": "Malware payload (ConnectWise)", "value": "de77142be26fefd3172be9b675cf7ba2ae46368b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676341, "uuid": "a3e5719d-722d-4f6a-a5c1-e76ca0344c89", "comment": "Malware payload (ConnectWise)", "value": "ccca032bbc998044cf8418f9d09c73f956b77640fd754e04d6e1dea3c5bc04db416bb895c624373e616c3d1d88cdf785", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676341, "uuid": "9d7fb38c-a68b-4058-aa0c-df857f718af7", "value": "T138D6232267FD0918E1F36778FD3A91E291367C658F12C09F2614786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676341, "uuid": "e6ec2696-9c9e-4a3c-8221-9109abe76ec7", "value": "196608:3rnLYG3zDhukOzrnLYG3z4rnLYG3zBrnLYG3z+rnLYG3zCrnLYG3zgrnLYG3zU:3bDDDgvzbDD4bDDBbDD+bDDCbDDgbDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676341, "uuid": "0df6eb09-9e7d-4f2c-b69e-8c5bd15a233c", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676341, "uuid": "958d0ab9-ef48-4e44-9b30-fc52524c6328", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676341, "uuid": "fc51e9a7-985e-4092-af7a-b3b0fca2374f", "value": "a7704aaa1731d096d35d2b0c9d8ca6af6a933d269f7395491ce4fec61975c305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f467e71-3c92-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776673586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673586, "uuid": "a27c56e6-a836-4f91-b0c6-b49bf3d06d4f", "comment": "Malware payload (Phorpiex)", "value": "defd3567d6e567f6d660103f5b2d3e4c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673586, "uuid": "1b986955-e2ec-48c4-b2d4-050ca6e2fcc6", "comment": "Malware payload (Phorpiex)", "value": "a78e024e259431c239e1dcebbbb0ff53d93f61ab66f28b30b60438bec733a5e5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673586, "uuid": "3de8cd1e-9182-484e-be5f-9f3677d984aa", "comment": "Malware payload (Phorpiex)", "value": "dd316e8bb62b3609c275c8d73514b4da254cf1fb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673586, "uuid": "8309cc57-8f81-481c-852b-bb01e4e7c113", "comment": "Malware payload (Phorpiex)", "value": "0d8a1e5e70a999d34c8c85392c515d49b53870a6e4eda70e0ebb37b006ce5a1d1774ea43af6d8746c14a97e00e873637", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673586, "uuid": "5c4b8888-f7a7-44e8-a82d-7549b6efdf77", "value": "T13A824B0FB9424216D0D200B49676867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673586, "uuid": "26260fc6-1c7a-4821-bef6-026891c69cba", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673586, "uuid": "92613dd5-814c-4ee8-ad35-1a599a593751", "value": "384:OI78VGQic1Kwzw077u9NHuagBhav8U9cK:zAo0769uha0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673586, "uuid": "959760d1-65f7-4821-b25b-89603cf365da", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673586, "uuid": "dcb13d90-d623-46d8-b4b9-f4097a7087a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673586, "uuid": "cb83dc22-6098-49f9-92f7-5374f2c9d036", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba3ca4d-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724824, "uuid": "8265cf23-ec43-4909-ad01-4816cac95d0a", "comment": "Malware payload", "value": "5a10ba1c404234ccd17d0e32f7a35790", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724824, "uuid": "05b695d4-97b2-4e65-a4d0-d7393be99c3c", "comment": "Malware payload", "value": "a7bc193aea3959a2febbbb613f5954549159f589e5553fc1298ea2a0b7660599", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724824, "uuid": "a6b0b604-bfb8-47e4-98b6-d9947fd19b81", "comment": "Malware payload", "value": "65fa0bb18e4b4ab01825a62b9071d3b8d6223b64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724824, "uuid": "978d26f6-5642-4084-81c5-ded61ca0d8df", "comment": "Malware payload", "value": "97a2591e0ad6ae0ac4440ed94e55627796c3ce84a61c872a3cae5a2e379736f335974efd5ace074062d9d08221993b8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724824, "uuid": "a1fd9a1a-cfc4-4ba6-b8f2-1752aed83518", "value": "T1B243C00AB76764ADD55981F886FE0332BB72BB701A721B3D6160DBBC0F506519C2ED60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724824, "uuid": "01019f24-c608-4d3f-bae8-2b6dde669c62", "value": "fe21e882686b5b4fbd50889e1395d60c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724824, "uuid": "5563e303-f954-4ac7-bb97-572c93c915c2", "value": "1536:o6KBS9xRYrUZIPVaqn6+4x/1N2SIEmHwmckVPxIiTb:6BAxU9P8o3ckVPxIiTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724824, "uuid": "81d32ea9-604a-446d-8523-e49231df2cca", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724824, "uuid": "6eae7b52-9596-4992-a397-ca15723b726c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724824, "uuid": "dc0bbacb-162d-47fc-ba2a-4c2b843e0782", "value": "a7bc193aea3959a2febbbb613f5954549159f589e5553fc1298ea2a0b7660599_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf84f6b-3cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776700828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700828, "uuid": "e367e15f-349a-42b5-8ff0-d607d57acf66", "comment": "Malware payload", "value": "a3fd0ee62e6063f9e1f0f494db70b388", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700828, "uuid": "9fad267a-8fed-44f7-b2e4-fd7542106342", "comment": "Malware payload", "value": "a7e5ec1cea5bfcdd2ebc4fb54e1c3a54335cef6a0e4e740c079dfb8200d6b767", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700828, "uuid": "1b82d73b-8978-4fe2-a729-0449837df9b9", "comment": "Malware payload", "value": "cb41a5e9dd5b7eb4b880c13cd07b7a5dcff93100", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700828, "uuid": "ded41c9e-046a-4b7f-a627-1a9c38e7ddc6", "comment": "Malware payload", "value": "f77ac6bb978a6e7b3d52bfc8c912826c2f966db6e72f55298eb3878dfedbde46586f64fb65b93e23583ab63073347e82", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700828, "uuid": "35271d42-47cb-4cdc-9253-ec6d6c5ad141", "value": "T1E6D4F1B85AC92C7EC2271E685871E803EE6BC7E7D23D5482FB97250BF78A8144C558C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700828, "uuid": "560825c8-e92c-4df5-b9fc-73d99188a9d4", "value": "12288:Y6OfTywqudaPe7lyhAHEJlJxJuyJX6S+cM0Ge2BQEFAnDl+KgXvxEDqa:Y6OfT3qDPzJ9sijMfADfgXFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776700828, "uuid": "2b04927c-11c6-45fa-be1d-b27b9248b366", "value": 637223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776700828, "uuid": "0f3bf7f8-b6f7-404a-8b68-0b6eb2466811", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700828, "uuid": "f8a022fb-c07a-499d-8a72-dac5ac028050", "value": "PDF COMPROBANTE DE ACCION DE CARTERA_indetectable.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c501d8ae-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725188, "uuid": "6cc0acbf-466e-41c4-b276-8fc284466e1a", "comment": "Malware payload (RemcosRAT)", "value": "6bd4f3448bcced08eb1cd054118af3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725188, "uuid": "f58631b8-c00c-479b-859a-ffb9c1710e85", "comment": "Malware payload (RemcosRAT)", "value": "a907d35faf1fb9148c6a340fa2626e2e62b8eb5e46b4b0427ad002cfffdf2e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725188, "uuid": "72b6a494-eff2-42bf-9caf-ab8e4197364c", "comment": "Malware payload (RemcosRAT)", "value": "e4ed20203d43b3bad1d9ca51d62e039a31e73129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725188, "uuid": "cc7ff24d-ab02-45f4-8eb6-fececff2927b", "comment": "Malware payload (RemcosRAT)", "value": "3b6fbb1b3d4081f9a30145fe33b8c7b5400f3a6f45362ffc0bd56d6e6ac6cd27c1d3ea6ac8b091a6c2291e659465de8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725188, "uuid": "31099a92-bc34-4422-8896-8a9f4857a416", "value": "T195D45C95A3D441F4D077C234C9C24537E6B2B8056670462F03EB5E6B6F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725188, "uuid": "acf499d9-5df9-4592-a563-1a008420b028", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725188, "uuid": "0ad091ce-c93f-490d-9de5-cb5ec0c701e2", "value": "12288:5aMwmp7scoHvln/+iB9PQoYYUPGmdou5usyW:Y7mScoHvln/+aPQoYDPGmd35o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725188, "uuid": "6a8305c7-9a21-4a3a-863f-9374264d1d61", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725188, "uuid": "d6131870-cc9b-479f-988c-270b4edb169c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725188, "uuid": "507f3612-78a4-4540-bf05-97e59ae0e0ff", "value": "a907d35faf1fb9148c6a340fa2626e2e62b8eb5e46b4b0427ad002cfffdf2e2f_9a11d0d1-38a0-40e0-a522-07f16ba3259c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e786ed61-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776665976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "07d73996-123a-4ebe-94c4-f11e21ccc069", "comment": "Malware payload (AgentTesla)", "value": "79c0fb5846d029217b0a117ca92a49c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "5ceefc4b-ee34-44e4-ae03-f78b3604bab9", "comment": "Malware payload (AgentTesla)", "value": "a980b5a7c30d8a5f74a2aa5370ce9485aecb99f659f4593db7396fe65a43c7bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "3a9d50fa-f588-4ef5-b839-0aa4df52e1f8", "comment": "Malware payload (AgentTesla)", "value": "865a3741f417b09dd91b3945871515ccdbc41fe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665976, "uuid": "e1928d8a-2876-4992-bf53-33cf27f5288f", "comment": "Malware payload (AgentTesla)", "value": "78432892e2018ed34cf2abf6d27a9d28f3da6f81232a13abb253e5c03c1155122135e49b5b828cd87b85672624186afe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "3d1ed0b2-fd35-4106-8366-b1622d1622d4", "value": "T12C56940CC1A4B42859C2CF9AA5AAC4B24CCFB86B6E4D8973A01FD0BD1C59F93D4615DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "58a5b662-cb72-4940-a1a3-4a12c018b2a8", "value": "98304:qxBPfnV8ns+//fStJ8gUUH77OCg7VR/nurlmzhpLLie+HcUEOVEV5bN59+qzJIJ2:qx1nV8sPJ8gUUH777g7D/ursdpNVUEOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665976, "uuid": "51512992-361b-4996-92d4-8126d75b7bc1", "value": 6027836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665976, "uuid": "62397988-e1a9-4560-baed-0a9ed0dad0fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665976, "uuid": "488552e3-81af-40c5-a74f-0c95e469e4a8", "value": "drvlbgvh.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfaf1f-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688335, "uuid": "586b2c59-3010-4125-94d0-1e168c67b19a", "comment": "Malware payload (ACRStealer)", "value": "53064d8242b201563c9f5b0f42b10232", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688335, "uuid": "cc52806e-9a2f-413e-a364-0abdf645e1d2", "comment": "Malware payload (ACRStealer)", "value": "aa047a9a7f1d3161c6285d40634c5387fbaa990f9e5868f7a036c3d260fcd055", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688335, "uuid": "e52bc139-fb0d-4c04-9aec-53299509f155", "comment": "Malware payload (ACRStealer)", "value": "bfe2e0b49fe125497ee37ef8e3dad2c1a53dc6d8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688335, "uuid": "efe12671-ad4f-4698-a4c0-1a4e99acfe6b", "comment": "Malware payload (ACRStealer)", "value": "e7b601dc2dce8b5458f5cc739065ded7b0f267dc656842f470bfc27f25488825b30b7b31b5714854ab54d6394538c683", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688335, "uuid": "61f605e6-920a-4ea3-89f1-fc69f4304367", "value": "T152168D1BBCBA6859D099F2348473B605F569F8451B2317D716B0BB682F3A3F04AF9B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688335, "uuid": "3c21f553-6e82-4d0c-9353-2735e1d80367", "value": "dcfc31003c379edf77782fe7ed76661b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688335, "uuid": "bf34a602-9699-4ce4-b1e7-6873fba18e75", "value": "49152:hMHek5pxoPAHVODOagqKF4Rny/mzoVtW0W7qjUZwQc6dwy:hMoAXyqopbPwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688335, "uuid": "a9187c70-beaa-4c46-8261-eb348d2e9a25", "value": 4282408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688335, "uuid": "c5e368d0-1b78-4f57-a03d-6a59e678ce8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688335, "uuid": "588ace21-b1b7-4ebf-8dd5-262fb35301d0", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af72391-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776666250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666250, "uuid": "f2732451-da8b-4efd-9869-ed311b1d3a6c", "comment": "Malware payload (AgentTesla)", "value": "dfb75349bfc8622b59698c28e81fe515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666250, "uuid": "e7df34c5-f25f-4593-9b1d-7de99fd5f48e", "comment": "Malware payload (AgentTesla)", "value": "aa444e210c232d199beb9807d9027f46158f3bd9f54a741e1985fd730060375e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666250, "uuid": "ee7cd6b3-6861-475a-8de7-1383f807228a", "comment": "Malware payload (AgentTesla)", "value": "846ee8982058b59fa6f25de63c8ee316805aaf45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666250, "uuid": "eac8bad2-cc1e-49c2-8f59-5db2e8c02c19", "comment": "Malware payload (AgentTesla)", "value": "620e7c52cf716cc31b0111cb8bee7e1ee69622785d769b65c91c7cf50e14660d5d6275fdfaf581add476c4809138d2c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666250, "uuid": "c950278c-0e62-411e-9beb-0497a35aa882", "value": "T168C45116EA51A02BE0938AB079799547BC292D361780EC57FB801F693074ABBF1F171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666250, "uuid": "02fb8e67-1589-4a0f-9a73-ad224c5a8522", "value": "92e718e197b9c3892a265f2138561f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666250, "uuid": "53c6f647-7a5c-4f25-bd12-802e0b0e5f42", "value": "12288:yOEoLuDNbExRQuIBzyUou81b7sFbo3LNHIvMWWoLoBV4Fv+a/gbMboait3KlY/8B:z7xL5HI/WAo/4Fz/gbMb5iJ87WSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666250, "uuid": "58a072a7-7e56-4552-882e-52d8f929e0bc", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666250, "uuid": "40069355-8493-43a9-9056-32a6ccbb1bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666250, "uuid": "fbd512f4-3742-4426-a25d-fbf429099236", "value": "Facturas pagadas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4538a4f-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676627, "uuid": "be4bc864-3907-4f16-bf97-c8dd409d3c39", "comment": "Malware payload (ConnectWise)", "value": "d044e127fa7c227e0c1da8348c0e0dcd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676627, "uuid": "b9cf9d76-ad69-4a81-a13a-3379b18e933f", "comment": "Malware payload (ConnectWise)", "value": "aaae65e7888adcbe6a97a9527d19ff1e1ffdad5468e4d2f5eae3585130c28e12", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676627, "uuid": "e3684e3b-f92d-493c-bcfa-b291d143bb9b", "comment": "Malware payload (ConnectWise)", "value": "d990e3c05d91b56cf9e3c02bd14ddf29b0e51ce7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676627, "uuid": "3909a128-f25d-4c3f-9fff-4a27a0627d88", "comment": "Malware payload (ConnectWise)", "value": "e12b86658777205262915e208b67cfa4c38786f8295f077863dfe43b5be9eb6735230668a85301cbf0f0455c57b53a93", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676627, "uuid": "c58f4e39-3bf1-49c5-aff0-adfc9f9e337c", "value": "T19E46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676627, "uuid": "83714dff-de19-40f0-9d1f-0400d173f3c3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676627, "uuid": "f35056ef-f9d6-4058-a7a7-b2b773b80572", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676627, "uuid": "30eb6df0-4551-4e8a-9a22-ec9281fda65a", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676627, "uuid": "add27a8e-6db3-4474-9619-7d96bad14b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676627, "uuid": "c64b77a5-8f80-4a9b-85e0-4b486f168b6e", "value": "aaae65e7888adcbe6a97a9527d19ff1e1ffdad5468e4d2f5eae3585130c28e12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cf1902-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725272, "uuid": "f5da96a6-43c6-469a-8de9-dc890bc6378e", "comment": "Malware payload", "value": "f277e0e285c90b91e2da4f4f94046c9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725272, "uuid": "952e70c7-9451-431e-a0a9-d45439d27736", "comment": "Malware payload", "value": "aabf7c1591dbecbcee2225a1b7d46fec856a304cb3264cef7eb90251d039e48e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725272, "uuid": "a06a329e-f966-4530-8354-452ea755aa8d", "comment": "Malware payload", "value": "307b4d83b2c0245627b54c9e9da16976cfd50c98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725272, "uuid": "fd53bfd2-4130-480f-b2d8-bd5e0c01cf76", "comment": "Malware payload", "value": "5253621bd71ec0b0e4b30baf02b22f103b72cd66fe79838acc95141981155af17f841c57cfb34ae4ac368438b2ab0bbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725272, "uuid": "01217456-9d6e-49c2-be5e-61c78a4e7849", "value": "T15EB34A57B2BA10BBE1738778C4670A45A7B2B8414761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725272, "uuid": "661d820b-90ac-4789-ba26-2c0e7f5e94b3", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725272, "uuid": "2b6a3b4e-1be3-41cd-a1d3-1bf4f9585f46", "value": "3072:t3QQah85ZpA4rwgw3LyVQezDZ4Ckx5qVyckVPxIiTlpw5:5aabDw53Bna5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725272, "uuid": "6eb69fb9-8b83-45f5-a58b-9135d17ab2a2", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725272, "uuid": "608775f1-56b3-4b35-b774-adec957c816a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725272, "uuid": "98b61f85-1dd7-447b-aa7b-1dda9ac6de98", "value": "aabf7c1591dbecbcee2225a1b7d46fec856a304cb3264cef7eb90251d039e48e_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e14fa5-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674046, "uuid": "fee3c410-86f0-4c52-8807-5586df540ae7", "comment": "Malware payload (ConnectWise)", "value": "19d671f9069d7662c114eeecd184dc68", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674046, "uuid": "dac89e65-4651-40a4-92d8-02856aa4fc72", "comment": "Malware payload (ConnectWise)", "value": "aadf76e1f11d1b37b47dc8fe6a953ec1a5996045406d01bcfa15625ec343f6ce", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674046, "uuid": "c057b3ba-9530-4d85-811e-d2eb407d2a55", "comment": "Malware payload (ConnectWise)", "value": "3c816fc50fe9173676f1f2191b0918130220a756", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674046, "uuid": "c1571410-cade-482b-a73e-e011c73f1d1d", "comment": "Malware payload (ConnectWise)", "value": "ec2171d8eb8e7b06bafd1bd99a9e31e61e37fb846c3df33473689fd8ff323afb3d36d462dbeb2642b84401ff80fa9a6d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674046, "uuid": "aa232ed9-7ccd-445d-9e92-cb4e6b08ff66", "value": "T1B746E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674046, "uuid": "c1751b56-a1c2-4ed5-b1c0-d8fa6aa07668", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674046, "uuid": "dc2fe666-1754-4231-a0a6-e7c9e080bcca", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlhgLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674046, "uuid": "b38b7f15-12ee-47a0-bcf3-3c9fc8170268", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674046, "uuid": "764fa594-6730-4db2-ad79-4fcf4932a344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674046, "uuid": "e7c7db6e-e43e-4d1b-b85a-607306d9b87e", "value": "aadf76e1f11d1b37b47dc8fe6a953ec1a5996045406d01bcfa15625ec343f6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeb2ce1-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725869, "uuid": "5220d0ed-ba9d-4603-bdb9-66bab61da46d", "comment": "Malware payload", "value": "2b5bf21336d7dfc4b69c3b8ae206479c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725869, "uuid": "dfb9caed-2696-4125-9030-ca4013b242a6", "comment": "Malware payload", "value": "aaea6c2278b089f8ea55e7c87f542468dced97af10fcc83da7443cd779948a59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725869, "uuid": "aa20b9d0-c27e-4a4e-a9c0-b94e41ae880f", "comment": "Malware payload", "value": "89db78a84a77863cedd5cf2bc649c9458ed91d34", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725869, "uuid": "eadeb8a8-373b-41bf-a06f-f744a3d8eaf8", "comment": "Malware payload", "value": "9a0504f2fb634a39206bd70e50966b5ce95fd545a8a69e8f04ce1046ddd437a8b5b89e0dbc898cee5a216062110b8eee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725869, "uuid": "d589c205-741f-4d9c-bb34-40a14959c6d8", "value": "T16BA2190AF75B14AEC97AD6B086FB1B33B8737C2249226F1E4350D7B16F50A90622DF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725869, "uuid": "5e788400-3351-40f5-87a9-50aa321fbf90", "value": "e8dd8318dd9ae8d1533db6d0bad58fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725869, "uuid": "fdfac999-a5ed-46e0-85f9-f4e058f16ecf", "value": "384:xSo79mrSx+j3pHcqh0ejqfn7wuMH+y1NKsm3FAL7ss:xP98Sx+rpH9iejqv7pMeZy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725869, "uuid": "8a9618a8-d716-4c67-b582-e31a27a42824", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725869, "uuid": "45841d14-2844-4949-a24c-541173297b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725869, "uuid": "d7a3a4b6-c862-44ec-858e-d7528a02ce23", "value": "aaea6c2278b089f8ea55e7c87f542468dced97af10fcc83da7443cd779948a59_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6763fd-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776727130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727130, "uuid": "f8fe0830-1128-4451-82dc-7aefc0a3f99a", "comment": "Malware payload (Gafgyt)", "value": "0cc76a0aeb8119321f1c02a6fb8feed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727130, "uuid": "f4057648-cea7-4f34-87be-bbe8d653d306", "comment": "Malware payload (Gafgyt)", "value": "ab0bb71ff55ef0f22f99d5bfd189fcd8735d58fe036063754840733273b5f15e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727130, "uuid": "9674c6a0-1446-4712-b9c7-7b06a4e71d17", "comment": "Malware payload (Gafgyt)", "value": "cc437316b4c6f74853316a9ad57c5366b28c2131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727130, "uuid": "0ceec22c-7e48-4663-9d6d-7825e19e9de4", "comment": "Malware payload (Gafgyt)", "value": "085fb239e1f6eaf604cfdda13f26c7d9b37acfe85cc9da11fea899b7a50414e55649429bec987f2e7a9429ecc38bbd2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727130, "uuid": "6fb60633-aea7-404b-ada9-2463324c3dd7", "value": "T10554B661C54CC983C163167DA1EE9FAAAB3B73DA2786DE017C9466702AC6FDB1C17C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727130, "uuid": "1c0eea15-ec51-4c63-b415-b15fee256626", "value": "6144:OZ5T4HXUPaz+N79q2aRwTp7qUGOiu6M/93m7wMVkgQ4:Ov0EPaz+N79kAGwz/Rm75VkgQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727130, "uuid": "a4c5d9eb-6b60-4f84-baf4-7f2ccf9129f6", "value": 291592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727130, "uuid": "027fea83-6f21-4374-a4e1-3adf8c14b700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727130, "uuid": "f668e9ed-a5ea-44ab-8f33-37c2f3da3f67", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b988e86f-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676636, "uuid": "35a5088c-8e04-4c0c-9fc9-ec4b469e0929", "comment": "Malware payload (ConnectWise)", "value": "361cc7b3ab15695bf5d6a61da003c4ca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676636, "uuid": "3a48343a-a260-482d-8494-1bc495a36b04", "comment": "Malware payload (ConnectWise)", "value": "ab23b919288b756b32a2a7f9853368a14b6387dfb8f8f939d19b40bcb00f8e2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676636, "uuid": "9ccf5e33-182a-4899-86de-991693a61bd1", "comment": "Malware payload (ConnectWise)", "value": "305e25a06be7334d74f17c05efa0cd4f31bd12ce", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676636, "uuid": "31270b7f-b8c7-4618-94c3-51ebe6a189da", "comment": "Malware payload (ConnectWise)", "value": "827a64791143f88acfdb63aa618f66041881b3da3a21bfd6f5e269dcb1f1f6e8cb7cfdfdc5dadd25a654dfac6db2f726", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676636, "uuid": "89e79113-1b9d-47d8-8f1e-210eaf62cefe", "value": "T10C46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676636, "uuid": "64712aef-c8ba-4d3e-84a0-d857d4189ec8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676636, "uuid": "055ac4ef-7bbd-41e4-b470-77bd41b90e2d", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676636, "uuid": "a276e854-901b-4e00-91ff-ff5b52bfbf8f", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676636, "uuid": "fb898949-1275-4c3c-916a-6769c6026ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676636, "uuid": "e085701e-0900-4544-a1fc-3dd7b5fbbcf4", "value": "ab23b919288b756b32a2a7f9853368a14b6387dfb8f8f939d19b40bcb00f8e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b643cb-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776696333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696333, "uuid": "ae16d23e-6395-40ff-a529-1750258e4eb7", "comment": "Malware payload (Koadic)", "value": "cadf2a3fd2a3ae8e801f62d26f659eaa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696333, "uuid": "b973a91e-7104-43dc-a7e6-aa397e84c55b", "comment": "Malware payload (Koadic)", "value": "abe7e5da48a8a55badb87c6937c19d10561fe6f22024c2a5b3600c97706e96bd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696333, "uuid": "e04aca99-da25-496a-b2a5-59b232aa86f8", "comment": "Malware payload (Koadic)", "value": "1da86814709916016224e5011df96c3dc6e1eae5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696333, "uuid": "462a7e1a-1733-4759-b32a-e3d2037b2fe0", "comment": "Malware payload (Koadic)", "value": "74b3fab55b9f9df9a5a77bf0b5cb667815d4f529b191c2c929e79d9357f5023ecee1eabf3a09f2d5e493e1697b22bbee", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696333, "uuid": "63fa5405-c7cf-433e-8af7-0f71c8f4b79c", "value": "T1343272E98E5F8A1FE32F1C796AD9583A8DC5D4BFBCD19974E340033E2C9642C09164AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696333, "uuid": "b9ecd585-3dbb-4d1a-b252-06087c039cae", "value": "96:UGxWUrz8r+a4xZNhfmKLfc0Z+0jga4lZGA3:lxWO8r+tXhuZIjgBky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696333, "uuid": "6c05a9d3-a1b8-4b3a-9839-f5d9e30c28d4", "value": 11211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696333, "uuid": "a8bacee8-c34d-4aa3-9561-61ab3e3e951d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696333, "uuid": "acabc1ea-e6e6-4471-a64a-bec0544ebb37", "value": "HSBC_Payment_Advice09287389.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac78035-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688315, "uuid": "bb1e93c1-36e1-4afb-94d1-fd17c6a5bf96", "comment": "Malware payload (ACRStealer)", "value": "1aef6a4530b0519328e6ea1d4b9f00ac", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688315, "uuid": "94439ab5-983c-4081-97f4-06bbc04b7e7f", "comment": "Malware payload (ACRStealer)", "value": "ac2e4647b0e0847df5f61090f3fef65f20caa7534f0cf41f8d307d3545dfc60f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688315, "uuid": "bc6339a8-ef45-4ad7-82d3-0f7afd52816f", "comment": "Malware payload (ACRStealer)", "value": "b4290e28b166e48810eda2d20d330d236d24b162", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688315, "uuid": "3f4eedfb-39b2-4151-82f5-0a815bfe7689", "comment": "Malware payload (ACRStealer)", "value": "7940859208cc3de88be54531aca4111877278e89d21c301328577e77e7fa89f6cc3ed6f21bc89e6067d63ffafb818a0d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688315, "uuid": "fb7cc1b5-58d3-4a23-bccd-afc3664f7edb", "value": "T160168E17BCBD5869C099B1348473E606F964B8445B2727C71BB0F6282F3B7F05AB9B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688315, "uuid": "6f63c854-e54b-43b1-bb24-cba330f66874", "value": "e1221a662fa83b5d7fc5aa5a30acae91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688315, "uuid": "d5a04ed3-5d7d-4f95-89b6-66adb3a6e9fa", "value": "49152:GnQimYWnbD9BWQaRykA161yLf/YPHrIJWSM764mZfWjoQcT/RqiH:GnoD9sQ6b87M7MZgSRqiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688315, "uuid": "8469964c-46c5-4e32-9cca-969006fba3fe", "value": 4393488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688315, "uuid": "5fa3e26f-df42-4e87-add6-f1c9724426f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688315, "uuid": "37f0d863-c1aa-408d-b446-568afa2370e7", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383aba5a-3c83-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776666970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666970, "uuid": "b2e14cf9-715c-4619-9c88-1be025b1d3f7", "comment": "Malware payload (AgentTesla)", "value": "9b3a02b6eb4fbe899445d6cf6467f12f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666970, "uuid": "9f914bec-ce07-44b7-b964-140a047d154b", "comment": "Malware payload (AgentTesla)", "value": "ac5b72ac5b9aafc6d2f1f494be22c583576bf102d34470c1f342f631e8aa0fd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666970, "uuid": "043eee2b-0e66-432b-a9c9-edac06c7a393", "comment": "Malware payload (AgentTesla)", "value": "0fac0e470c20fd582766d3032ed02ddff308fda1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666970, "uuid": "43f5adcd-ceef-43d5-9ddd-39f8cef0ce46", "comment": "Malware payload (AgentTesla)", "value": "44ad0c211e2b85535d4bbab815b976a794fb6ec0f55f974b34bc831117d21e29d0d7bbae8acec62e74dd9c0910b5e6cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666970, "uuid": "5e06e6fc-0828-43c2-85a3-eaedc0d763c6", "value": "T15256A608E0A4B15E58C2DF5EA573E4B148CF78AB6E0D8A73602F947C1C69F93A4521DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666970, "uuid": "cc563b94-c685-4d95-a8f2-bb6e746b8d84", "value": "98304:75UU+41QXDyTNsYXbCLmEDWHQ7gGmSUIfsW6LQu4cE4SbkaIZkRnhG0v5UbYQMNs:lPh1QmTmYrCLmEWHQMSUIfvyQu4cBSby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666970, "uuid": "e98179e8-4d9b-4d81-9f6d-89b3c846d479", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666970, "uuid": "6d4dc310-76cb-4814-9b44-7a074848aa38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666970, "uuid": "2cb9be49-3e77-4d37-84fc-0dc69a9b1485", "value": "Revised Purchase Order 2026-XY02.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9d8317-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725200, "uuid": "fb512438-e690-450a-8255-24f2d5f73403", "comment": "Malware payload", "value": "9f6fa310dbb3657a5752b7c14bc3ef50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725200, "uuid": "26676a03-74a2-4d10-adf8-1745cfd08ff3", "comment": "Malware payload", "value": "ac75c5223d263506713114a14d271490734be572552cb45524901918f8e5e244", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725200, "uuid": "15ec55b4-6440-443e-99ec-8bfd226c8be1", "comment": "Malware payload", "value": "1d5ffec356bf206db2e0cc025aad56eba1849f37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725200, "uuid": "35053d56-8dc8-499c-b00b-139321d736b0", "comment": "Malware payload", "value": "d80ea7b11f7701bebb455b8cd888befce87a71a447365bf69cedfd584a8025a29353a747580f4c2f435e22b2821fc5b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725200, "uuid": "423a5b2f-a27f-418e-9216-a215dd72ed07", "value": "T185A3494BA2E600BBE2B78678C8930A49D772B85517619FFF03A4425A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725200, "uuid": "0e27611e-7cda-4c0b-a424-e7402ac3712f", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725200, "uuid": "572ec810-d4e2-4731-9328-2f8fb1a5b7df", "value": "3072:hvBGrVNNR2AJNQKAfRAtivrXT/7nM4L3zm2Q9ZVbZacTShsrHkxj/l:DG5HoqXAfRYvqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725200, "uuid": "2a9a26cd-ea6d-4c61-ab9e-4702d607c84c", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725200, "uuid": "3b46f6a9-ae7d-4c4e-9ccc-32d6ec39fb0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725200, "uuid": "01310019-bd0e-4f3c-99f6-5b2b2308280b", "value": "ac75c5223d263506713114a14d271490734be572552cb45524901918f8e5e244_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4ef1ad-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726036, "uuid": "78949b49-797b-4804-b472-eb887eaddf5a", "comment": "Malware payload", "value": "73fd69ddd840c35a946ae81f22a67f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726036, "uuid": "008db227-ae78-44a3-ab66-194a96eb90c6", "comment": "Malware payload", "value": "aca5a4791b1efd6b8a20ee73aa20afdde6810b5511b327cf236a4a63e15d279c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726036, "uuid": "e909d962-2f57-40ca-882a-aaedad14ddd0", "comment": "Malware payload", "value": "26aec97faeaa3d3634a47abc472dd45c331a3222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726036, "uuid": "5bbd2ea1-e562-4d6f-b5b1-de3cedf65d30", "comment": "Malware payload", "value": "f9fa3c2836dcaeb8558da3ca5542e385cacd3dedead52eb0cd2cd177d72d38e2d2948406c893e5d4e5bdc2cf1a089668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726036, "uuid": "2dc31fbb-374c-46c9-9744-bca2ac0271c5", "value": "T19DD3C01177859F08E83B0779526155A057F0ADA5EB53CE1EBF8930EC1BB3638CB50B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726036, "uuid": "e9a48eb0-a7a4-4f01-94db-66c9e36c091d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726036, "uuid": "35bb5fd0-7d81-4f18-90ab-181551d81a10", "value": "1536:BW7n7MpYn2HmZ+idOQMT5oy/x0va6RSK/KgiNa6vR14tZ7aI2gyOCaxKr9DkhtAq:BvoySvaBVKekyLWT0HVKek5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726036, "uuid": "83df47d5-fe77-4a58-9f73-d51da1022d7c", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726036, "uuid": "a8d0f423-937e-434e-8ff7-3334439445be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726036, "uuid": "dc3fbce7-fd50-45f7-9788-5ad5f0a76d9a", "value": "aca5a4791b1efd6b8a20ee73aa20afdde6810b5511b327cf236a4a63e15d279c_48e6f273-2f98-4516-b2a1-52cb419b0723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6088f0d9-3cdc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776705263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705263, "uuid": "679aae48-0d6a-414b-b5ee-86d11ac5e479", "comment": "Malware payload", "value": "1e48a0246197e9396ac837c6d91b7dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705263, "uuid": "a7ebf773-924e-4933-bd4e-d429648bfcf7", "comment": "Malware payload", "value": "ad3cbef3f1f5e2f7bc1812b3f53d8c897b97362cd7e8fc05e8174fd9f8424042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705263, "uuid": "0a6fe071-75c6-4fa9-bb0d-f3059b27d24d", "comment": "Malware payload", "value": "17fa5ed98b2da0aa87c86cc15d31cddc41490dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705263, "uuid": "5fbcb6e3-7cc6-4b22-8ae3-8fa98f3c4251", "comment": "Malware payload", "value": "3b526a13e6843c57a1109acb15bf1ddce7c8e53049344df8c9da2d4133385754a391bf3beb83d4ea27a03a66bec98559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705263, "uuid": "f75c658e-881e-4896-8522-88b693c3d116", "value": "T1B784C038AAEA5019F1F3EF54AEF47493E82EBF632A0E845D1091034E4633D49ED9563D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705263, "uuid": "d0a7fe27-0717-44a0-8abe-0bbf2dddbe30", "value": "6144:imN+NLqo6zljaF47x2h+x4iZPzrWlzGcwcxzHdCZ4Gl5eInAiwMd5DXt9B4kGOSB:ip6zlOF47x2hw4+LrWccwcxzHdCZnAIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705263, "uuid": "8ece2b64-7647-44b5-a2e7-992862c64fb9", "value": 374044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705263, "uuid": "b10933ff-92b7-41f8-b8ad-fd4408398b8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705263, "uuid": "0cda76d4-ef68-49e6-b108-c99dd97d73b0", "value": "New Order # CCI-357911904.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d0f643-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725052, "uuid": "b676340d-f310-408c-a7af-696c92aed3eb", "comment": "Malware payload", "value": "f7a3ee7e4c0d03aa6c03fdc291191691", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725052, "uuid": "a9cdea8e-40ae-4d2d-af47-c5b83fecff47", "comment": "Malware payload", "value": "ad693ddef2a1f857262b5351b04a6e8e4e256207e83f4a37a830e587be94a34f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725052, "uuid": "f156949d-9109-42ee-a37b-7ebd0fd973c2", "comment": "Malware payload", "value": "ec803117594f93d6900d4b1bc9ea2819528c7ec1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725052, "uuid": "fa41706c-df83-4eff-b2cd-b196f6d0dba7", "comment": "Malware payload", "value": "191664ff8db47289752902abdc7c313ead3e12915073b018632374d1e488bbcf383d9777f08590e001a1f6a28a8efc24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725052, "uuid": "2e7de662-6685-4751-9aa3-e68144da6e70", "value": "T102A34A5B76E900BBE1B79638C8670E45D772F81617619BEF03A0425E2F633E18D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725052, "uuid": "63b60de5-44a2-463c-902d-269134fa9b5f", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725052, "uuid": "86702818-6066-48bd-9e21-a1504fe41ad1", "value": "3072:afAwoPt0PRG7nQbwAwZDuf+0PpLqXOAlw:aol0pAMwAwZS/ihe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725052, "uuid": "ac2ff377-de18-41ba-9258-6db2aa071c75", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725052, "uuid": "1b63db99-e68d-478a-9f75-2b7ca73fb5f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725052, "uuid": "1b41ba7e-5b4f-4bcc-b77a-5aaf37f20bc9", "value": "ad693ddef2a1f857262b5351b04a6e8e4e256207e83f4a37a830e587be94a34f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5275ecca-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688919, "uuid": "1f32eb8e-0e52-4f84-a1b7-d898f72977ad", "comment": "Malware payload", "value": "16cf2e4afab283e55db3a3fd6434ce62", "object_relation": "md5", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xianghe-Information-Technology-Co-Ltd", "colour": "#B1C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688919, "uuid": "ff98888c-cfd2-4187-b1dc-984d8bb11706", "comment": "Malware payload", "value": "ad90ad8bb29b5bd588e495fd314cd4777d4f16dffd98d5139354342222a0e2a0", "object_relation": "sha256", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xianghe-Information-Technology-Co-Ltd", "colour": "#B1C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688919, "uuid": "4486d538-141d-49c7-b5e6-7a2d28f661e7", "comment": "Malware payload", "value": "cd27e2f5503f48f0936321aca4648a99b3fb3617", "object_relation": "sha1", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xianghe-Information-Technology-Co-Ltd", "colour": "#B1C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688919, "uuid": "2c6c8104-ea81-4f5e-890b-25682e1ffbe4", "comment": "Malware payload", "value": "47b9a616050a64287fa5a65390c839c3cc108078909f5f8c241747e3163ea0de54a0ad2022974c41689a1abb09deb2ac", "object_relation": "sha3-384", "Tag": [ { "name": "detoured-dll", "colour": "#CD8C71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io--5188", "colour": "#BF8E91", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xianghe-Information-Technology-Co-Ltd", "colour": "#B1C958", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688919, "uuid": "84fcc31f-597d-436d-a09b-a367c45da088", "value": "T14CD4E043F7441F9DC96BD639CA17237BEB71389696148B0B13A48B232F275342B2E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688919, "uuid": "ffdd8cc7-32d1-427d-a1ad-fc2871a496d1", "value": "2ff469e8a85333f8e6ac6f93c3cf6824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688919, "uuid": "3159a4b6-7666-4fe4-b7a6-f8e0aaa8c749", "value": "12288:AZey+rAW5YQ/qA9UrUoqg+hV2Rie4IINkmzERrteFij0QmVv:zy+BYDA9HrXSukmzERrteFipmVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688919, "uuid": "71de6cb3-a398-4d08-88c7-74d479f0415a", "value": 623864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688919, "uuid": "0cee0b3e-58d1-47f2-a7c8-c6ff3488d7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688919, "uuid": "e338ef8f-823c-4fd1-95e4-6c81c6c5d4b5", "value": "ad90ad8bb29b5bd588e495fd314cd4777d4f16dffd98d5139354342222a0e2a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344ead71-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724946, "uuid": "6775f80a-b474-4981-96fb-af0dea6b5dc8", "comment": "Malware payload", "value": "f5f1cda9d4b86be491a647dc3f274e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724946, "uuid": "f8613560-7066-4130-9706-e4523f5ee679", "comment": "Malware payload", "value": "ae49f4fc113c4b1cfdcc748142be7e6a64bf0b24d8316a54b43a3aaa4fa11145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724946, "uuid": "f134e76c-b807-4f8e-a434-2330033031b4", "comment": "Malware payload", "value": "76bb8b2470d354a4a70e54f3773b37d3994e397e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724946, "uuid": "f0b2a503-c3e4-44ee-90a2-cc7f4c04068f", "comment": "Malware payload", "value": "8d30190b60e6e27321e16fc6a97cce68994649aef080d42b7bc2de041fe265eb1d651a50869e89944d90ac51599d9de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724946, "uuid": "a65a203d-10bc-4e06-8003-43f38dbacabd", "value": "T19C73BE42DAC41465D496123D37B92AFA59B4F8FB7611C19E354CCDE8DBC2CB0A1363CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724946, "uuid": "4366efce-36fd-40ae-959f-b1d01cf25666", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724946, "uuid": "40fad9ae-32e7-4771-a910-7f8fff681273", "value": "1536:Im/sPgvOJChCtYIXdzIAZcLFqhbMb+KR0Nc8QsJq39:5kP8hCtxdzIIc8hbe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724946, "uuid": "27c9fe49-89ac-48f4-b42e-c946b94ea421", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724946, "uuid": "6353b0cc-9896-4725-9145-d49fddf0d83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724946, "uuid": "dd6742df-c064-4ebd-9037-eda04c5771f8", "value": "ae49f4fc113c4b1cfdcc748142be7e6a64bf0b24d8316a54b43a3aaa4fa11145_9afb3f62-58de-4245-bb41-32ad913500da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4c8c9-3c8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776671359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671359, "uuid": "1324c576-40e5-449a-a455-8597d06508b0", "comment": "Malware payload", "value": "c3b7c93d9724e425743094d46f96fee8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671359, "uuid": "23eb1c8f-2fc2-4ce0-b426-d0b4ef9f8026", "comment": "Malware payload", "value": "ae8d1f7f13a398009e05f5d36c7716082c6348e58be446f746e7bdda218adc23", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671359, "uuid": "b00dbd66-3756-4af9-84cb-f22da985f51a", "comment": "Malware payload", "value": "51bb56924cd18e183a051060070371b24438c49e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776671359, "uuid": "cb279b45-1a30-4446-928f-4ef9fcb164cf", "comment": "Malware payload", "value": "f5e87f5adf7b841753a67cff356653ee944fee7303e8342ca605d570813c12835d7a6284a962ce0ef3c7bca148a3413d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671359, "uuid": "6437470b-17da-4ab7-9739-1078cf12fd71", "value": "T13931E2162FD94324D3F5DE3740BAF7215922BE61F9229FAC418482882C45615FC75F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671359, "uuid": "890c1eeb-9afe-4b45-bcc1-86cb70c9aa01", "value": "24:8jXaJQnkdSrblkAbx+/2dJ8U/qF8tiSXQaR3+PRvEY+/vm:8nngSzvJ8U/qQXv3CsYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776671359, "uuid": "265df16b-1f9a-47e2-98d6-977ee508c4fd", "value": 1510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776671359, "uuid": "edc09b1e-cc38-482a-a3e7-f848fd5ac83c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776671359, "uuid": "2fed2415-45f6-4e33-be7c-d1a8b175ce71", "value": "xform.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbcbc5a-3cdc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776705419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705419, "uuid": "86e595c4-9258-4fdf-918e-27b447e6bf91", "comment": "Malware payload", "value": "44b6052ad8403d9be6a41d1749877a48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705419, "uuid": "aa03fd52-4d17-4078-961b-d6ba199b1fa9", "comment": "Malware payload", "value": "aea1623b24209adbd6dba5017b38295806e7ef25405338a01c17674dc865f324", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705419, "uuid": "d3d8651f-07ec-4bf8-8811-7436c799b2ee", "comment": "Malware payload", "value": "0d9f1ef0a77f57cb81168b8d490892c0b43458ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705419, "uuid": "0d8d2e56-69f7-4d82-8913-e620a813d2ec", "comment": "Malware payload", "value": "8618cde23592f07988de6135e57f8a3e536c7eecb8774cb2ab3a9044e14d42b963972eb3fed956c8d67b050b97c9a033", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705419, "uuid": "003d2e5d-8528-4f41-975d-327e83051514", "value": "T158136C6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705419, "uuid": "16446d0a-c9c8-4788-aa0f-6fb9a211444d", "value": "768:bBXRWNGxVb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b7lxecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705419, "uuid": "7247d975-5444-410c-a509-00ed5fb67a33", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705419, "uuid": "737583e3-17ec-4c4d-a909-e67b1dff7b7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705419, "uuid": "af742436-44a6-46ad-9f97-939bda3e2f47", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3767a23e-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725810, "uuid": "3b3e5963-20b0-467a-bcd8-2b80e3a5c13b", "comment": "Malware payload", "value": "8a275b099c2eb69ba14fdfbd3e1e121c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725810, "uuid": "d2f7bb69-ac87-445a-b10d-70589641c83a", "comment": "Malware payload", "value": "b05c843862aee8e2900848f6d8640dba64c170b4ff031ebb6aebab9b018b81cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725810, "uuid": "32fe886a-c798-4bf1-8eb0-5703cd95e09d", "comment": "Malware payload", "value": "df7dc8dd733ae8893356b79fbf1dc8a7687a5773", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725810, "uuid": "00f3c659-85f3-4080-889b-b261a6b82dc2", "comment": "Malware payload", "value": "34fd9d2f58d9656e31ae956aa889f2e1227d5e7e71f673615e7b9f89a752ecce9bce5d694d0bee46485689bb5b5abb21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725810, "uuid": "2b3c4c22-3c2f-43a6-995a-8d6ed7598892", "value": "T108A34B5776E900BBE1B78678C8970E45D7B6F81107619FEF03A4465A2F233E18D3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725810, "uuid": "afd04f76-05df-4ec2-9e15-c8ff37c0f5ae", "value": "314abc9e3cbd7befb6945530d77e4a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725810, "uuid": "5d1c255d-dddc-48cd-b2ea-d5889d135652", "value": "1536:9HAN2Zq7YQJgEKfUn3o/xuTHuSwQb4Arpu7yfskzw8EECHsWeqdR9dlbdkDQA:9bIYQX9Y/xGO3Qb4AE7yfEzMwpByDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725810, "uuid": "25b2a1b3-36ea-449b-9dbb-5ff6e94a3034", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725810, "uuid": "a4f7f4a1-e2f8-473e-b3f3-12c3981b12c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725810, "uuid": "309546f7-659a-4cc8-a6d6-f76caad6c3b1", "value": "b05c843862aee8e2900848f6d8640dba64c170b4ff031ebb6aebab9b018b81cd_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e34449-3ce0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707039, "uuid": "e6e5213b-bd81-435f-94eb-b07053b29573", "comment": "Malware payload (Mirai)", "value": "23c41b3c01ee1d4a6951c045aeab1a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707039, "uuid": "67e5ad1e-5489-4c9f-868a-ce5effe4f119", "comment": "Malware payload (Mirai)", "value": "b0851510a709e90be0699d40016b9c80ee6b6f772e8da26e9041df9daf991e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707039, "uuid": "0ef1d4c6-48f9-4c52-a80b-2b9fd89d170d", "comment": "Malware payload (Mirai)", "value": "0f6a0559c0323379a0c714e3e9af75f374c35be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707039, "uuid": "c4952e2f-9165-400d-addf-f02e8dc62dbd", "comment": "Malware payload (Mirai)", "value": "8ee9a2eb89e039a924c9cb1686b77a8fc1f43a6f50158c2deadb01b479c74a72e4de60a3e163c3c234bd1095b72ef021", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707039, "uuid": "469c725c-c045-439e-8d32-60b9df542d1a", "value": "T160B32B46EB818B03C0D5177ABAEF42453323A75493DB730689186FB43F86BAF4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707039, "uuid": "2343b47e-559d-4f60-b65e-007b0aeb07c7", "value": "3072:jowtPc4BAtYhkbB0x3U3oTmJ5AM/9W9hl:UwtPc4BAChkbB05UCmJGM/9Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707039, "uuid": "4f423fc4-944a-4d3d-9084-1f0f70cb6ad3", "value": 114584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707039, "uuid": "52ed2b32-af48-44aa-8b15-05a0039895b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707039, "uuid": "3d58eea2-96d8-4b77-8551-860c554571d7", "value": "00okarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d086494-3ce7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776710062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710062, "uuid": "f8ccbe35-e321-4e31-bb62-0ce0b3841c27", "comment": "Malware payload (Mirai)", "value": "5fff7159c8858dc15677213792845042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710062, "uuid": "ff714cc6-34e3-40bd-8d24-1d61c85c20f5", "comment": "Malware payload (Mirai)", "value": "b1113ca667d0c1e3c7ffa15dabc293d6a408ea661fb9b2e31bc765ae7e378b92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710062, "uuid": "34fbc4fe-ef61-4073-991c-3c2cf758c60a", "comment": "Malware payload (Mirai)", "value": "6152ff948e1b9bbf5bf85009b3c7ec53f0fb7d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776710062, "uuid": "39fee1ac-b624-458c-858f-28a96ab8e25e", "comment": "Malware payload (Mirai)", "value": "3388d28a4e58411cee60af50826387430d5fd1e2f38025ead6beb69157aa7d6eaee3a855e830bfaf78f2899d426be3b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710062, "uuid": "277c8be2-66d0-40be-906f-2d826edf2d16", "value": "T11DF2E186963FBA74C0F33A7414253AC8EE1E2A58370B6F2F4D6941FC4D79A9D1E10758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710062, "uuid": "6fd51cdd-5310-43ba-8d2a-84e92fb64464", "value": "768:683xQ2svJX9VHFAFHrfsbsrbq/Lpr6d3/zt5x0gP:1G2yf6Lsbsnqdr6d3/zzDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776710062, "uuid": "be10fdfd-a816-44ba-8b20-3d0eebb7cacf", "value": 37044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776710062, "uuid": "7096dd45-4953-4cee-ac67-040e661d1336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776710062, "uuid": "c0388d91-6c35-4fa1-b4ac-d53ed21aa340", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b618cf65-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776696387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696387, "uuid": "11d288c9-3380-4635-b419-6dba162f2ace", "comment": "Malware payload", "value": "d903f9aab00170c696fc35abc1a9044e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696387, "uuid": "01418326-a4d6-49df-b65c-5e288ead0fb4", "comment": "Malware payload", "value": "b17a31f547f8a8cf14863e7f959ff7f8addc68c8314221dce7232248ae4b3be9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696387, "uuid": "c001495d-f15b-4d32-8710-f0c883037044", "comment": "Malware payload", "value": "515aa82eca52d2d41bed882a6b7968950b605173", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696387, "uuid": "2cf29095-dc4b-44f9-9f19-9c185dc32719", "comment": "Malware payload", "value": "b43a2d44bc70b16bdea8f8bfe509108fa1f5bce677e6f787db99852b789c1712344934ebbf935d89dba40f5b3b6ae7b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696387, "uuid": "913e8f82-b23b-4c41-a141-8e48ec04c154", "value": "T109643A70ED2006974F871BECBE581666C9BDE609053714B0F6DE434EA0065ACFBFD629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696387, "uuid": "06ce393e-63a1-4336-a915-829aba419916", "value": "6144:qlpl4lCl9l4l8qlElM/lPzl6lNlOlhllelOlc+lulJlqlN9LlOlRlAlrLlQlq:qlpl4lCl9l4l8qlElM/lPzl6lNlOlhl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696387, "uuid": "47d888a8-d9a2-4c39-9a79-412067df4a27", "value": 323456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696387, "uuid": "353cf8b9-c40c-4886-9ba3-96c5d28442b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696387, "uuid": "ef7d52c5-e4ae-4a65-a2aa-e20f0144fe5e", "value": "Maersk_airway_bill_commericial_inv_packing_list_bill_of_lading_customs_reference_number_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46ba512-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776697673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697673, "uuid": "c6cfd10b-9f95-485b-bd04-d64ac3faff35", "comment": "Malware payload (VIPKeylogger)", "value": "3fb049dbda413f5804c2179f0322eb88", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697673, "uuid": "f4580ffd-84a9-475f-b039-22c04939adef", "comment": "Malware payload (VIPKeylogger)", "value": "b18b670876e79e72321306f52a478c3f4d9b1ff3357f1ad8f7c44162f6390c23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697673, "uuid": "f5972d5a-29b2-49a2-bcde-76e92ed99246", "comment": "Malware payload (VIPKeylogger)", "value": "bf528db9dda4716aa1124282ab2b3102eb872b94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697673, "uuid": "a7264658-97b4-422d-85a5-8adc4e410032", "comment": "Malware payload (VIPKeylogger)", "value": "23e1361a382db6cc3200c36c39ac3428dc376b18b0fe113c68732113560f9d76e2cd5d9757cea3e39b3ce17aec97b612", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697673, "uuid": "1f1c1311-720d-4f9b-925d-fe8755fc79b5", "value": "T1BB645B70FE6505694C5B6B9EFC414AB3CAAD810A563B50E0F7CD078D22081FCE7BDA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697673, "uuid": "8c263584-7424-4f24-80cc-3b3ec3079453", "value": "6144:rE+E8E4E+ErYoXI7rETE+Er3UE2E+E5EUE+Er8eEpUEsEE2E+Er8BE+EFE+/EeEJ:pHOlOYwOCOoaGOl9oOzTIOkYOmcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697673, "uuid": "f7a54bb5-7149-428f-aa0f-993f79fa7329", "value": 315742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697673, "uuid": "f7afc382-c166-4d6a-9988-705b0c045d9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697673, "uuid": "607d40ee-e617-49c6-80a5-923bdf0f3ca1", "value": "FS 1769_04_2026..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fc3c32-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688010, "uuid": "96c9de53-328a-474a-9a31-5db013cae639", "comment": "Malware payload", "value": "104001b8d221e3121f9ad276993b62c9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688010, "uuid": "e51a9819-9d2f-418d-839c-2172fed99f0e", "comment": "Malware payload", "value": "b22b03ea034072b38101c5aebada5ff31bc009ee28f7b0f322ad9396b82df551", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688010, "uuid": "729ef093-f354-41ce-9627-074663e34206", "comment": "Malware payload", "value": "381bce4ec6f6772914251114d4b16f57ed6fd31b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688010, "uuid": "3519135d-1913-4354-ac0e-cf3b79f8348b", "comment": "Malware payload", "value": "a04195e15d8b9825d51a432f2a1033329e1b463f36385b86b0540b51db2113ac4f8ecbbff43f99f18453db5f76d6f264", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688010, "uuid": "ac3d9552-5358-456e-8943-bca251b3b932", "value": "T134B4D06173E1CB27FA8E5630CEA2C6DD1712FC278E17820F7266735E5DB2560294323A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688010, "uuid": "823fef55-4af9-4f17-aa46-8e07820d9cf9", "value": "12288:ggw1n7EyiHLP/gzIbignpPtWoJDz5QQp:ggwd7DgD/7bFN8oxG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688010, "uuid": "ada422c9-4339-493a-88c9-9f5291e197d7", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688010, "uuid": "85a3f5a7-8b16-4016-8a3e-38659063dde8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688010, "uuid": "47ebbab6-cb52-4a1e-9747-9e2dd548457c", "value": "re 3474.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8958f6fd-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725088, "uuid": "4525cfa4-86c5-4cd8-b1de-1224037c8bfc", "comment": "Malware payload", "value": "cf137b42e3ce9e7a3ef85062df950b4d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725088, "uuid": "ff3f3a0a-84f5-4d1a-ad50-76508350036d", "comment": "Malware payload", "value": "b25e8a0b84e5bd7b5cc6dc480d2df8a6f942688c6c7760604e35bf8f1e05e328", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725088, "uuid": "517555ca-9d1c-42fd-a7f7-7076b6c23143", "comment": "Malware payload", "value": "7952e195f8d483e5e197ef80686e7efd646c3253", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725088, "uuid": "000ae72f-afdf-4e81-ad92-3852080724fc", "comment": "Malware payload", "value": "a9ab4e8e465dfae80f280323bf71490f05213884dad75f4ae525d23c132458e6eb724220aafd668994f7bfdc8616d32c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725088, "uuid": "9835705f-ad9b-411b-8c6c-30bdb5321d3b", "value": "T1B9820A0DEB47A4BDC609F274A9EF1731A4B1B93206766B2D2368DFF60F90594725F820", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725088, "uuid": "636ff4fc-0ca4-4c87-8359-16bc9dad6905", "value": "e5586c2e7d29a6a74ce35ddec6708f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725088, "uuid": "3f7fab6c-5900-4560-a18b-565c324350f6", "value": "384:vHE59Ya2XiZE+4QvUCbwvOC8SDd8UlFFHmckVPxIiTRfV9uLPH8t:vk59gyZYQsCb2OIThmckVPxIiTRfHak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725088, "uuid": "caedb671-aa07-4f62-8b3d-e189c0ae12cd", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725088, "uuid": "6d470bf2-5898-4c52-a687-44b924b40273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725088, "uuid": "63a8909b-7d0b-42cb-b8dc-af150bcf5744", "value": "b25e8a0b84e5bd7b5cc6dc480d2df8a6f942688c6c7760604e35bf8f1e05e328_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3f65c6-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776665824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665824, "uuid": "8e6db949-17e5-46d5-9382-877d6f40dc70", "comment": "Malware payload (GuLoader)", "value": "48b367ca7149f6cb469659e3338b4335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665824, "uuid": "03fb10e0-c1d0-4e78-ba61-57b7170c0247", "comment": "Malware payload (GuLoader)", "value": "b2c09f242ce0a6b8fe0a1a889d866d72cace7d83ea71765372215cc0eb85ffa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665824, "uuid": "c6bcf0cb-0d66-4267-9f20-21f1c8f3c40b", "comment": "Malware payload (GuLoader)", "value": "88b26ace223fc96b1b6f147100eaf46983c72cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665824, "uuid": "26548007-b48f-464e-9b3c-0021519b9336", "comment": "Malware payload (GuLoader)", "value": "f9fd4d9207f0a9fd93d2dee2d96adde132e0dc499eade4146370beaf115308a46debdcbb1bdf4c07638adbae9382b5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665824, "uuid": "f2f670df-9efd-458c-addb-4d7e195f4a2a", "value": "T141A4024137D6C887EC750A301CB293A31AB1BF75C61A928FBA99F71B1C732E24D0D566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665824, "uuid": "24cf9681-3cca-4b6e-9d1b-4ac14d693fed", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665824, "uuid": "fe8665fd-9986-41e6-8caf-8ff3ff658422", "value": "6144:uX45rw628jOcfk63e1alvgAdhtVuI8tr3RNzHQBdZhKg7xBSnfIU1IG:uX4TjXx3TaCf8DNLQPKgLtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665824, "uuid": "4da3695b-2d41-48cb-89b8-bcb8e1afaa1d", "value": 486544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665824, "uuid": "c14ad3ff-cc24-4cf0-a5c7-db7f1813cff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665824, "uuid": "a267249b-eb55-4844-879b-b0b2d9eb03c8", "value": "list of orders for confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439bce74-3c8c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776670855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670855, "uuid": "f2cd5ffa-2e40-4ee1-88db-e08c05a1f2a5", "comment": "Malware payload (NetSupport)", "value": "b1d16ff9c3667f8c90834f194f580c65", "object_relation": "md5", "Tag": [ { "name": "91-202-233-25", "colour": "#3F58D8", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670855, "uuid": "733fb38c-6d04-4ff5-acc4-3d820870b8eb", "comment": "Malware payload (NetSupport)", "value": "b2ca271ecbdda43794a36226acfe760243b8ddfa953bccdd1bed0d47fb85eab3", "object_relation": "sha256", "Tag": [ { "name": "91-202-233-25", "colour": "#3F58D8", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670855, "uuid": "85b8c2a5-20ee-4f41-b74e-175e7772048a", "comment": "Malware payload (NetSupport)", "value": "3416ff55c06301a352a5c0f8724f752606e05043", "object_relation": "sha1", "Tag": [ { "name": "91-202-233-25", "colour": "#3F58D8", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670855, "uuid": "2965b82c-fce1-470c-ae5a-09c792e4e4ff", "comment": "Malware payload (NetSupport)", "value": "3bb829d4d30e8d9fa3f225d477c06569a39d6fdd3cfba520b2e3f509343b673c9541c73bbfaf80e3aae5cbc9dbcf348b", "object_relation": "sha3-384", "Tag": [ { "name": "91-202-233-25", "colour": "#3F58D8", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670855, "uuid": "37814ada-469f-4558-b52e-8a94e04dfd63", "value": "T17FA5333830C3DD60F11EEC373C41A926BEE6998569A681F3AFB53D366201937E19D487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670855, "uuid": "8e8fe9b4-0285-464f-9cb1-2aabf4193c50", "value": "49152:rtDZYnir6iOqtOEWb67u9lApvv2HpMDUoh8wyIFTSC4yB:rLrGJEokeHpMDUM8RIcC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670855, "uuid": "7a30c4a8-b2b8-4d22-886c-1e21b26b1445", "value": 2240322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670855, "uuid": "06690ee9-5bd9-418b-926a-b4a5e77398d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670855, "uuid": "01c76d31-4054-4c99-b741-1be29a0f6928", "value": "b2ca271ecbdda43794a36226acfe760243b8ddfa953bccdd1bed0d47fb85eab3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695707ce-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776688098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "b638cee2-34ce-4840-a35d-58b044ac9918", "comment": "Malware payload (Mirai)", "value": "b564173d6fae03b323d52d0632492032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "5a586ab6-3984-4bf5-be18-8d4658855499", "comment": "Malware payload (Mirai)", "value": "b2d4efdcff14e0ca16b4b6629e745e8ccf7e027c30d5c7bd68b1b56011a8e930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "9c252ec1-6e48-482c-b757-b9553815ac39", "comment": "Malware payload (Mirai)", "value": "25656ccb17d980eaf2e2600c3909b7fcc9e2c7f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "9ed8a54f-582b-414a-ba9e-0f57a7979363", "comment": "Malware payload (Mirai)", "value": "db7628c1b87a303074e72d51c7c01afd645b64e15de028ac87a75bea926f5fad1fe41c7e5b8ea37c97715da8161ee4ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "28e0ef9e-f6f1-4e8e-922a-907f4b66a1d6", "value": "T19B232B42722C0A47D5A25AB0393F0BE093FFE99120F4B6892A1FD7468635F771586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "91893c44-0844-455c-8749-0ca4cbc512cd", "value": "768:fWLJhV3pc1tbRC+3u7RsGVBCnfd0aC3E+n8Vdk/fEXIZy3:fIRpc1tbR5kDPAMcXk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688098, "uuid": "b70faa6a-df6d-400a-836c-617f798e3699", "value": 47140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688098, "uuid": "96ba4995-cd79-417c-9151-a9c9a53796c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "24209365-1548-4d68-8f3e-753bfa78fcb8", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bedcf0-3d14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776729506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729506, "uuid": "c0eae091-948d-4167-a857-0fe3b80b7369", "comment": "Malware payload (Mirai)", "value": "cabe91db97bd02e09951024d09b6cb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729506, "uuid": "1559c727-6a16-4a7b-9796-0256765740a1", "comment": "Malware payload (Mirai)", "value": "b2e95fd9fd80c8e35a3bfd80741d779af4035a1782ebfb51d82db1e07b055872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729506, "uuid": "6e54b73b-0459-427d-ba75-814efb075c3a", "comment": "Malware payload (Mirai)", "value": "28d1a26cfad6c0038d8652f07308ff84fef82169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776729506, "uuid": "1f506091-0040-4393-89c6-c6c16d2ee304", "comment": "Malware payload (Mirai)", "value": "d9e91cb73e621534c080eeae3ddb7b199f344de920f35b1c6cab290750768b691238161eadb86e4deb9a0346a2e43009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729506, "uuid": "40ae44e7-7091-40b9-9d8b-31cb80f6373c", "value": "T149037DBAC8296D84D6554674A8358A7C2F63E110D3833FFB5A4985A68047EFCF60A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729506, "uuid": "72159573-e008-428e-82c4-f4e9bd5a6259", "value": "768:satfOwtgw1qKXHvneeFdUi4oNW6ePDCHoSvqCy:saNOwt71r6UaPD3sqCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776729506, "uuid": "81cb4207-9e2b-4a02-b37a-1ec515e08add", "value": 39196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776729506, "uuid": "5321e216-5877-4355-aba5-89ede5b87bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776729506, "uuid": "c6392df7-f884-40b2-b842-5ef1a7954164", "value": "00oksh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8ed5d8-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725548, "uuid": "ad550cdf-3ca3-4fae-b119-9e31c245c4a0", "comment": "Malware payload", "value": "89d9f8a686844f6136e76a638f8e8ad5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725548, "uuid": "b5fe03f8-bc85-4794-ae99-f3ad15b5b24c", "comment": "Malware payload", "value": "b33446d860a4087f914a6392bfabf24fc3fecf89d6b7ca00779c606c5faa57be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725548, "uuid": "a7068b06-c4c5-4d05-b930-e1748e786c8e", "comment": "Malware payload", "value": "f98444ee1cd1a910ad3ec9ccd93f3937de6a5b1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725548, "uuid": "af1c67ca-6a33-4582-b027-af13b63d1030", "comment": "Malware payload", "value": "4ace67a020ebaec7426dd89b3dd0e4802ebe0a429363f7ee73be2b4c67a362f03e9b4036a6ffbf5fc078eeea7ce32b7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725548, "uuid": "4bd34f70-0361-4531-9df4-781d53f8e2fd", "value": "T191A34A57A2BA10BBE1B68639C8970A49D773B8451761AFEF43A0425A1F633D08D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725548, "uuid": "c0e270ee-9d00-4c7e-8e27-b8cf301ebdd0", "value": "500afcac24ada5096b15630df71ec442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725548, "uuid": "15505df0-33cb-40e4-b522-7839f6cddc56", "value": "3072:47FEVRoWiGqsGQbXAL/QiYk2GWwD80p5wCDvmXT7RLyzfWC+YmSO/2nePGyufbH0:EELobqGMXAL/DYVbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725548, "uuid": "da0fe223-03e4-4603-8359-7a2d7772e5b3", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725548, "uuid": "7106233c-72f0-4d55-a14a-6ba38c28114b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725548, "uuid": "bc99ee17-c91d-42b3-9429-1443a31be37b", "value": "b33446d860a4087f914a6392bfabf24fc3fecf89d6b7ca00779c606c5faa57be_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5fc431-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725655, "uuid": "397cb4e4-ad59-4832-baa4-d0312c79f7f7", "comment": "Malware payload", "value": "d11d0136ccb2de3ccd41bbf581d6d88c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725655, "uuid": "49a29f8c-95d4-4256-9cc5-3bf03b0b14a6", "comment": "Malware payload", "value": "b34c18077edc28a2d6e8ec94b9e41c7fdd50885721e4aec99c16f41ab6af7ecc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725655, "uuid": "461de438-2153-4823-bacb-ce6c4c493a04", "comment": "Malware payload", "value": "48da1639f7ad9572d246f6a3429fddd42e787bd1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725655, "uuid": "840030da-ae9a-493d-8514-99283a57cbb3", "comment": "Malware payload", "value": "abc78f813f9086b9d7bdab1b5a0a3af262106c40f44e2875cdabfe59e9148c2a85f6f069fb1fdbc87d55ec5804c0617f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725655, "uuid": "ec08dac7-eac7-4542-b11c-8fa047c802d3", "value": "T14E43E01DF703A4B8D102D5B98A9B1731BFB1BB3165239B3D1124D7780E84EC09E2EE26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725655, "uuid": "a1c9ae1a-8fac-4101-8576-4ab11db88d5d", "value": "fe21e882686b5b4fbd50889e1395d60c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725655, "uuid": "5eb61481-f92e-4397-9719-07056752e184", "value": "1536:xo88mGc3Hc1CYSMC5fFFDgIFnwxKg4SpemckVPxIiTc:qmGc3c1CY/MfnZNwXptckVPxIiTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725655, "uuid": "34d053b5-f782-48f3-abab-16f37b1d0475", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725655, "uuid": "aa59f62b-0d8d-4264-9120-dbe7620a3f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725655, "uuid": "48cdc2c4-8aca-4dd5-9977-fc74e2372cc7", "value": "b34c18077edc28a2d6e8ec94b9e41c7fdd50885721e4aec99c16f41ab6af7ecc_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931de235-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725534, "uuid": "464b1fbc-19e7-4a2b-abd1-38f7aa2052c9", "comment": "Malware payload", "value": "2695631ab68223cc0e242d25bfc503dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725534, "uuid": "b51d8e6f-8b23-41ba-85a9-e49f9da57c5b", "comment": "Malware payload", "value": "b3954d905cd0d513f84598b6a63547bec7ee02977865dd236b8efd9846ba1585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725534, "uuid": "7ea85cc3-8058-4b8f-a4b0-65b7805ac805", "comment": "Malware payload", "value": "984da5766362e72947f0a31a856dad522cfe5374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725534, "uuid": "31e6eb8f-e60f-4e12-b85a-a34e1f27e79e", "comment": "Malware payload", "value": "9abb1a11ecb9bbdcd48812ca71d69f1d7afd0d72b3f5c810b072f52a6d59911bab6243402455eab4935febfe4ce58825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725534, "uuid": "234962ed-e6d4-4117-8920-d22b4247bf7f", "value": "T1B3767D13B2C5603BE47B0A3B4C3BE748693F7A617F19CC1A67A4095C8F39A40AD26757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725534, "uuid": "99a24a6b-648a-47ad-841e-9c984d577fbc", "value": "75c3d0a1cc86e4835d4cfb6340fd7c7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725534, "uuid": "795055dd-9a30-4913-b9e8-c611e18bbbda", "value": "98304:3QzAf5Rdr7Ixro4obTzQTrzBpT1BBc/Tbcv//S:gza5zIxb7rTbcTba/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725534, "uuid": "211e0e1b-861d-43b4-99f3-4c74d344b332", "value": 7657472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725534, "uuid": "74ff74be-fbdc-452c-b177-5e45e8ee21b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725534, "uuid": "69e6fb3f-3053-452f-aefa-0b3b47d95c76", "value": "b3954d905cd0d513f84598b6a63547bec7ee02977865dd236b8efd9846ba1585_b796026a-a5ba-447e-be74-6e1c5c248e91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5749957e-3c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776668740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668740, "uuid": "8c5d7c9f-c316-48ce-8b6c-5501ba21562c", "comment": "Malware payload", "value": "a9e2c038701d0ecdb734f70f4afa6e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668740, "uuid": "77f241c7-a53c-4c65-b6f9-55907ec68019", "comment": "Malware payload", "value": "b3b2af60fd48258c1ac9359cc0db7d47ff19e0cff5253f1a32d51bc72b349e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668740, "uuid": "4b420436-1412-45f8-b5ec-b8ee913d4003", "comment": "Malware payload", "value": "535b2d029843c40f4774c9021538308e160a1b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776668740, "uuid": "70843d33-0564-40ab-a9e3-db7af4bc0379", "comment": "Malware payload", "value": "cbf91fddde709c6910b949905203fe859f5ead9305ba88076e532e5fed155df5a9584168bacb2aa0030ad037f795ace8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Yunshang-Zexin-Information-Technology-Co-Ltd", "colour": "#14F6B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668740, "uuid": "247056bc-6067-42ce-a9a4-7bce781e233f", "value": "T138B78332CE450E674EF262BC69658AE3FA70A32F1380591BBDFC9A4C1F76D716042B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668740, "uuid": "80b85d24-52b5-4705-8b83-7959909295c2", "value": "90e661b7ca3751e7b7204b32177d7330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668740, "uuid": "27da8657-b254-435d-84a9-6b2f11ff5d1d", "value": "98304:a6ng7WqJ7vRVW0nQJyQ47E7BJgvDOVYTh/fMEXJnfn+n3K:af40nePMFHMGfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776668740, "uuid": "536bf836-a436-4f8a-96a1-bd2c21327e37", "value": 49071896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776668740, "uuid": "83754719-a85a-4159-ba12-20abd3f5afd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776668740, "uuid": "71687800-ed48-46e6-9dbd-f6283ef9400b", "value": "b3b2af60fd48258c1ac9359cc0db7d47ff19e0cff5253f1a32d51bc72b349e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8fb698-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725683, "uuid": "915a200e-b2ba-46d3-9cb8-bac31d71f0d0", "comment": "Malware payload", "value": "d21ad786e826fcc7f40f97f6e1e6c4d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725683, "uuid": "8ec56746-1cac-44c4-a4d5-d7172fad3ace", "comment": "Malware payload", "value": "b42aafbe446530a8d68e8b8697113280ff54fea5aeb3c3ea660af24c455b2b7f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725683, "uuid": "b467ade7-b863-4efc-873e-67cf5bfae04e", "comment": "Malware payload", "value": "263adcbe296664d9c7aba957c7e073a9d1bd3de3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725683, "uuid": "a96d2296-7e59-47eb-a643-32391bed4527", "comment": "Malware payload", "value": "f8ca768400e988d062b2ecc271e9048d19a2d38a712c1f360a9058aa0768ba1737c0c16487ab9038a63546c6e4ac9cf3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725683, "uuid": "372b698c-30c3-4730-9457-cfab8c273950", "value": "T10AA3495773E900BBE17B8638C4574E49D772B8524720ABEF43A4465A1F233D18D3EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725683, "uuid": "38cde8fd-bdec-45d6-b6a9-6715091321ec", "value": "3f65ea29d90fcb98cc03781edfc42862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725683, "uuid": "bb9de15f-2e49-4776-982f-1761106aeaf0", "value": "3072:3rLeTrVwYwnGysQbEATnTz7KJMblIdj9dLRAL6:3+ThwYsyMEATnHem6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725683, "uuid": "3f0fc4f3-7470-4b64-8b0e-d893b3b68a18", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725683, "uuid": "cc06e6d5-fbaa-48b2-be03-fd25805ee2a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725683, "uuid": "86dabe7d-4edb-43c7-8155-968a3fde47b9", "value": "b42aafbe446530a8d68e8b8697113280ff54fea5aeb3c3ea660af24c455b2b7f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7623d882-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725056, "uuid": "573847c6-878f-4f06-9e94-336fddd58e67", "comment": "Malware payload", "value": "950242bfb6e3c79d4c176d85905299d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725056, "uuid": "d0875a9b-8619-4ebf-9f63-99132869d286", "comment": "Malware payload", "value": "b4bc880eec604ca025b277ca5fe8b7e47c614337af4039789ac919e81e684dbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725056, "uuid": "afa78198-b3cf-4c77-a1c0-002cc2ec9cb9", "comment": "Malware payload", "value": "1a99f681045985c126c0d8f4b5d1b51a84d20d50", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725056, "uuid": "cf6f16b5-26de-4a5a-873d-fc65cb5609f4", "comment": "Malware payload", "value": "a9d2bb6fce74f7c068a1ae5da525560f6ce74d87568419502b3d2a91190fd8bda2328d3ee3992a67b588251d089ea359", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725056, "uuid": "30705b86-244c-46a7-8058-b3004a6ad693", "value": "T12AA34A47A2AA00BBE2BA8678C4530A4AD772B8551750AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725056, "uuid": "718bb118-62a5-416a-b892-f208088749b6", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725056, "uuid": "a27afd22-d3d0-4991-a23f-4270eee4030d", "value": "3072:W+TeXQwDasaAmiTQhAS/xYN0l51756565rnIryHo/CRMK:HeXbuFaTcAS/0XkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725056, "uuid": "862cf24b-d11c-4a42-b210-da88d1021048", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725056, "uuid": "399d3063-1f88-4f6b-a972-d36f35fb3837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725056, "uuid": "ee9a1dc5-1ad4-444d-953e-fef5c2928313", "value": "b4bc880eec604ca025b277ca5fe8b7e47c614337af4039789ac919e81e684dbf_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3992e4f0-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725814, "uuid": "2e72ada2-2eb0-4a95-b5f0-84c197bbb2fa", "comment": "Malware payload", "value": "13963caf212ab72c1d76a91556070fcd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725814, "uuid": "438941e9-dcf4-483e-8281-4e362d8222d5", "comment": "Malware payload", "value": "b505d66eac2888d74664daf057f0ed56dd1f7ff79139345493582a7bf9d1780c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725814, "uuid": "a58aac15-405b-42d4-8846-f96881e922e4", "comment": "Malware payload", "value": "3fe4ddae465771740ed5a6b1884085e1a9ce96e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725814, "uuid": "5c283604-1fce-4fa0-9bf8-9a46edbec80e", "comment": "Malware payload", "value": "4e6ea27d84a2e0afc7867f56665264a6975da9f46b7ae2ac9682a36b11063f6caf80c598eac055b58d4f0c63c9fee6a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725814, "uuid": "6b7ad155-f0f2-4296-babc-0e58ac030569", "value": "T158A34957B2E600BBE1B78638C8630A49DB72B8555721AFEF43A0425A1F273D18D39F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725814, "uuid": "e3014f74-ba08-449f-a10c-42e0b0cfc3bd", "value": "c67fcaa01b2b46949969e032eed97f41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725814, "uuid": "c843ce50-edbc-4245-98b4-9daf165da188", "value": "3072:IaTF5AGZWAOZQaAZDGFFNrB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51pyz:pFSG4xXAZDmCo2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725814, "uuid": "e7ba9315-d962-497e-a1d8-4afc5fb35d58", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725814, "uuid": "e5ffb191-cfcb-4179-a35f-feeca51795e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725814, "uuid": "2b454e07-47f6-4796-bd29-adf246b77d0f", "value": "b505d66eac2888d74664daf057f0ed56dd1f7ff79139345493582a7bf9d1780c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de88036-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725928, "uuid": "9234088f-eb86-4af6-a890-c0dee7b7fe3c", "comment": "Malware payload", "value": "ad426a79f9d9980a0ceaec2a84c9611c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725928, "uuid": "ab82a12f-ebc9-4d49-9144-243b4f9be448", "comment": "Malware payload", "value": "b5ce79db27d93a8da119f34600c09f15ea9a4b7cd39defe20c08b030cc86a72c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725928, "uuid": "73217b80-3a00-4403-b828-5448bb7a63cb", "comment": "Malware payload", "value": "cf4750cb258a6dc4eeb1ac52f1164d26b06cc39b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725928, "uuid": "bf280140-62cb-4311-b109-d73150f1e011", "comment": "Malware payload", "value": "b7c098f13aa001a9584caea903b35bc739bec9646a45ebee4df0dc374f15058fdfc8a09cc9ce6fa00d3e749f86af3a79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725928, "uuid": "564d473e-7b02-484b-9547-b452d9787f88", "value": "T15FB35A4BB3A500BBE1778679C5630A46D3B2B8911760AFEF03A0465A1F277D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725928, "uuid": "22ca56b8-5254-4e48-b2a5-5609731bb2d8", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725928, "uuid": "e41f4bd0-05a5-4cda-b49b-b09941ff9296", "value": "3072:0r/azEnyFSpckqn/JqqJxSjjmPckVPxIiTRQQol:0ruEyY2n0NWOQol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725928, "uuid": "563e6ce9-1f63-4898-9839-aef1f753131c", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725928, "uuid": "75951ee8-7f91-4b2f-a1d5-fd163dd20587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725928, "uuid": "344ef27e-344b-46b5-8010-0cc344f474c0", "value": "b5ce79db27d93a8da119f34600c09f15ea9a4b7cd39defe20c08b030cc86a72c_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6050158a-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725449, "uuid": "2e8d97b6-9eac-42b6-8e08-ccd5610b928d", "comment": "Malware payload", "value": "753c2e12a4c339307a61cad737ff25e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725449, "uuid": "d5a17ede-1836-44c5-b08d-28d7d5cc754c", "comment": "Malware payload", "value": "b6295e8616de387ab9ad8148054eb2207b4e3ce26ac1fc73eddacf81008cd7ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725449, "uuid": "b473e330-b0fb-4847-bc40-edb07c61f028", "comment": "Malware payload", "value": "83571995d17d8ad65d810aeb4c0152e9f6236a16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725449, "uuid": "cadb4233-9d9c-41d7-ae8a-1000223fef8a", "comment": "Malware payload", "value": "19c9160879e4ccb6ac0cda3be42aedbbb0819acfd080ea1f13af89cb9d07fc38f1534d03c8e74f57a6bf97ffdc5f410e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725449, "uuid": "b871a2e7-71e0-4cfc-86dd-46314db85dfa", "value": "T1FE821B0EEB4BA4BDC50DE2F419EB4B31A4F1B93106766B2E1354DFF64F50550635E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725449, "uuid": "9b7198cf-3be7-4bac-9067-8392f59746ca", "value": "1ac395261e17715235ef3a987b9c855a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725449, "uuid": "11ea8bf1-ec63-4f74-bba4-cba380a62725", "value": "384:a/l9xaWZtyxtTfzq7wIce82hM1mckVPxIiT+W09uLPR9:a99NZcxtjW73b0mckVPxIiT+Wya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725449, "uuid": "5f33208c-ee40-4de5-beb9-d0b711d87397", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725449, "uuid": "1c7f3923-b788-457a-b0e1-a14f6f1a1a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725449, "uuid": "86638be2-b40d-421e-a18c-c2ed5f8ae150", "value": "b6295e8616de387ab9ad8148054eb2207b4e3ce26ac1fc73eddacf81008cd7ac_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f531c15f-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724840, "uuid": "675ba972-7c64-41cd-8889-fa91560cab82", "comment": "Malware payload", "value": "900ffd37c20e0c735f9381b3e4fed69e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724840, "uuid": "43c71b93-262d-4f43-8995-fff2abaadcc5", "comment": "Malware payload", "value": "b6466f4f88ddce385be689db81b9c4c2521d1a1bd119c3c0cb62e65106fac73c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724840, "uuid": "b1e7ae22-980a-42a5-be13-2e0a8429bd49", "comment": "Malware payload", "value": "ddf5eb2ec1cb27e2b5e901791ad0202005f1a9f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724840, "uuid": "104a0b91-c276-4f34-96dc-6be8dfa93ffb", "comment": "Malware payload", "value": "9f1ec35cf621c11f1005405366fc0c6c810cf7d11c6773fb5f6092a2cc610c96aacf9f97be715b90d1084f22a6df83ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724840, "uuid": "a398a56a-3c4e-4e5e-bb08-d07926b1f008", "value": "T16C341C90B281FDB6EC998FB820D2534993FAF0819719EB3BA620FE3C025EB54D573545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724840, "uuid": "3206d33c-c07d-43f6-94cb-4942f2e9dd3d", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724840, "uuid": "82c2f78d-c0f0-4ae0-8deb-d1ee1879d308", "value": "3072:m9VVl7xAaoF0S+ktKnkhsT2v3KVuCHytOiZPFnU2jvK9A+M:u7Cao2S+8Knk62vKVuCHyEiZC2jvKG+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724840, "uuid": "d0260396-00c3-4299-8f81-c48daa6451b1", "value": 241106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724840, "uuid": "65f5066a-197d-406f-a1bd-5e2d50de2916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724840, "uuid": "c9d0dc24-1d6c-4c21-bd29-5481dbc57653", "value": "b6466f4f88ddce385be689db81b9c4c2521d1a1bd119c3c0cb62e65106fac73c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ebc14-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725806, "uuid": "d76052bd-1dd4-4fd6-b8ef-ea7dd9cf9088", "comment": "Malware payload", "value": "7a635c1b1ab679bde304dc4a72529fb7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725806, "uuid": "0377124b-9fa4-42cb-8180-befc0876a4af", "comment": "Malware payload", "value": "b6d48e5e8bf76fdf911dad5c6daf457f645e7082b9bbb0f9952d03d7eee5e56a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725806, "uuid": "24053861-dccb-4090-b312-fde8d597b416", "comment": "Malware payload", "value": "16621ff9970c5b5722b2c05f43304f7a657dc817", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725806, "uuid": "2f0eb94c-1608-416e-84ea-ae088e1ba03d", "comment": "Malware payload", "value": "1f1eaf6dbcfed4c3cbe7448458ad46359d089f41c1be2d3dce56b3de3db8e84b1faeb99e7763e90300544f3dbba936cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725806, "uuid": "6766cadf-b98f-4502-8dcc-0ac20cbcbc70", "value": "T1D9A34A47A2EA00BBE2BA8678C4530A4AD772B85517619FEF43A4425E1F273D08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725806, "uuid": "1e8f3263-f657-46ee-90fe-036912faedb0", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725806, "uuid": "ef7de017-1fab-44f1-8991-133cc1ed863b", "value": "3072:xvTeXQwDasaAmiTQhAS/xYN0t51756565rnIryH//C6QK:FeXbuFaTcAS/0rE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725806, "uuid": "8bd32e10-3b6d-4a03-9d9d-3e0028e0b466", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725806, "uuid": "a1f1a78f-4adc-44e8-a004-0d81eaf7b825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725806, "uuid": "803c88e0-0974-4bbf-9d7d-594ec8f05f37", "value": "b6d48e5e8bf76fdf911dad5c6daf457f645e7082b9bbb0f9952d03d7eee5e56a_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c5945d-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676729, "uuid": "7cdecfd1-a471-4b5d-b4e8-56c1ba6aa85c", "comment": "Malware payload (ConnectWise)", "value": "836d60f0222b4cc00d309058f02ed0b3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676729, "uuid": "20439969-d503-4d24-a03a-4ff244df3c55", "comment": "Malware payload (ConnectWise)", "value": "b6f883fedb78d226dc825e8827f41fbbf6c382b31e94b1c2bcd7da472de80b7b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676729, "uuid": "39779b1f-fb7a-447e-accb-c5ee129b221f", "comment": "Malware payload (ConnectWise)", "value": "8c6b2e636a1ff943fdddbd988ff535af62ef1441", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676729, "uuid": "43586d00-c95f-4c83-be7c-23c7fbefabf4", "comment": "Malware payload (ConnectWise)", "value": "913e11b4a52f8fb6210d99e4fd7498d7b5ef6c1e0ae1f874ab3a35181bfaff2545b765d4f3523dcea577e18306617352", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676729, "uuid": "ce9d473f-3668-499b-baba-1c2d3c2e0c7c", "value": "T107646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676729, "uuid": "e63defd4-31b9-4d36-92df-eae02dcb3fb1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676729, "uuid": "c00892e6-bb48-42e6-840b-4205f32c6fe3", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676729, "uuid": "244d6f48-f48b-4d2a-ab7b-82abc9e99857", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676729, "uuid": "e814404e-e0e6-476e-80fd-d352cacfea1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676729, "uuid": "71e097be-fa2b-4593-9e03-4fd2f26005b6", "value": "b6f883fedb78d226dc825e8827f41fbbf6c382b31e94b1c2bcd7da472de80b7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33605af8-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727092, "uuid": "94c2589e-6bc9-41fe-9013-8b0a8f6960ec", "comment": "Malware payload (Mirai)", "value": "fda2fe77fdee44b9fab96897ad0ae9ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727092, "uuid": "1e0ca81d-838c-45fa-a202-9b1d4d69f044", "comment": "Malware payload (Mirai)", "value": "b786cdf83439b2b505c2852d270f7d07262255a55c68b5722844db7226d8e26e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727092, "uuid": "daed0d4b-c845-4217-b662-38d204cab4ab", "comment": "Malware payload (Mirai)", "value": "a6cb69f4f8f350475b328d092f15871cd309329e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727092, "uuid": "a972076f-a6ef-4cfc-a4ae-ae25822dd683", "comment": "Malware payload (Mirai)", "value": "8df60b57b64703e722e2fe08755c1521ab11ae90a4e859e77fe9fa079f8a79250e46b8c5a8cf297ef65a3de66387d0ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727092, "uuid": "9fa64b9b-4f3d-43c5-b16f-c6a634e43899", "value": "T1C5F2E1702649BCF9CE609577EAF1CB47F32A9368A4FF316915040A64F8D532268F63C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727092, "uuid": "40c61fb7-a96c-4d80-ad1e-c7587214824b", "value": "768:rJTKmOVP3WWkPgb7lPBIqxwQEECBah3zGKTzAJs3Uozw:rAmO4POPN5Evo3FTzzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727092, "uuid": "3b0d0ea5-433a-4d17-950d-d619d8c3c58a", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727092, "uuid": "dd8779f2-0daf-485a-9dbc-af102b372d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727092, "uuid": "963a70c1-b8d8-4b33-b352-2cccd3aee634", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857042cb-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776697594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697594, "uuid": "e474b476-746b-4304-bf03-654d67cb422e", "comment": "Malware payload (a310Logger)", "value": "deb660223b2faff90da2d64cc63804c2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697594, "uuid": "828aa229-6a2d-41c0-89d1-a3948b0d738b", "comment": "Malware payload (a310Logger)", "value": "b7ceb62e3761588f4da5c7711a96285721b21cc96decbb7f47f16d4b99f71591", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697594, "uuid": "79008aaf-d0cb-4721-bca7-8a031a841772", "comment": "Malware payload (a310Logger)", "value": "b063551e6fc561c6fbfa6a115fad85a13edaacf6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697594, "uuid": "79a36a27-fa31-4af2-a9f7-96a51166b95a", "comment": "Malware payload (a310Logger)", "value": "1741147f081cd013ef3265103b2d747c8f381859c5f06c07450c8d5605dca8adf82087b1ee3fee0ea425bb9f1175c29f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697594, "uuid": "68eba79d-8e39-4c48-8a9e-bc7926d46b9f", "value": "T1D2C5021199C42FB9CFAC5B1880FE160EA3F04A8F5016B98AEB33BD46AFF7644511719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697594, "uuid": "6df3aff0-66ed-46c8-8af2-f40145f2ef9e", "value": "24576:dDdC3gjOnFnlAslaOZb7ZVYF7oCjjbn10Fi8tugVO7cmAey0vzB46bLwCR06koI6:dDBKT6zjj+n0gVJmTBeEXXNzxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697594, "uuid": "2aa2ae14-881f-4bc2-ba40-92ea979dc8b4", "value": 2726117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697594, "uuid": "50da1199-1d4a-44c2-aad5-56fca3f8ca10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697594, "uuid": "089f1137-aefe-450c-82fa-2ecd3c232777", "value": "Dekont_____________pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e0bba8-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776697727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697727, "uuid": "26939c05-05c5-4da6-9bda-31b35e3d87c7", "comment": "Malware payload (AsyncRAT)", "value": "6c454e29e3a9662e35a1b1f2a947fc9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697727, "uuid": "00a8c02c-1181-4bf2-b5af-e2df013431dd", "comment": "Malware payload (AsyncRAT)", "value": "b8342acd2dde4b63d58b11bb83626aa61cd4a7ed33ba42df5eec4b3ad3e934df", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697727, "uuid": "30898592-d892-45bf-9634-50b9e838d457", "comment": "Malware payload (AsyncRAT)", "value": "139dd46a2f8b37e2a0588bdba63a3129f78fdd88", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697727, "uuid": "1ecac624-6ec4-4e2f-9e42-8cefd0894506", "comment": "Malware payload (AsyncRAT)", "value": "06e928188b0dc4ece516fd42d124005cabec30a4c00e2a2d539a8d6ac1f59bcfb54c36701df973cebae5d2bb944fa115", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697727, "uuid": "487948c7-023e-4ec0-98d0-e418699d590a", "value": "T102C5546A27F90087C1E5FE4FBE5B49CADFE6B9A427679C43526CE5C204C4D00D980FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697727, "uuid": "fc23ec88-a673-46bc-80a6-7adf0f72f47a", "value": "96:84+EWOK+WAmvOzI7nsQZFlA65/Y3viHRQqlv2S:HK+y2zaQwuhVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697727, "uuid": "1f46d828-184e-4a48-a28c-466ba74b3a49", "value": 2497013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697727, "uuid": "f1334c5a-206e-48af-ad68-8998ee3788ad", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697727, "uuid": "a02b7732-4112-4739-975c-6aa7b010140a", "value": "PO_00938848KGB_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71204f77-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687252, "uuid": "deaf658c-57f2-49f0-85a9-c90432ab1207", "comment": "Malware payload (SpankRAT)", "value": "18fde74c2e920cf18667ad994397f4f7", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687252, "uuid": "4afeb78e-fa5a-43e6-8a53-e3a0f337f34d", "comment": "Malware payload (SpankRAT)", "value": "b87d26778e84da00feb3b434fd121302851d40f56d52a063cf403dbaa02bde21", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687252, "uuid": "55191b89-ec85-46a0-bd1e-8462d79011a0", "comment": "Malware payload (SpankRAT)", "value": "6a217f0bb203120b1a1773e7fc21e42f3c183076", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687252, "uuid": "d95642b2-603f-4752-b3a0-ce88cf5919e4", "comment": "Malware payload (SpankRAT)", "value": "5f7e59ca0190168f1e2aa0f7e04b9b85ec0029fd45d15dcf168253fd7d1c7e754ba1dd9d83e0c034d9e95184f220c212", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687252, "uuid": "fd247ab0-365b-4581-ad62-1d1fe7ba5aef", "value": "T179256B03F6A985E8D55EC07C876B9236BA37BC8D053076EB27D41B243E6AF506B0C725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687252, "uuid": "984b5ed9-40ef-4047-b0e5-76991f046978", "value": "5ec1e5cc3b4bdb3330181aa846255dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687252, "uuid": "c427f251-d173-470e-9c83-92447f89c23e", "value": "24576:3SEHmljYGgcEl7F2/Jw9aj3Za96AZtMb:3SEGljYGgcEl7F2/0aLY96AZtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687252, "uuid": "81b5b31f-c46f-4700-a591-aa89ad58399f", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687252, "uuid": "75faf749-de56-4f24-a8f9-96611cc8db6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687252, "uuid": "861fa10e-f572-4dc0-aa2a-e2e4d0a2b7d0", "value": "b87d26778e84da00feb3b434fd121302851d40f56d52a063cf403dbaa02bde21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4438d03-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644952, "uuid": "2776226b-cbce-4e44-ad03-7dc72400da28", "comment": "Malware payload (Mirai)", "value": "b896224dfd94d435cd90cd1334486509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644952, "uuid": "3d954bd8-5649-4fa8-b8e7-7050600cd8de", "comment": "Malware payload (Mirai)", "value": "b89cfc08d8abe6eed52db45e83e51f39f9c67b864c41ab658f10f4ede463f00e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644952, "uuid": "3fe1f2d0-b177-48e3-ac5d-c3efcdc39332", "comment": "Malware payload (Mirai)", "value": "6450ea0a7c60ce92a6187343873517cda732ecd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644952, "uuid": "58eb30ef-8c78-4920-bc14-ee2145f87905", "comment": "Malware payload (Mirai)", "value": "f3f9c42acaa926626e7cfda3ecfb73155a38535dbc02faae18c5aef4ae6abfe163ee61d3b9fc645ecd7edace4ad1ddf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644952, "uuid": "97c82df2-514b-4f0d-b000-3bc71fc6d4da", "value": "T14B43971E2E619FFCFBAD863587F39E219648339216E1C684E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644952, "uuid": "7088bfd5-bc9a-45ec-a56a-397c4388ffc0", "value": "768:RaT+l5PNxAGJYmzrEIPfEIXwKE5jNxAjACOFym6OCLdc34pAOreBAWslnk/zw+:Rn5FxAGJtzh6H5jN2ZLdc3EzCw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644952, "uuid": "5611ef28-02dd-410c-b594-6032bc686364", "value": 57108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644952, "uuid": "9d67df77-fd43-495c-93d7-7435119fcf34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644952, "uuid": "c417ea5f-c887-4a28-9e93-23adfb1add47", "value": "00okmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f93789-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675186, "uuid": "53c592e2-65a0-4c9c-8ecb-cebaf638620e", "comment": "Malware payload (SimpleHelp)", "value": "9caf6ce040a7f0e755fca330a3cf80cb", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675186, "uuid": "faee2d27-0f40-47fb-8e83-3e9165bfff22", "comment": "Malware payload (SimpleHelp)", "value": "b8a3eb83c275a9951b569a8befe5f1ea5c135de94ec648e9a3cbe11297986add", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675186, "uuid": "b8adb06a-d667-4e5f-b45f-a748351c1603", "comment": "Malware payload (SimpleHelp)", "value": "38b8940d944a108e3bf7fd10fa2d38fb74dd3779", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675186, "uuid": "14494652-a934-4eed-90c2-31de1c4eed4b", "comment": "Malware payload (SimpleHelp)", "value": "c22c9fd830c6b13406d27563a718128f04ee40f7f9b41f38cc8eb27b1286e6d2f8ea8e5e7a5dcb3382be4a3146fddd23", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675186, "uuid": "d0b4d18a-a44d-452b-a1cc-d47615d5a57d", "value": "T199D43B34E2E15DB9CF37A5FCD08A4497E79BB9A203C4026717F086E28B613D4542EF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675186, "uuid": "2ea72ec6-4a2f-4bd3-a3a0-0836f263b568", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675186, "uuid": "811db3fb-afeb-4526-9d30-806e2be6b178", "value": "6144:kxrmLfiUqSn2mHtPsPekdzZOuapaIYOEoZbsCpRkFNPrOGUDo+5rHVZsM:kNLU92UOpzDapJtJRoNTOGcocrHVZsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675186, "uuid": "38fa0e5d-89a9-4860-bb9a-c2a1d937c5f8", "value": 648928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675186, "uuid": "d55d1eac-1bca-418b-a5b0-f5a32a63baa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675186, "uuid": "33e8bad7-efb1-41bd-8916-1261baf6cdf4", "value": "b8a3eb83c275a9951b569a8befe5f1ea5c135de94ec648e9a3cbe11297986add", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bd22b4-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725181, "uuid": "71e43dda-2697-4bb7-8a46-dbd572ffae73", "comment": "Malware payload", "value": "8dda0dc4124e43939cd46854c39eddde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725181, "uuid": "fdeaf8bd-fe48-465b-b8ac-14a82618d7ad", "comment": "Malware payload", "value": "b8abff5f55bb3c6b6b9acae1fe545b3163462639f601ea8325475eededc16986", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725181, "uuid": "c33a4fe9-f915-4d72-aec7-7240e02062d0", "comment": "Malware payload", "value": "b4051d43281db01776bf753c09aa531da5b4eb7f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725181, "uuid": "4e3a9044-edbf-4f36-8cd1-2570b59c5c10", "comment": "Malware payload", "value": "7e0b31bae0e8d02fa672309df98484b693d0b2b8b99c86e697073bb3562700bd6f6774549f4801701300163fb7071aaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725181, "uuid": "238c5fed-fd9f-4c43-93cf-dca5c499951b", "value": "T111340A90B281FDF6EC998FB824D2530A93B6F0C1971DEB2B6620FE3C025EA54D573645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725181, "uuid": "5b6e24a1-3069-47a2-9787-bd6df0aeaa42", "value": "a8aa6c5d180ea2df5aeadb569d4a92ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725181, "uuid": "adc9c6dd-6710-477a-9d86-c0fde0e24fc9", "value": "6144:7nx7Ca8MS+jKnkN2HKVubHyQiZz2jaonQ:1C5bFkIqNPUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725181, "uuid": "f1768f8b-01db-4706-83d5-ebd8e0943c5c", "value": 234478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725181, "uuid": "cfa24ecc-0c1a-497f-ba90-15a7d28eebc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725181, "uuid": "f7f1c230-543e-4839-b941-bb99f8f8b776", "value": "b8abff5f55bb3c6b6b9acae1fe545b3163462639f601ea8325475eededc16986_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a888b6e-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776687107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687107, "uuid": "daf427e6-f2ec-4e6c-ae05-7e8c8d407661", "comment": "Malware payload (RustyStealer)", "value": "615f080a36f54acd28b3f0bde7e041a6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687107, "uuid": "7ce1462a-f2ff-491c-a44c-75b21591a9ef", "comment": "Malware payload (RustyStealer)", "value": "b9a5c983888a1f5dc35202b1a91d28669387f6c55c3500daaa24e4badbed607c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687107, "uuid": "db6e9700-6d5c-4e47-8d64-286f0f2b841b", "comment": "Malware payload (RustyStealer)", "value": "c277fed5c3467db94d4a57ce626043299c23c68a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687107, "uuid": "81838aa9-8031-4d4d-980b-97f485e06b82", "comment": "Malware payload (RustyStealer)", "value": "65a52422f6e27b6d684378fc5490e8345ea0806e7eb2935f8c4356c9994a418967f0c2276ee627f52c805d97ee55a87b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687107, "uuid": "ea6a7e1d-02e3-48af-86de-2fa1426b1fdf", "value": "T12326334176C00CBAED6A42753DAD83ACA7FC9D021F12EDEB4C9594F31E726910672D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687107, "uuid": "0fd64750-e098-419b-aaa7-2d5ef6743042", "value": "ad299604fdb6bc3cc7a020985ae57379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687107, "uuid": "a8b4cd8c-ba90-4798-b6ad-695c4515675e", "value": "98304:8B+m13wzZavXMcECXfTZznfAlUWT/+Zv6rVbyUx:8d13bXMcdLZD4Fz+Zg8Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687107, "uuid": "a7330c71-bfcd-4259-85fd-a84588a44ef4", "value": 4696064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687107, "uuid": "4e71764d-996d-4c3e-b287-fc7c4648f18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687107, "uuid": "325e14a4-310b-499b-bb93-2888f332a28f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ab2a06-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725481, "uuid": "4eccfec7-48f7-4315-9194-c16d185e0f49", "comment": "Malware payload", "value": "528e0c988faee2a5c8bda0f236b0603e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725481, "uuid": "58ecaca6-5421-4318-9fb4-a9d979a3df7a", "comment": "Malware payload", "value": "b9b2b1556c23f95d4774e038fcaaef494d879137e548f57c482d03c87ad45bc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725481, "uuid": "06c9e366-5748-4fa2-8569-b43d6a28844f", "comment": "Malware payload", "value": "f2e82c71eaabb626ca62c3f25eed1c390de40d24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725481, "uuid": "5dd907fd-c0ec-42cd-9472-984e1cea3ecf", "comment": "Malware payload", "value": "86ba16090a88c33ad941954bee89d1607e72506c05d141496de9bbb2f73e8deb0bc5e18c2a72054636f18587684fee4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725481, "uuid": "de47e3eb-187b-4052-bd64-4f66e72f6b1a", "value": "T1D4B35A57A2E400BBE17BD23985A34A46D7B2B81157609FEF07A4464B5F233E18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725481, "uuid": "9ec1f008-c9c9-4008-96ae-9cf30b10cf6c", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725481, "uuid": "2f342f4f-3a96-4ade-9937-60b31f015236", "value": "1536:uXj0eyoElaUrYG2a0ETuZYd2THgS7VFrd0wmEZsEHPsWvfdN9dlIKtWO8U+:uX9Fuq4L2YduAI/d0wvZsIV1daEWO8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725481, "uuid": "23981bbf-fd7c-4536-88af-a5d9903b4186", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725481, "uuid": "bc440f46-aed6-4249-aa95-f5237f0320af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725481, "uuid": "d5fd624d-92a2-43d2-b6a8-59daad346790", "value": "b9b2b1556c23f95d4774e038fcaaef494d879137e548f57c482d03c87ad45bc0_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c011a97d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725610, "uuid": "3a17faff-ce86-4145-9189-7af085a9dac8", "comment": "Malware payload", "value": "c7e095376f370481028bedd8888d475c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725610, "uuid": "06a70d85-48ef-4a9b-a1fc-1eaec47713f0", "comment": "Malware payload", "value": "b9fe5632860836ca8738860db1df08a5373cc8d66cacc1562d3ff2b85b4f4e3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725610, "uuid": "0e97fe05-48ce-417d-9496-23c3296d043f", "comment": "Malware payload", "value": "89bb447ab803aae42e7531423fc5c06a544448df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725610, "uuid": "d42d73ca-aa77-4c44-9966-1f7cd679d2c6", "comment": "Malware payload", "value": "9cddfeaafbea81ac14c3887e82ed00d5ac5cee3c23bc364c32fc852dcb44396eaedade0a41b0e7f6b8334d64b8f9b1ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725610, "uuid": "c43df633-2692-455d-80fa-a4e117a5baef", "value": "T121A34A57A2EA00BBE2B68678C4530A4AD772B85117609FEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725610, "uuid": "47d4c401-7606-434f-97e8-21825551bfd5", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725610, "uuid": "6057009a-74f2-42d6-b50b-8e3895d8361b", "value": "3072:RBTeXQwDasaAmiTQhAS/xYN0C51756565rnIryHw/CmwK:beXbuFaTcAS/0uLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725610, "uuid": "45cf08b0-cc72-4ba1-a1a6-cdc43cd897a9", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725610, "uuid": "39601ba3-d7fe-4503-ac5b-833020a0bbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725610, "uuid": "3506a438-dd45-414b-ac18-b6c011a6074e", "value": "b9fe5632860836ca8738860db1df08a5373cc8d66cacc1562d3ff2b85b4f4e3f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b378b20b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725159, "uuid": "9bd1f6c4-225b-4ab4-b784-db4ab4620daf", "comment": "Malware payload", "value": "39cc82d1a455a4f52a0a6f73e95dc701", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725159, "uuid": "551b63b3-4880-4ba9-a831-5dc798259a30", "comment": "Malware payload", "value": "ba74d25ed7d0fd6d43ad9239affb533c6eb8bd3b148c7c5e8fdea04ab7b05b99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725159, "uuid": "183d8284-0898-4a70-9124-5da377d8b01d", "comment": "Malware payload", "value": "a74f54cb71ea0b9730fdd7633a156873ab78c8a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725159, "uuid": "bf6bd9b2-46ac-47d4-ae6f-60b6c0adfdaf", "comment": "Malware payload", "value": "aee85831c903deda51e22d0c2e4b4ba7dee320a7a36996c43b2b69daa691c2dcedde540ad05c79b0ee28d6710c7de25f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725159, "uuid": "e2681c85-b6c5-4a09-8875-bd3c068434f5", "value": "T153A34A5BB2B600BBE1B7833884570A45E7B6B8554761AFEF43A0465A1F233E09D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725159, "uuid": "90039f11-f7ea-479f-893a-17e0f65394fd", "value": "0fd9902150a10ebdcba803b76e55f48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725159, "uuid": "2ee930b1-e2fe-491c-8fe4-8f2771ce2648", "value": "3072:8MwulKXezak9QbNOkzviKtuAOjzJoyfm2GgzskZpgyzfWHRzT9aiD8Lj6x:3AXIMNOkzvht9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725159, "uuid": "970ee908-fefb-4d41-9c7c-a9d811bdfad1", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725159, "uuid": "d7d2f5a9-2e24-4de0-8040-ea08cbbbe972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725159, "uuid": "b13373c5-b3cf-4fda-bd2a-c9b4c1270485", "value": "ba74d25ed7d0fd6d43ad9239affb533c6eb8bd3b148c7c5e8fdea04ab7b05b99_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51dbec0-3cc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776694775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694775, "uuid": "f91c8a5f-3914-4cb6-89a5-6aaa8d0d87b9", "comment": "Malware payload", "value": "1001ebdcfa03343a271e33d2770260ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694775, "uuid": "a10356b5-c981-4174-b768-c3320a695637", "comment": "Malware payload", "value": "bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694775, "uuid": "24ead8af-3b52-43d0-9139-38ef20122b8b", "comment": "Malware payload", "value": "b0b13016df43d80a189c4e616a65607129c7c7cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776694775, "uuid": "a07bbf35-7c9f-488d-98fc-d3a79eabdbe4", "comment": "Malware payload", "value": "9db51c89a3d8056cf51f46c5a303c72f85476ae81d4b57a27a0421c6588a5f4e1ae7acb1e6ffb227019250c7a65b579a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694775, "uuid": "b3133bcf-5f3f-48d3-8d21-0743e7ed5c7b", "value": "T1A5D7333F728B613AD2BD4A3679FBD221883BBA255106885B57F4C90CCF151B11E3E61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694775, "uuid": "98162e38-5614-44b2-a4dc-f34f39311673", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694775, "uuid": "09de6a29-9d88-418b-8082-40af4b08d5bc", "value": "1572864:UqwtPTmM7jiymeL/fWPFx0bWCZZUAD/IEjBwv4YydwmR:QtPSMC+3WPFx0bIOI983R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776694775, "uuid": "7432f016-1198-407b-8f80-64bb392f5492", "value": 60848928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776694775, "uuid": "d0b802ef-e94b-4d71-adff-61dc981c70eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776694775, "uuid": "ebee90d5-7bd3-4b6e-9906-b6e5011cc6e1", "value": "Faceset__2_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e01d22-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724999, "uuid": "861de79e-7a2b-4a99-859d-910963076003", "comment": "Malware payload", "value": "642546cdeb9cffd081c1f9d61bf89f79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724999, "uuid": "a787402b-1d2c-457c-8847-d9edc7521a56", "comment": "Malware payload", "value": "bc53ce4bcea856eb3d03b0367dd2342b879a00491e7d5992716eaa421f32adb2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724999, "uuid": "069e7022-dbb1-41ac-a108-048871aa699a", "comment": "Malware payload", "value": "e96766380848272226b4e942f5c20793198501c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724999, "uuid": "d09f2961-237f-49a5-abdc-d0bc97f43bc4", "comment": "Malware payload", "value": "610f4ecb8a8c29032cc0510d0fdc4667d84dbeacee92a6cb27a22403cdb8adfcdb88b9206faee004a0ec008b50a65b7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724999, "uuid": "565e3ee9-c67a-482f-bc9c-8d2675f91130", "value": "T1BFA35A5BB2B600BBE1B68338C4570A05E7B6B8514761AFEF43A0425A1F273E19D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724999, "uuid": "52a0edbf-6d07-412e-8c32-a779a7b7b2b3", "value": "0fd9902150a10ebdcba803b76e55f48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724999, "uuid": "41a8dcb8-3296-4779-99b8-656cdb198b02", "value": "3072:5g4MwulKXezak9QbNOkzviKtEAOjzJoyfm2GgzskZpgyzfWHRzT9aiD8HEGx:6jAXIMNOkzvhtPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724999, "uuid": "05143b92-7495-4617-8705-0a18db885e6c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724999, "uuid": "37938a02-a253-4588-8050-08bb7288a4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724999, "uuid": "ea1a2e49-319c-4b15-b8bf-7ac8a5096b14", "value": "bc53ce4bcea856eb3d03b0367dd2342b879a00491e7d5992716eaa421f32adb2_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184bd5ae-3cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776700847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700847, "uuid": "7a46f298-fc05-4dea-8937-898275183f64", "comment": "Malware payload", "value": "0ada3527eedd40567839d53adb4a733a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700847, "uuid": "cbf65c09-12c4-4313-a010-f71cf68e0ca0", "comment": "Malware payload", "value": "bc916149425b09e8604006219d1b0faa7ddafc900011c83145c7b8faebe49557", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700847, "uuid": "8291c133-7b60-41b2-9a52-6adde7c274a0", "comment": "Malware payload", "value": "5bb270aad5fac87145379e08c7f1b4e0cad49651", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700847, "uuid": "c8a2fe00-c672-48bc-9c53-0c34be750e87", "comment": "Malware payload", "value": "8c79faa4e522b00344d91919865803d1c4935269d09ff1d73ed120fa86ff3831c044f97bed2e266e42cbcb5b6ae12acf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700847, "uuid": "2f00b973-ddff-45cf-b44b-b628794e0471", "value": "T16FA433397A5DDA6CC413E2325751F71AC33F0B60CD22D4636B1AF1270CA9AE2658C767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700847, "uuid": "93216f61-2057-4116-b731-f2a20029e97e", "value": "6144:ORvdnhDfXoyvxoXRICgdaJarvdItANgnAUHQwJ85INfVnKp5qw7ibdO8HRF3:C1hDfXoC68d8aj5+Qaj7nKC8ixdHX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776700847, "uuid": "aaaddd8f-1162-4bb3-bc13-e97b4899b4eb", "value": 449302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776700847, "uuid": "b570fea1-f75a-46ab-b323-05454cd97e32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700847, "uuid": "03138a40-a5be-4068-b6cf-868e9a8c423f", "value": "PDF COMPROBANTE DE ACCION DE CARTERA_indetectable.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afeab7f-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727104, "uuid": "0634819e-c5bb-4c58-8055-071a93483a7c", "comment": "Malware payload (Mirai)", "value": "97827026974a8b39bbb89b996725134c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727104, "uuid": "e300be36-3409-4f6b-9757-2ae2f7c85907", "comment": "Malware payload (Mirai)", "value": "bcd24a63e25d58e6b16548906401d9f6a83d10f7ee985f57581b46e29e131aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727104, "uuid": "d9c63f71-9b99-4719-aa4f-a6d6edbe1140", "comment": "Malware payload (Mirai)", "value": "c61b6276de98ec7a61ae23dc9f180e59536e12a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727104, "uuid": "4064ae7f-d862-4824-8320-c6e576e08bff", "comment": "Malware payload (Mirai)", "value": "4292fe2131a09df01167b77f463ff72dd50e3092f4531f8407940d74a6e18e67db8bfa60712e52106b407bedb6ca13c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727104, "uuid": "5442fcf4-7abe-495b-8188-aebe7700fda1", "value": "T1EA639E16D82109A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727104, "uuid": "6c5fa70e-1ea0-42e6-8680-f05cc7433392", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8ud0:dWVkwgAYugsz9xznsxrd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727104, "uuid": "4dca3a50-fea8-4c06-919d-d4c9846df040", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727104, "uuid": "723c48a8-0b61-4302-ad1a-60b68568adf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727104, "uuid": "372bafbb-83b2-4b77-906a-7c2bc216a74c", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a0802b-3c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776644956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644956, "uuid": "f346b9bd-39b5-4421-ae6b-84ae5adcdb87", "comment": "Malware payload (Mirai)", "value": "2167fb8b9188de58a9302c4195c56f27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644956, "uuid": "d473db66-7671-430e-ae3b-35e14dbb5d7b", "comment": "Malware payload (Mirai)", "value": "bcd8805da45aaa227c3979c999890c3d5778d078d0a22f0d552b47a364387638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644956, "uuid": "855cd91a-a7f3-4406-a4da-0a58909d8245", "comment": "Malware payload (Mirai)", "value": "d21782a4960c3fef8a60bbeee83e70ae54d8d1f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776644956, "uuid": "bfead10e-1f69-4a23-bd62-e572360c69a2", "comment": "Malware payload (Mirai)", "value": "2998e93ada1159544ced77248752ba8073ed18335bd692ff24c6c2834aef27df64c1407ca8b43be25cf4ec3eae2b71d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644956, "uuid": "dfca9f90-f946-4003-82f6-6eb701f27a0e", "value": "T1C943710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644956, "uuid": "abb8f6b1-d4db-4d43-8e70-6aaaa5e9b557", "value": "768:oLWu89xw1IlGGUantlZIxY966x1EnB6NTcWlp21wmNOUGpCIMtjej5dIne2el9e2:oLWu8fwgUHkkLg9gzStS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776644956, "uuid": "fac02dd5-628f-4dc3-bc6f-10ccfa6a8d50", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776644956, "uuid": "c80aa0d2-28d3-4d8a-91ee-c807ade34ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776644956, "uuid": "7a2201a2-2867-4257-acf6-b32773465e4d", "value": "00okmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5992574d-3cbb-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776691078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691078, "uuid": "a7c01b45-52bf-444c-b5aa-4bfeda6a396a", "comment": "Malware payload (SalatStealer)", "value": "a9035abfae1198abe6c77eee2ed99b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691078, "uuid": "edd90470-0c24-4829-80dd-17851067a338", "comment": "Malware payload (SalatStealer)", "value": "bd197d7a1102a14fcbfdbde86b00812efca8d6f1539c2676790d35cb241f35db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691078, "uuid": "f42ca1b2-3d01-423c-8fa8-e7eeabe51de8", "comment": "Malware payload (SalatStealer)", "value": "1a65c70fb4c5d73bf8f455d6ada8fb4f20107274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776691078, "uuid": "ddef74d1-0d8a-424a-9b03-88b140e56918", "comment": "Malware payload (SalatStealer)", "value": "3b4628596a79cb508c69e8e2bfc6a870be50e5545b112c6c226ddb6342d52508a665cfe5be7f6df8e727c3c8150a1dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691078, "uuid": "4f9cd942-8677-4adb-87fe-6cb503f15720", "value": "T15FF533136C5F88BBFADF0F320E38A4611900A4CE8C9A719975D8122CDED9B9D35B9747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691078, "uuid": "0b62110c-f997-4efb-9c39-7b777724f1be", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691078, "uuid": "605a7f70-9be0-4b99-8bb4-9f9ea4625f3f", "value": "98304:QCqRgMp5j9aU+wUAQIW6EL2dVxYjPKKFBglwRLoQWpb:QtV7j9V+bpX6Eyyzgy5oQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776691078, "uuid": "8a6a9bf2-163c-400f-b0da-1cd673e932e0", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776691078, "uuid": "8bf137cb-ab22-4d40-9eee-3f359ba08ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776691078, "uuid": "630020e2-ca90-459a-a3a1-c0bc1a7dac92", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec8c150-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697717, "uuid": "2a75b143-3fb9-4d90-90d1-6f4bf43e74bb", "comment": "Malware payload (AgentTesla)", "value": "bb9c15ff0a22616550d6a8875822eb13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697717, "uuid": "cccb48b0-4ea4-4756-be15-ca4208173b4c", "comment": "Malware payload (AgentTesla)", "value": "bd69cc3b4d6bcc9fff5783e9d43d8a034e61f184ce6d7e253dd24d6bfa9976e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697717, "uuid": "495cc3f4-40ac-455f-810d-531d278984f6", "comment": "Malware payload (AgentTesla)", "value": "5ad6611e297873e57af001cd44fda6d8266d08c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697717, "uuid": "51706b32-d6e0-4e14-8453-6841c68b4037", "comment": "Malware payload (AgentTesla)", "value": "b95e55aed319bff5b862c2cecefc3478cbf7688595d2a5e4305091e93feda3d4ee5f5be2a7758fdede8f79e027808982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697717, "uuid": "c6c903cb-8999-482d-8f5a-605fc9bd46e2", "value": "T15333C574190C45EF20D3EA74B084A7E3FEAC0A5D9FED6A4F915487DA1A3EA8734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697717, "uuid": "770c518f-a3f0-4815-9d3b-65f4b51e73ff", "value": "384:4pTQuR22LV9FxSDkJDUCa4qqEySpgiKWksXOq5odwgSs7tCRMnQZnVd:ETRBRJMP7lpiTMUwgeRDVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697717, "uuid": "a471e9ab-a6e9-4388-b5b6-ee1920b1c8b1", "value": 53671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697717, "uuid": "d1cf217e-2c10-4b6f-aefb-98c57376ce2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697717, "uuid": "ceb70484-0869-4c3e-8e78-e79aff472282", "value": "HARGA APRIL 2026.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3b2057-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676646, "uuid": "bcf64e35-c8ea-45ce-9958-8afb5ca1904c", "comment": "Malware payload (ConnectWise)", "value": "90c4d47cebace163cdeea7e037512460", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676646, "uuid": "5e4401e5-e644-457a-8242-2dc3e8fb1cfe", "comment": "Malware payload (ConnectWise)", "value": "bd7333eb83ee91c8fe2d6f3f2e55473541d122bc5699d1c1f3ab32c55a214eba", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676646, "uuid": "cd659bce-c018-470c-aa2b-eaed1c8e57d6", "comment": "Malware payload (ConnectWise)", "value": "d4295efa7c4ddf3a0836ff4da8b787509c7a7cc8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676646, "uuid": "24537a81-2ca4-4127-80f6-21bc2f0280b5", "comment": "Malware payload (ConnectWise)", "value": "e4dc10bc6a78ead621680fa50666df8aab4a593122237ced5f4dc6b8bf86d8d83f2a0a60b24cffbf060c61bb5eeb094a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676646, "uuid": "62351aef-2624-4ef6-a99e-365e0dc177e5", "value": "T1FE46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676646, "uuid": "4dd7f8af-bfb2-4c41-b8e1-7cb6e9302924", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676646, "uuid": "c6eceab3-18ef-4f61-8e7b-14674bf6cf58", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676646, "uuid": "559b9cc9-000a-4ec2-8ca1-282dfb59a79b", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676646, "uuid": "cae110ba-5494-47bb-9170-f2d7d5f15b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676646, "uuid": "62ccda91-9dea-47fa-b315-0be86e7199ba", "value": "bd7333eb83ee91c8fe2d6f3f2e55473541d122bc5699d1c1f3ab32c55a214eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc7ebff-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725284, "uuid": "c55d0d2c-ca6b-4cce-927c-de8d86b6560a", "comment": "Malware payload", "value": "2aed49cbd2fc1ab0cfad4d9997950950", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725284, "uuid": "351ad84a-949c-4616-a1c7-9c49bc8a0bd1", "comment": "Malware payload", "value": "be70c9376c4d24e8c5e37a06592aaef594a96bee65db7a0aa7d6ef69cdce8e61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725284, "uuid": "81e41839-1eae-45ae-9f89-8912ae672656", "comment": "Malware payload", "value": "f3c0bfa25814632a2e01ec8ad2ecf0211bc445fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725284, "uuid": "d7f296e3-f435-4092-bbf7-cc6adfab53af", "comment": "Malware payload", "value": "3eb70696f262977550168339d8c4bb5dd7d4fb56c50cc7b2b4d9acc488abdbab9c197480ce6042ea90629ef47c349cef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725284, "uuid": "e073ccba-b59e-4159-bc68-8e79fcd8a1de", "value": "T196B34A57B2BA10BBE1B68338C5570A45E772B8414761AFEF43A0469A1F233E09D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725284, "uuid": "c0247218-a93a-47f0-9633-3e4f58c2eaac", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725284, "uuid": "fbcf0c8d-ee90-4c08-a0d5-6a83c816eed2", "value": "3072:jpnewXSApGnKj7A8VVQezDZ4CHx5qVUxZ:5eg5LjE8vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725284, "uuid": "7479631a-d500-429b-b5a9-727db0afae41", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725284, "uuid": "762636ee-5bd5-4a74-b69d-794920e18b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725284, "uuid": "4481559a-c7af-4011-aa2f-dde1d76b5db7", "value": "be70c9376c4d24e8c5e37a06592aaef594a96bee65db7a0aa7d6ef69cdce8e61_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01160e9e-3c4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776643255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776643255, "uuid": "6cd28d43-239a-4057-aff5-098c8699f41f", "comment": "Malware payload", "value": "ec84b0b815a42457563032fc6bf73bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776643255, "uuid": "9a8880fc-014d-44b5-b09b-35d640f9d8ef", "comment": "Malware payload", "value": "be8cbe4f4bfcc27f366d09382cff27ebf1d08c250a90144cf272d854c3beee2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776643255, "uuid": "5d56a056-d34d-42da-b98f-5d0c3dcbbb7b", "comment": "Malware payload", "value": "fede9e1e155cb3609c1f58ae84d3144f5b03673a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776643255, "uuid": "16267360-3baf-42ba-a858-7f7abd5632aa", "comment": "Malware payload", "value": "af4ca35124623603a8c2f0c9b8ca618e8f2666a9063a203ce53ce7808ab6af8fa0c78a6f656b22a09c0728d759c25367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776643255, "uuid": "80a63fae-8ce5-4adb-b84e-84caabcfad1c", "value": "T19AD68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776643255, "uuid": "6580047e-3f0a-4a50-9949-4b49ae6768c2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776643255, "uuid": "ea4e023e-d63d-47dd-94b1-eaf3e98a9411", "value": 13238272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776643255, "uuid": "e651c77e-fd85-4e3f-abf6-866dd622580f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776643255, "uuid": "c0c7a654-7488-423c-9928-56fc8e361d10", "value": "be8cbe4f4bfcc27f366d09382cff27ebf1d08c250a90144cf272d854c3beee2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61bd0af-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676738, "uuid": "73560002-7923-43dd-9c23-77c0bda56bb7", "comment": "Malware payload (ConnectWise)", "value": "dd7a107b2183d4083d31cb2093050cbe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676738, "uuid": "6a3107b7-3817-4f98-8da0-81c763fbc645", "comment": "Malware payload (ConnectWise)", "value": "be90965b1b493272b4eea91b956f4e107365b6e5d6f8e49457c90bd712cb7f22", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676738, "uuid": "c7cb95b8-d74a-4bed-ba01-90da6cda8119", "comment": "Malware payload (ConnectWise)", "value": "690b895116af7bd8e7ec96c784028ab33bf04a01", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676738, "uuid": "d43fb7e2-bd15-4b3a-8669-b7429c45332b", "comment": "Malware payload (ConnectWise)", "value": "14e2577488b1ae84d1d2ba7e9ad6e4ffa610d9be0a187f24f3af756cab3d6042e46a8531e695c9b6449adcc8495766c1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676738, "uuid": "eba03866-757a-476b-a17f-22e6c1c35bef", "value": "T136646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676738, "uuid": "55995b9f-3a23-4a7d-9e2c-0354f1a34d93", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676738, "uuid": "3df97b81-9814-40ee-9382-cd959bae08aa", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676738, "uuid": "b0cf28c2-e0ef-4e3f-bd21-d07048cd90b5", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676738, "uuid": "cf091908-8b7d-4797-b996-2250956856a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676738, "uuid": "70aeabb1-f50c-4503-aad5-c102f38f3a04", "value": "be90965b1b493272b4eea91b956f4e107365b6e5d6f8e49457c90bd712cb7f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904641de-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725100, "uuid": "cca1c7cb-cfa6-40d9-81cd-61180372a3a2", "comment": "Malware payload (RemcosRAT)", "value": "edd45b64edaaa6b6184414b9a3ff3b64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725100, "uuid": "cf5384d5-ab07-485b-91f6-5d62db96e6d3", "comment": "Malware payload (RemcosRAT)", "value": "be94ed15a50a3386f6ab466401d68faf13ead40a05f50c37f410414b57512d3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725100, "uuid": "873a5066-9824-438c-bf55-f4561c51909e", "comment": "Malware payload (RemcosRAT)", "value": "cf0693af1e4ecb180717a9a32e3be811d99f07db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725100, "uuid": "813faf64-b190-4f87-ad60-d8c116f89f84", "comment": "Malware payload (RemcosRAT)", "value": "e8d33da187a0c7065ddc4b7b48a0228c57af2844ebe5cc5de93e7e3fb0055d4670bc217c07072879d2c7f0e567bc5350", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725100, "uuid": "09d2f851-b1dc-4219-93a2-edd139123b2c", "value": "T1B9B3598BA3A500FBE1778679C5630A4AD7B2B85117609FEF07A0421A2F277D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725100, "uuid": "b17a6593-6bd9-401f-932f-9ee04f4db5e1", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725100, "uuid": "5c6b0eff-1db8-4962-bf4f-1967624d7158", "value": "1536:bFRxeCCntVHnsWYuk4YBKbZpHTH3S1ZowWe407WJlqJxE+gsWRJdL9dlIj1wls:bLHCPHnUQXZpzXIye44vJxSjjCwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725100, "uuid": "483494ca-f0f5-431d-bf6a-c1e56d869f98", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725100, "uuid": "f4a80589-17d3-4a23-8dac-a9b1a89fe572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725100, "uuid": "f2748748-bda0-48b9-a1a4-29f37074e1d1", "value": "be94ed15a50a3386f6ab466401d68faf13ead40a05f50c37f410414b57512d3c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5652e9-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776674064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674064, "uuid": "7024c38a-6b9b-40ad-ae9b-1274f218f228", "comment": "Malware payload (Phorpiex)", "value": "bd50c1ba03afb8a4dafafe98cd8eea8b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674064, "uuid": "3bf0d8fc-c299-4150-8467-c9b3e3ea59a6", "comment": "Malware payload (Phorpiex)", "value": "bfc7e2165ece4f40f94629076eb896646d3d16603ac0e311b86f30e488afb2d4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674064, "uuid": "85398e62-0594-48d6-8612-bbb9fe3bc4c3", "comment": "Malware payload (Phorpiex)", "value": "0b688c44061f3b8cc05a050e90f008cf5ce2bc2c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674064, "uuid": "a851a140-ca6c-493e-862c-3166bf31c912", "comment": "Malware payload (Phorpiex)", "value": "ff35b33c19c53028f16645a06a3847454f6e95447ec4aba098747ad85519d5a5245dbe0f1b32577685155af79317a74e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674064, "uuid": "db6db6fa-f023-430e-b00b-d7d53a1ea2f2", "value": "T13D22392B7F490231D39049B456B54A4B953D1633A783B7EFF373D1990BA62498440EEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674064, "uuid": "e3a58aad-a8ba-45d4-8417-6d715c306dfb", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674064, "uuid": "5ec07f04-55ad-454f-afba-a9cda321cd5f", "value": "96:ogdwoZzYz/J4hSZ6BWdipKD7lx+ZQVCTBzePFJxGE9mZ2FFhxC7tCEeAQCXFh:oHoyFZ6B6x+eV7PFJxTEZmFhSeArXFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674064, "uuid": "54c38768-3304-4812-b58c-57a8f5cb1716", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674064, "uuid": "af4cf40f-2c17-4efb-bc79-09b82d6bba0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674064, "uuid": "e7fc9219-fd5e-4c4d-8f87-f804f90521f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e7142f-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697575, "uuid": "23ac4f11-b66e-4be9-aed1-128740f025d8", "comment": "Malware payload", "value": "cfe337e13050d89e2ff87dc8cef97e1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697575, "uuid": "04909843-ccea-4fb7-8ed0-ee1c23baef95", "comment": "Malware payload", "value": "c03060e63d3a3a16312ea4d15393c38901ec7239d7290bd30f6b266316bc0b1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697575, "uuid": "bde58ce1-c0b5-4163-ba36-f9b2f644a40b", "comment": "Malware payload", "value": "371dfd48a8255f3a6d90014a5602b9a9eff2f0ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697575, "uuid": "99eb41b3-ae41-42fb-a644-450b347ba1a2", "comment": "Malware payload", "value": "97081008e7ecc6485b5c809b78ea5b27de3cea0f73501d7ebcded3ad40fcd3b1d8376f62b6d9270f69de40a261306963", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697575, "uuid": "69da4bb6-4e46-4ede-a148-72d99a2f5b24", "value": "T1DCE4EE6618BB9500821721EA573B63F975B7C983BA0474B8F44FF17CEF8AD2C51A0639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697575, "uuid": "878ff3b7-ca4f-49ec-b0c2-184379ecabe0", "value": "3072:jkm5kBAOoTbKyjvBUtUy30t9UiLYUJgCPCx/Rc7Rt5JZzg23iqdaRBGB4rz1sOy:jz38kIZUDCxW7R3JZzgPqIHDRsOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697575, "uuid": "7606a7f9-923f-4ec2-9908-799d88e12bf8", "value": 698872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697575, "uuid": "ba5def8c-f7b0-4254-9153-5de3522b478e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697575, "uuid": "9c289bd7-53c9-4b1c-9176-5b2106f06a11", "value": "RAKBANK Inward Remittance Advice.rar.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d14e5e-3cfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776718125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718125, "uuid": "79e2836c-70d6-468d-b4d6-3c0f50efb233", "comment": "Malware payload", "value": "5e5a3c23107fa7ee3d50711bf5417507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718125, "uuid": "f63a7943-b0b3-4eb9-8422-0604495439ee", "comment": "Malware payload", "value": "c07f115373473db336425d9ce032a33b012fff9c652498169b1d745746fb4423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718125, "uuid": "de738895-d4df-44e1-bfeb-d028a6b8f192", "comment": "Malware payload", "value": "126313a3cb4c32007d3cf0f560f2f8976263b14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776718125, "uuid": "e3daed4f-7b0c-438e-9631-a35881d2061a", "comment": "Malware payload", "value": "50d4e53c77b5ca7f76da808bdbe75991c9b865a92cd62fbc1fabfe4b34d48c8e1ea4b06a0774f74182ce6e84b0395fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718125, "uuid": "960c463b-f95a-4f32-900a-f3f86ea50de8", "value": "T108266B31368AC52BD07606B01E2CEAAA921DAE350F6144D7B2DC7D6B6B745C31732F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718125, "uuid": "ab485d5f-caed-4ca4-ba05-735bc1514ed6", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718125, "uuid": "92c13cc3-bccf-4141-bf65-e4ade4159b37", "value": "98304:XQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJt4aTWXAO:XQN5tgqSsl/oL+Tqv146w9Db64aKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776718125, "uuid": "f3655c9e-1760-4ad2-8915-7df5a602214d", "value": 4685702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776718125, "uuid": "ec3a5929-c16e-46d4-a725-aab07978a740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776718125, "uuid": "e8ac8d0d-b03a-46e2-8419-b97402a074c7", "value": "Dont Play This.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dd5038-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776724848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724848, "uuid": "566ec7ea-9cc7-4a93-ad57-682aa03a43eb", "comment": "Malware payload (RemcosRAT)", "value": "e0980726d10e2424544a01c1244222a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724848, "uuid": "13dff3e6-b4f2-4b17-ab38-0bda0563f263", "comment": "Malware payload (RemcosRAT)", "value": "c086065da56bda3b3654003d541b44f9721baec9894066768447d6c3841504ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724848, "uuid": "890fd1ca-8db3-4da5-93a8-401af231233e", "comment": "Malware payload (RemcosRAT)", "value": "02acf674338b93af87b4a3c1281e67b6c9c7abeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724848, "uuid": "352b1306-9f29-423f-89a6-984b9fe84baa", "comment": "Malware payload (RemcosRAT)", "value": "82ec854c2bc3bf900d4eee77d24ef9141b27bde1f45d95f86443ab7e4fa1c75ad37d7e36162177218b6c8b216266bf81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724848, "uuid": "b2ebe436-7602-4f3d-be2e-f9258dbd0553", "value": "T1B5B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724848, "uuid": "c252663e-0b52-4d6b-a0a6-f5cec1768cd8", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724848, "uuid": "25675fb7-9902-43f8-bbee-5a10dec8a972", "value": "12288:a6pxxGI8gvGOHJpAbDYGxLhZ+sPZtUmPFN:a6pxxx8U+bDYGxLhZtZ9PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724848, "uuid": "d60e3861-0c64-41b1-834b-ecd014ad7cd7", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724848, "uuid": "3db43880-9621-4122-9e0b-937a4781023b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724848, "uuid": "2e690a49-f36d-4b21-bc7f-f276b3d3c5ac", "value": "c086065da56bda3b3654003d541b44f9721baec9894066768447d6c3841504ab_15e5573f-b978-49fb-9e14-68e5bed78f77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e21e79-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675105, "uuid": "b0ddc7ee-e25a-4768-8f63-000f72ca5dee", "comment": "Malware payload (SimpleHelp)", "value": "238a40a338fea33c237370b2ed1caafb", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675105, "uuid": "e01e36be-8122-42f4-93cf-be1878f0e7cb", "comment": "Malware payload (SimpleHelp)", "value": "c0a2506b362503577ad959568b1309d2c59293f32fa7b8c788204ff49e65810d", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675105, "uuid": "9fd5b8d6-0c8d-461d-85ba-47439df1f7cd", "comment": "Malware payload (SimpleHelp)", "value": "157d3c7c8411ce0bb64d99b45ffea28d0b153697", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675105, "uuid": "93ef0ccf-923a-46e6-9a33-b92c411bcd25", "comment": "Malware payload (SimpleHelp)", "value": "1232d0b167f24bfcab840d01b005d4f413fb40e9eccb3a572859bbbca2940658e70e1be6bc120bdff1f7fe64c2d7cfb9", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675105, "uuid": "c4faeba9-af19-44d4-b775-7fdf8a6f7a68", "value": "T1DED44B34E2E15DB9CF37A5FCD08A4497E79BB9A203C4026717F086E28B613D4542EF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675105, "uuid": "87a46cb5-87f4-4274-a1b3-5a3ebf36c06e", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675105, "uuid": "c3f77af5-d813-4f67-9b07-6ee9b9bc374e", "value": "6144:kxrmLfiUqSn2mHtPsPekdzZOuapaIYOEoZbsCpRkFNPrOG1Do+5rHLZsR:kNLU92UOpzDapJtJRoNTOGZocrHLZsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675105, "uuid": "d0a62f64-534c-49c2-b651-b973d61e4993", "value": 648928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675105, "uuid": "49f85635-f924-4ee3-9f7b-7326c87b1387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675105, "uuid": "66978e15-c5bc-47c0-8ed3-2864dc1c3611", "value": "c0a2506b362503577ad959568b1309d2c59293f32fa7b8c788204ff49e65810d(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9933703d-3c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776667992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667992, "uuid": "21f1646e-8ae8-41f1-9835-784a77bc7e40", "comment": "Malware payload", "value": "8181ed84e26518ad15024199594a33f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667992, "uuid": "55aa629d-fb08-4323-96d9-7c5bc1ed4f98", "comment": "Malware payload", "value": "c0d96546c15948ac504193f1d3bc9adbdacb129dca30e56b93936d88ef658f35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667992, "uuid": "f2378b5a-86f0-4487-8890-38a93d56d5c8", "comment": "Malware payload", "value": "d29b60ec6ffbade4528399fe49ce8ae0272b78c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776667992, "uuid": "3544774a-263d-4eee-bc2b-d8a9861e02a8", "comment": "Malware payload", "value": "7ab2bc70038ad3da3f940d7b804339d3202f4ebf54a3da73d0b7ced6a02deea304017682971bdf6f8a18acc63006c64b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667992, "uuid": "6bc35d48-e252-40da-8f74-f2e56fb27ecd", "value": "T1B34185C6735045B2DCD5947BB2BA858075F592DB84B61BDCFBCC28FAC08CE08BE51A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667992, "uuid": "dac72dbb-1709-4473-a835-3a9bf57e69ba", "value": "48:9X0XEXoXMXtaXcFXNbXuZMXfmCXYgXJ3XAgXeETXqkX2YjXDtX1V:9X0XEXoXMXtaXcFXNbXuZMXftXYgXJ3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776667992, "uuid": "89a6f734-f684-4042-aafa-2cf8bb70ea07", "value": 2275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776667992, "uuid": "25f3f712-5861-42fd-8877-d020e3053c59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776667992, "uuid": "0d9be9aa-3bd3-44b3-95ab-eef780f53f3e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800c69c8-3ce0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707034, "uuid": "c9ef9044-d311-47a1-a7c8-70d97c9a1847", "comment": "Malware payload (Mirai)", "value": "7fc237fe0158e1b43032c05b9177e92d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707034, "uuid": "b71c63f1-53db-4a1a-afa4-b23833595fe6", "comment": "Malware payload (Mirai)", "value": "c11cd736d1a8188371a5f2080bc06c25561ac4f19863165072d2db7ff1d540ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707034, "uuid": "89fb0a2e-32a0-42df-bf9f-fa6da66cc036", "comment": "Malware payload (Mirai)", "value": "69d1152b6782b0419ed1ee05ebe6a2148b22c05e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707034, "uuid": "b7b39e37-4cbb-4075-8fdf-21b580ade10a", "comment": "Malware payload (Mirai)", "value": "ec1857c5359e63f7d32e4cd52dda6667c86cfd025d1aa65ef6cdd5208d5f1347b1a1acf443d520bb4f678e50a6344a37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707034, "uuid": "a7a8fd3a-4d59-4e15-ab06-85fcaffdc1ba", "value": "T1F0235B21B9392F17C4D4A8BA22F74768B2F5165E25B8CB5E3D320E4EFF14A8095173B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707034, "uuid": "1649be2e-50fb-4a67-b964-2080a33c25b3", "value": "768:yzomnlRq91dCPgsIrU6Tabz2rlkGqfrnxoO+6E0Rc:yzVnlRS1dCPgs8U6azw6nxir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707034, "uuid": "4fd36aef-d31b-4bba-94b8-ece91137cafd", "value": 46820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707034, "uuid": "55f643a0-b7c6-4dc8-9fa4-db0ebf7833cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707034, "uuid": "9a7969b4-14e5-4708-9874-364724e6fa21", "value": "00okspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e180166-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676536, "uuid": "f257f6ec-2f32-49c7-a1f9-e6e58b42ce7c", "comment": "Malware payload (ConnectWise)", "value": "524342108ebf6cc6fea62b0b81ef81d1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676536, "uuid": "0e7e311e-3ff1-40e8-a9f2-414881514df7", "comment": "Malware payload (ConnectWise)", "value": "c1510a39b7d6111d3fb947cabeee96b9360b8b74523f7a711117ab7b59f6ef06", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676536, "uuid": "1ee7de9a-1ff3-47bf-a736-a26aa36dc41a", "comment": "Malware payload (ConnectWise)", "value": "6e05a0edd5991968b95ad4146d19c67a4c47ddad", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676536, "uuid": "847d2e0b-e214-4097-b8d2-ce9cab3b98f5", "comment": "Malware payload (ConnectWise)", "value": "0f262fdde757683dfef654564e74f872594b7f8840f62beda5ae09f6be0400eb31ee31f73dc357e76b68ad4e76cad448", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676536, "uuid": "12a51540-bdb9-46ad-b4a0-dd9953dd4f9c", "value": "T13E46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676536, "uuid": "6e147397-b94b-457d-8ddc-9ad2cd710f47", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676536, "uuid": "11e1e144-557d-40e8-b16b-4e97159124b4", "value": "49152:jEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:sEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676536, "uuid": "8e2810d5-1a1c-4c6c-8263-752e90faa484", "value": 5622808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676536, "uuid": "0f3b31aa-2b50-492b-81eb-b34d47714bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676536, "uuid": "abd4d1ee-dbff-4f67-9329-1c8cc0025e6f", "value": "c1510a39b7d6111d3fb947cabeee96b9360b8b74523f7a711117ab7b59f6ef06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d705d2f6-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725648, "uuid": "87bc3b15-5006-4c36-a42c-4924eaa908c5", "comment": "Malware payload", "value": "13660085b4c3d8bd660c769ca1d824d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725648, "uuid": "e68941de-1839-4fe7-ab98-19a7a8386687", "comment": "Malware payload", "value": "c1accfb182ec267d0ff8c4d473494c16160390a79f1d8240db5b57b0a6f58acb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725648, "uuid": "0cc031e7-b7d6-47d3-b0a1-8f8537d43d38", "comment": "Malware payload", "value": "1cad76742c43cbcadbb89428d89998806d4ef04f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725648, "uuid": "2644c7f0-8427-4d41-b8f7-ccf8a9ad1fbb", "comment": "Malware payload", "value": "68ce0ac6ede8adcf01f9304c2923b3679c921d9737840c6fe962728038410a4ec51a30111e518382c3e05b9ccdaed2eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725648, "uuid": "86a3eab7-a57c-4e4a-905e-5af046e22250", "value": "T131A34A5B72B600BBE1B7823884634A49D772F8455B61AFEF43A0425A1F673D18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725648, "uuid": "1bfd41eb-3dd2-41a1-8b8a-1b7831b25e9a", "value": "1db8242845956bba39a653cbe367a0dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725648, "uuid": "d655eece-1fa7-40f8-908a-b20dd2f5845b", "value": "3072:cLTdd+k2M31COjvyGOYQb6AwrubNATME5JAC/T/2njLhbCDvmSOo2iePG3ufWC+G:uak2E1JKWM6AwrQoi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725648, "uuid": "d98d4050-487a-43a0-8714-db6072210b29", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725648, "uuid": "bb062e62-bf69-4122-99b7-d753922e89ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725648, "uuid": "440f7d58-3863-4299-af93-f462e891fd0f", "value": "c1accfb182ec267d0ff8c4d473494c16160390a79f1d8240db5b57b0a6f58acb_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b712573b-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674055, "uuid": "4ca03f97-0359-4bfa-971f-2cbe06a9604d", "comment": "Malware payload (ConnectWise)", "value": "b72c692ccbed2379c14f0245ecdf46ce", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674055, "uuid": "1cad3c09-c89e-420b-89aa-3268a3c66730", "comment": "Malware payload (ConnectWise)", "value": "c1cb8138f3e3b03920b1ab0999f7b2dd2487e4abe2ebda6c4fd775ed6607f679", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674055, "uuid": "3e2d8306-6097-4c20-9f3d-2bee7e431a6c", "comment": "Malware payload (ConnectWise)", "value": "0071d821418109e5ee528bcfe596c4c26f0842ec", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674055, "uuid": "915981de-003b-4f2e-9851-f54f9e86c885", "comment": "Malware payload (ConnectWise)", "value": "ef66fc8bc3673baa54547364b19a15adcc8d28ebeae0d61c92e3dbde60ec1a3b9089b561e3962724909f46d262fb9ad2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674055, "uuid": "978afbdf-b078-406b-89bc-7fbb02fbaa29", "value": "T198D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674055, "uuid": "136ac39c-4236-4a43-b443-2b6f4a53858a", "value": "196608:0Hxcp9ym3nltDUJVWHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3aHk:SGplpJGp7GpHGprGp8GpoGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674055, "uuid": "f4a38557-f4c2-4313-b61f-c0e9a85ae936", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674055, "uuid": "bd946838-5f44-475e-ae0a-b769965ba29e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674055, "uuid": "56e5f659-acd0-45fd-8e7b-8f25e13e7ea2", "value": "c1cb8138f3e3b03920b1ab0999f7b2dd2487e4abe2ebda6c4fd775ed6607f679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a1a41c-3cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1776702956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702956, "uuid": "c820718d-5d57-4808-b61d-918367acf1ae", "comment": "Malware payload (Adware.Techsnab)", "value": "60e21724fea0189dd7ffa4614a96a927", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702956, "uuid": "f475e6da-9655-4768-8e7f-bfb59c7bf930", "comment": "Malware payload (Adware.Techsnab)", "value": "c203f86657bea4cbbaf993ab8539ac011522399cb8bc3e4ab3e5e0d510fc2f1b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702956, "uuid": "135d394b-8894-4b4f-ad75-28ae1bc34de8", "comment": "Malware payload (Adware.Techsnab)", "value": "939191b02fea676bfdcf7681a60e766db2b26362", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702956, "uuid": "c0ef6b3a-1aea-4857-871f-301a82007b3d", "comment": "Malware payload (Adware.Techsnab)", "value": "efe638ed494ee944f937b46a940cfa13621bbb4fee4c6903cf8a87f958e136f1658e86984df22513231817e3e22a686e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702956, "uuid": "6f788993-7be8-4714-ac7d-11866ea8490c", "value": "T12633C7E23C4161D0A177BE24E1C173B7E897D90511D8E90927F07A688B2C1C7666FDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702956, "uuid": "ea37a2be-e032-4891-9642-ec665c6ce30c", "value": "1536:URrqOEkNknixU7kRRymHwk3HcBf/dj5ydU85fYv35Jgg:UhrhU7kvymQMcJydha/5Jgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776702956, "uuid": "856eca8c-a7be-4a5e-93c9-1db5745d0d6e", "value": 53984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776702956, "uuid": "a55e2757-ffc6-473e-a137-32a854fa5d4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702956, "uuid": "49a33822-7b75-4be6-8317-d0002757bf31", "value": "c203f86657bea4cbbaf993ab8539ac011522399cb8bc3e4ab3e5e0d510fc2f1b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8439f9ed-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725509, "uuid": "c3d75f25-c59f-40a7-8956-3e18704b1379", "comment": "Malware payload", "value": "67743d6333b654e7904d94817c254a49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725509, "uuid": "86dc61f2-a617-48b8-905d-acc6a0d23407", "comment": "Malware payload", "value": "c2fdaaf45f3544fc0ae466715f4dece54ad1145c47066a7034c0cc9ae9c49bb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725509, "uuid": "38821583-c1c4-4156-8dda-b6cef379dcab", "comment": "Malware payload", "value": "f5bd89cba000c0229a6317349c7cbf05b449d924", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725509, "uuid": "1a5196b9-1885-432d-8ca1-4c9599c2658f", "comment": "Malware payload", "value": "2b7b89305e087878919117f0caf4c372ce81a5493ab9166dbd52656a89264d4966485689af989a6650dcddbab327c927", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725509, "uuid": "8b6a6c09-0456-44fd-9daf-b431e0ab8660", "value": "T1F1B34A57A2E900BBE1779239C9670A46D7B2B8114760AFEF03A4464A5F237D18D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725509, "uuid": "274b41ac-38d3-4e25-864e-0b344e62c7ec", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725509, "uuid": "34e14c9c-7d0c-40e8-90c0-1fa7ddcfe585", "value": "3072:vINA+vkXsN6BdfY0rxDY873xmNkFPPPLJ5tc:vIlv0suFrxkUYc95O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725509, "uuid": "c50c00a6-4d63-4b0e-b496-894824f28769", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725509, "uuid": "0aabe700-69c8-47de-9bd2-147b5cf71b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725509, "uuid": "1b14a61a-4ad6-499c-8a6b-62aea74a89c2", "value": "c2fdaaf45f3544fc0ae466715f4dece54ad1145c47066a7034c0cc9ae9c49bb7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011d668b-3d0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726148, "uuid": "e66cce27-2763-4548-9754-a1b7cf06c387", "comment": "Malware payload", "value": "afd80167002eb2a4ac437d01fc5b1fad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726148, "uuid": "3177aa5e-9825-4562-a9b1-547578be381f", "comment": "Malware payload", "value": "c35d11ebb1590f051140c2842bc0b6c9f6640389622f13cb422b7a0c6fd73a78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726148, "uuid": "386d6ce5-64aa-46bc-89ba-d3add9ffbac3", "comment": "Malware payload", "value": "fb40c97b5e6ed3b03d594053b493a24edadbed6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726148, "uuid": "c122aa11-9e7b-44dd-88e5-7d7bffc7c90d", "comment": "Malware payload", "value": "868f210cd07e1ccbd382b84538814c3b6cff66a1107d86e3e37a71d631ec558d2a95f07347d7ca7cadd9cf4c4b2bfed0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726148, "uuid": "8e679cb1-564a-4df5-b277-b7b2c3bfb8f3", "value": "T1B6B36B4B72E500FBE17B8278C5A70A469772B85117619FEF07A0425A6F237D28D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726148, "uuid": "4f4a8b8d-cbec-42b4-a9b7-ad5c39f389eb", "value": "233a5431c033868c22dc3cb966d2f492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726148, "uuid": "44ce26ce-a446-4828-8d5d-67d01a71ce31", "value": "1536:5mEBmaKZzy32YN2Z/npOjkIkd4THESzEpSEumqxj5UfEEvsWd3d49dlNLjZAD5:otOno/K9kdkkMPEhqhuE2toD3ZAD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726148, "uuid": "2af956dd-6780-4249-acfd-958bb78d2650", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726148, "uuid": "6a196367-28d6-4b0a-94cc-72eecc09baa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726148, "uuid": "bda104b2-80df-4e33-ba4f-12fe75744f23", "value": "c35d11ebb1590f051140c2842bc0b6c9f6640389622f13cb422b7a0c6fd73a78_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7190de4e-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725478, "uuid": "cd86923d-7d24-417e-a47b-bb5a5d8373b9", "comment": "Malware payload (AsyncRAT)", "value": "1d2a5020995a2e0d0c2826ceafd2bbc0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725478, "uuid": "22c3fd95-6501-4ddb-944d-905a61e82d56", "comment": "Malware payload (AsyncRAT)", "value": "c3b7d2446bac6b40669014ced9749f7c5dc512e9bd8ae3da9969383866e04273", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725478, "uuid": "39576a3c-2143-4947-9d65-aed6c1b8c671", "comment": "Malware payload (AsyncRAT)", "value": "f4cab35979f2ac74d075e957474d090f6a0643c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725478, "uuid": "c6b7d2f5-ad7d-42f7-a21d-d3a42a62794c", "comment": "Malware payload (AsyncRAT)", "value": "d7bb2a5fb65ff92162ac270f42049af8586594bfd40f74ebd5845b41d9fa1b396f271d4a60314dff1602b4b617004a6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725478, "uuid": "16d5fb91-a5d2-4a7b-90ec-cdbc8f282f9b", "value": "T1FDE23C4877E04312C5FEAFF02DF2720912B5E11B9913EF5E0CD889962B67AC146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725478, "uuid": "c1ab0e83-d14a-4e2d-bc6c-074118b530f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725478, "uuid": "4d5a8c2d-dbdd-4b36-a0c9-e19efc41a87a", "value": "384:7paJuqQYbqjpk972V7/AqBZB1FOmLpMZvh0FbOKTCOQ9sRApkFTBLTAOZwpGd2v0:I16zY0FPCZvGFbO759sVFo9jZOjhqbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725478, "uuid": "35254ab5-1d99-4352-8bf5-ebe57b8457bf", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725478, "uuid": "cf830484-1da8-4d12-9903-da8b037ab9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725478, "uuid": "3f819796-4c50-471e-8253-1af81ee87b79", "value": "c3b7d2446bac6b40669014ced9749f7c5dc512e9bd8ae3da9969383866e04273_37807ad3-4106-4549-ba78-2d744cd30230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a2607-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725306, "uuid": "7e9a2251-0051-4bde-bc46-651fce9803b1", "comment": "Malware payload", "value": "dfffc2f7baf42797d3543719705ffcc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725306, "uuid": "c17af80f-2e22-4e92-8b60-4fba52d1db4c", "comment": "Malware payload", "value": "c3c186ad8f38885608d9f5ae51e98eff34024090bb23f29111c58dab369a4360", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725306, "uuid": "d7b0784f-4653-4d1d-a310-979f07baf189", "comment": "Malware payload", "value": "99dac559ff327e630591be7c90a11138e1cf3721", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725306, "uuid": "dd34d592-250d-46eb-9f4e-8ebb3256e7ef", "comment": "Malware payload", "value": "c78eddbbf01d0aea33264fb37efc1a5a909bb17c5d90cb6a3dbae32590a94efab866975ba6bdb1877f0594b52850a8df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725306, "uuid": "ffc0dd50-1162-40d7-a999-912b21e7c650", "value": "T1C7341B90B281FDF6EC999FB820D25309A3BAF0819719EB3B6624FE3C025EB54D473545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725306, "uuid": "2a18a305-0842-4690-aaec-62a671370db4", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725306, "uuid": "6820feb3-abe2-44a2-bedb-060b0962963a", "value": "3072:PBsVl7xAa4F0S+UtKnkpsT2c3KVuRHyBOiZPnZU2joyO74M:W7Ca42S+MKnkC2eKVuRHyQiZG2joyHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725306, "uuid": "aaceb0dd-7be7-42c3-b37a-21271493d905", "value": 241071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725306, "uuid": "91bbe483-0556-47b5-995b-44681a58384d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725306, "uuid": "db2ed354-5d14-4bd5-a7a4-816524457f74", "value": "c3c186ad8f38885608d9f5ae51e98eff34024090bb23f29111c58dab369a4360_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea95f6c-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724990, "uuid": "6cc86191-0fbc-4b7f-84ea-44762ed74ba6", "comment": "Malware payload", "value": "b7068c3cfb34c849341ce81022444f19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724990, "uuid": "e1d22787-3ce0-4039-a811-e4fb0e88af68", "comment": "Malware payload", "value": "c3d736d7c775fab7ea67bce29868ffc4d1f8f1b93e270625b7c6615f6d234a02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724990, "uuid": "291c7bda-1f9f-4ad3-a5b5-cdae055eb3a0", "comment": "Malware payload", "value": "7ce1a5e4d0146086b5b153fcbf2800f2125d3203", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724990, "uuid": "d5298611-a331-4765-828d-5f5eec9ad2e1", "comment": "Malware payload", "value": "3dfe4cb82c1989c4328d726691116366c6f98868f1eb5aa8bcf93d1f7bf5db5cafa6d47dd94fb8649156afc026fb6b76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724990, "uuid": "54a5ebc5-8087-444f-a1cf-bbd887d66d36", "value": "T114A35A47A2E641BBE1BB8638C4530A09DB76B8115720AFFF43A4465A1F273D18D3DF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724990, "uuid": "23d49708-a208-4014-b665-e88fbbf792d4", "value": "89a97c0efa41b17c5ccb77f897c17c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724990, "uuid": "5b24fa8a-16ac-4dbb-ac82-11b114d0011f", "value": "3072:VvbLzvFq70zdDlGqpQb0wzczUaAtpFrpqpqpvykTi3Ve0:pv470xprM0wzcgd70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724990, "uuid": "2a83700b-7042-490b-b74f-38a5be3a817c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724990, "uuid": "b7cb35a5-e3e1-4431-81ae-072bff50e520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724990, "uuid": "9aec9218-8f40-4761-9e24-f641decd5ac5", "value": "c3d736d7c775fab7ea67bce29868ffc4d1f8f1b93e270625b7c6615f6d234a02_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8265eaa2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725077, "uuid": "0e5411bf-34bd-484f-8e82-2770afd8437b", "comment": "Malware payload", "value": "2dbc3f9d404302dc5f4201a52ff0ef00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725077, "uuid": "dac463eb-a993-4557-8d81-4258dbb5141c", "comment": "Malware payload", "value": "c3edab607d8eaca4433eae265de68f9d4b16fc7665d1856bf72f471d049483e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725077, "uuid": "d6a7dad5-3794-4d24-833e-9484c25fbed2", "comment": "Malware payload", "value": "c715c9bfb6389f82d07af837a4f85249fa60a945", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725077, "uuid": "1db849a4-6af5-467a-8315-656a72e3d5cc", "comment": "Malware payload", "value": "4cff92001361313a95e191636abc643171a3da3257ce0421d888de3a19561dda822b36581384efc61cd1ffe78d0c62a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725077, "uuid": "b8735520-0b14-417f-b765-00a63bae56d4", "value": "T16BA35A5BB2A640BBE1B68638C8670A45D77AB8454761AFEF43A0425A1F233D18C3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725077, "uuid": "1e29108b-3d0f-4565-89e7-6137d1dc8be3", "value": "0fd9902150a10ebdcba803b76e55f48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725077, "uuid": "2b133bec-7bae-4552-b490-30748f2544ea", "value": "3072:FM7nphumaOQbIOA3Z9yerAOjzJoyfm2GgzskZpgyzfWHRzd9aiD8LcckVPxIiTsE:uphRMIOA3ZQe4WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725077, "uuid": "fc36657e-1457-4054-bb32-6e5e42404f51", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725077, "uuid": "8a128333-0218-449b-a93d-30531227d8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725077, "uuid": "5bbd76b4-8eca-417c-a6f7-736fb6b861f5", "value": "c3edab607d8eaca4433eae265de68f9d4b16fc7665d1856bf72f471d049483e5_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e3694a-3c96-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776675095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675095, "uuid": "278ae3da-95b8-4afe-87e1-b7a59d51c091", "comment": "Malware payload (SimpleHelp)", "value": "546704a14f7a05a3c57f165367cbafe5", "object_relation": "md5", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675095, "uuid": "77563323-3bd4-4db9-9fb1-55448d11cab2", "comment": "Malware payload (SimpleHelp)", "value": "c44d0a08559cff4685a6e23879f3dee3f7b722885deccbb9a25c842e760be8d4", "object_relation": "sha256", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675095, "uuid": "088c3154-3e9a-427f-8b6a-bdbb838ffecb", "comment": "Malware payload (SimpleHelp)", "value": "5c7b0799aba11333d3be6cb4222dfae18ba22c65", "object_relation": "sha1", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675095, "uuid": "a5d9a4b0-8030-4c22-beb7-a304d4017408", "comment": "Malware payload (SimpleHelp)", "value": "b0e4f5ca6802774e5ba3be03199d98f0b72a0d2230e750ae55626e826d17119ae8147cc6023d4b047e6c87aff9c62b2d", "object_relation": "sha3-384", "Tag": [ { "name": "147-4-218-66", "colour": "#984CA2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675095, "uuid": "e6c733fd-7a03-4775-a0bb-418d14747d68", "value": "T162873324F6E598BADF27D4BCC146C457BB9AB5A103C4022B13F1C5D64EA16904B2FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675095, "uuid": "7dcd7440-dd69-4efb-9388-d16e9099392e", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675095, "uuid": "027f8bea-427b-405a-97ed-8c07594a167d", "value": "786432:pEBQ9FQqqs25uju3MKDY2rvb75gz8v7RmY:pJF2TAmHv5V7RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675095, "uuid": "fb2e7ec6-a05b-49e3-8f02-f78281ab47a4", "value": 37511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675095, "uuid": "5de83456-6e37-46fc-a220-ead92883da85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675095, "uuid": "bf23d8b0-7fa7-47d4-9cd8-7779c48e6c7d", "value": "c44d0a08559cff4685a6e23879f3dee3f7b722885deccbb9a25c842e760be8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b33a2a2-3cd5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776702248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702248, "uuid": "157d937f-9b05-4141-9737-65532093447b", "comment": "Malware payload (AgentTesla)", "value": "f0968ad25786f590f7d3dc938a54554a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702248, "uuid": "ec9892df-980b-4298-9e28-ef09316c12d7", "comment": "Malware payload (AgentTesla)", "value": "c4b4a5a913174365cfb2bb814453af9072c9f2d52ff6da18acbd0692ad6a1bd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702248, "uuid": "e38157d8-eb46-46d2-bd37-bf28154483f3", "comment": "Malware payload (AgentTesla)", "value": "bedd708b9a70b4e8fbde527ac9d7c2b825d2f006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702248, "uuid": "0ec05e21-954b-4708-b971-877e21ee40f7", "comment": "Malware payload (AgentTesla)", "value": "44ddb56cfe5306e4886fd40a0c44b7744e6bcebaf1ab9c727c0e2934a608675bfdac7050e79bce27e8890ea514aca50a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702248, "uuid": "16edb2e9-689f-4da7-b05b-20f74c9ea8e3", "value": "T120247B4263F95648F5F70F88AA3B14219A3BBE6A1D38D42D16A8144D5AF3D08CCB57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702248, "uuid": "9101e06e-bb41-4abd-adb3-e2203348ab73", "value": "6144:yZxKv4Sa5b5W/wgMfnvINz35PA2q7n+pxvRjXj:Yx47stW/wPnIN75oJng5RjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776702248, "uuid": "98be1c4b-0ae5-44f6-8526-64943c2243de", "value": 213180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776702248, "uuid": "63605998-f2ca-44a2-bdf6-bf55c9e71447", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702248, "uuid": "46a8204d-7e65-41fe-ac20-afe9b3bd9886", "value": "TT COPY 8410122904 AND STATEMENT OF ACCOUNT FOR APRIL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435d8f4a-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776687605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687605, "uuid": "ac07ed8a-8cb5-4c37-883a-a07134da80c1", "comment": "Malware payload (SalatStealer)", "value": "ba6fde59249b07e6f1f87c67615c3fdc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687605, "uuid": "91e112cf-da2e-4aba-8197-7f7b5a223d25", "comment": "Malware payload (SalatStealer)", "value": "c4c9e9fba2ce105e0a1bd77893ae1384d0167855b95e96ced02ec7d22d51c31e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687605, "uuid": "70b7eab9-3c01-43b2-865b-b270852924ba", "comment": "Malware payload (SalatStealer)", "value": "006856e4bf59a0bf830f866689190d6ae0e29f4c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687605, "uuid": "fd05b376-ede5-4af0-8a54-0a7c89e34e6b", "comment": "Malware payload (SalatStealer)", "value": "c5310de5a49b98fae463effccac526630e9ea7b6bbcb2f501d4de796bce1d79c831858f9204d2ba4051af175f5952551", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687605, "uuid": "734149d0-1ee7-4039-8886-d126d268fa6e", "value": "T11F263312B9D5C8B1C8F6413808FC6B2C2BFE6A540F579DCBCAA0749A8ED15C1DFB1526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687605, "uuid": "9b60e50c-d48d-43c7-b818-c51ff90a2750", "value": "d3cd397a45cd3e1347abd3de762a37e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687605, "uuid": "614332b8-5110-4a33-9299-b0760ee777eb", "value": "98304:/R3rZMxSm8kRGnN8EgtY6a4PSuXKU1QfIyllkd5m:/VrZM78k+gxzFjwlkd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687605, "uuid": "5b6858a6-0787-41e0-ac79-81e6105991dd", "value": 4694528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687605, "uuid": "29023654-13ed-456b-b08c-2078c2db7026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687605, "uuid": "3cdd53ce-2699-43cd-af48-9bb4c21e9dd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828b2a77-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725936, "uuid": "929b7dc9-56c3-4d3c-a0ab-e4476a99ac01", "comment": "Malware payload", "value": "9a00bfd4a5c6a1ebe251907c6bfe594e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725936, "uuid": "e8a8e98d-b7f1-4b46-b195-b66adc2cf609", "comment": "Malware payload", "value": "c5619ff0944d7b99f9ccd7ee067df499366ba06ef4e00729dd88edac7290674c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725936, "uuid": "9e0fd9c1-e6a2-455d-bd7d-b0894ba4d0b5", "comment": "Malware payload", "value": "d3e603f8a2bd54365fdd16088742f3998928d3ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725936, "uuid": "178da047-7331-4492-a346-76fc0b6f4c86", "comment": "Malware payload", "value": "b87831b36c0e4647b405f8fc494064d920aee5906695eab6b18f69a0b724824d9df467f67ce4bb44020d927036157260", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725936, "uuid": "627c966f-61e4-4cfd-a2a9-300ef456246e", "value": "T1EBA34B5776E900BBE1B78638C9A70E45D7B6F81107619FEF03A4465A2F233E18D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725936, "uuid": "6bc21577-5500-4466-8932-35a5ce2ef77c", "value": "314abc9e3cbd7befb6945530d77e4a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725936, "uuid": "b3f78723-1dd0-4efd-89bd-03698a8a6cda", "value": "1536:yHABEZV7YQJgEKfUn3o/xuTHuSwQb4Arpu7y6skzw8EECHsWeqdR9dlRtk0iQD:yJHYQX9Y/xGO3Qb4AE7y6EzMwpjC0iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725936, "uuid": "622ef302-3bc9-4ac0-849c-4e5bab49cdcd", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725936, "uuid": "4086cfe0-30c0-4f78-b593-44576ed285ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725936, "uuid": "1114b016-8bc9-4daa-b661-334d1906968c", "value": "c5619ff0944d7b99f9ccd7ee067df499366ba06ef4e00729dd88edac7290674c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc72e858-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697686, "uuid": "32b9d5e5-4859-42dd-9249-e3e8ee601be8", "comment": "Malware payload", "value": "05cfa2439a4f75ee974e62f5ab4b2e88", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697686, "uuid": "9ec825d6-8d43-4be1-a2ab-5ce078fa2088", "comment": "Malware payload", "value": "c5c082f758c522548a1ac93767506f3f94e550665b18d6e79f9c2d55f3d048dd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697686, "uuid": "804bdf77-dbda-4896-b88d-6f32ecaee18f", "comment": "Malware payload", "value": "8c41e49b8a70ab60a9de680b95fb28d484fcccc2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697686, "uuid": "c8aa72c1-5292-4f74-a915-8c9d917bb092", "comment": "Malware payload", "value": "bb8968c61b9f611303714c00799b9d0d434c38411419e80c68c7cddfbaac23abc4dafbb77f5fe75ff1fb319f006da209", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697686, "uuid": "44e26b89-27eb-4b70-ae64-ce5d866e2895", "value": "T1695633305F940C6B0AE48735706F6F263FBE5D9B854CE1F64688B0D7268B781875B8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697686, "uuid": "8af87a47-d224-4167-a232-59ee42696ff8", "value": "49152:zOhcMj+GaNQPP2cfJMF3S5RknB30EisHpb4G2izWxzZhKCvvwdrPQ3kt9gbMbJdp:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697686, "uuid": "c39c1bf3-7814-4aaa-91df-540d714e2d51", "value": 6347619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697686, "uuid": "4ee0da86-e046-4d77-9038-a328139afae4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697686, "uuid": "5955ba3b-fd88-48da-82e6-70cacee7992d", "value": "015GYMR91680PNHZNctogmAdjnt_7917RM5QUOEP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f94f4-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776724959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724959, "uuid": "24a328c0-2bd7-4a22-8903-bfb1c1ea4db4", "comment": "Malware payload (AsyncRAT)", "value": "744ff1d49d322301c5558bb359651399", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724959, "uuid": "f462d5f1-0045-413e-aaf9-2a9c29219635", "comment": "Malware payload (AsyncRAT)", "value": "c61c5222e298bf632c0f701da32d74c1e2830a56e1baef37cfb8d212540c516b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724959, "uuid": "955262a5-a324-4727-a0bc-013dd610823b", "comment": "Malware payload (AsyncRAT)", "value": "a1002398fd47d8081b6053cb42fe81aaccae0eea", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724959, "uuid": "cc6f813b-ff93-4a80-bd8b-8dfc1a1923fa", "comment": "Malware payload (AsyncRAT)", "value": "f3b86600a5c3a347ec7c2a8ca218348cd8fc8417842cf3d5205d245ddfc13f46c1f400ea0584802b2b45c4eb11ef09f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724959, "uuid": "4aa000e3-9b46-4614-a243-79e4b84bc8b3", "value": "T1CA035C487B908221DAFD6BF51DB3A6430730F6038E13DB5E4CD492AA5F577C48E417A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724959, "uuid": "4ac6b3e9-e798-4dae-bebb-ef55051ad7a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724959, "uuid": "28e69345-3888-410c-964e-d2114555134d", "value": "768:5jrnY4DfiwCPcJ50guqZI9x7FWPr9Q55OwhHanHlg:l5Oc50gWFS9Q55OwlGHlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724959, "uuid": "4dc671f4-897d-47f3-b2e9-1e26c7367a3b", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724959, "uuid": "92c679bc-f351-49a4-9414-8bb019cb5751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724959, "uuid": "7348f72c-360f-4aca-ac5f-8ede88c24b82", "value": "c61c5222e298bf632c0f701da32d74c1e2830a56e1baef37cfb8d212540c516b_5d44cf8a-849d-4d0f-aafb-b02dab1c8584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47055fef-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727125, "uuid": "183d2e3f-8fa7-4dc0-a1be-dbc85555772d", "comment": "Malware payload (Mirai)", "value": "c47ef44a37aab3724bd86635b9324bff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727125, "uuid": "4deea53c-89c3-416b-8600-5860932da5fb", "comment": "Malware payload (Mirai)", "value": "c632bd71d56213672dbb094962b6072a54e0d8214e8b956352b58e74a16bce95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727125, "uuid": "a8b8a399-e107-4ad2-9459-2e8be540bce7", "comment": "Malware payload (Mirai)", "value": "65d3d705c0458fadadce0022cde5db85d6a57bf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727125, "uuid": "932ddac2-6a45-452b-881f-646e2b2855e4", "comment": "Malware payload (Mirai)", "value": "27eb8877858d7f5a9e16c5521eb136cf381c8cf90cc583f72c42b2cb49c49188b5b2ae3a14611b8c9bddec0218d39c46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727125, "uuid": "8fd8c0b1-3314-404a-8a17-b8de5f112f24", "value": "T157B33B46EA818B13C4D5177ABAEF42453323A714E3DB730689186FB43F86B9F4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727125, "uuid": "8b67f8fe-182a-4b85-b2cf-cdafc250dab0", "value": "3072:TogdvcIBoMZYk07B0a6UX4smJ5AM/939hl:EgdvcIBoXk07B0RUdmJGM/9jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727125, "uuid": "9d660492-4848-4933-8d13-95df623efcfb", "value": 114568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727125, "uuid": "316ffef5-f529-49a9-a0f3-c10e001d27f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727125, "uuid": "b60d8b20-bdee-4c10-8425-8a80a3d8be25", "value": "00okarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56a4280-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725994, "uuid": "694b858d-5dae-46d2-8653-cb6afe893c17", "comment": "Malware payload", "value": "3201f19c0bb2ddf430ae6da4d30a8cd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725994, "uuid": "447c1af5-08a0-4c24-b587-5efaf5b6a009", "comment": "Malware payload", "value": "c73947cf188f442bed228f62a3ba5611009fdc2f1878aaed7065db95ede05521", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725994, "uuid": "0ff816e1-e538-47da-861e-b9601dc8c78f", "comment": "Malware payload", "value": "9215d1233d6110b156480cc70d79afdf49181d37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725994, "uuid": "1b8b724f-3167-45cc-b82d-75831d7c8cae", "comment": "Malware payload", "value": "977e612310a647a853b38049842ec6179d4f0ed56659b571bb91cbf85002c0edae466e30573eece58274fbe786b6d66d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725994, "uuid": "9eef2b33-8943-4a0b-b5d9-6d726d48456d", "value": "T1FC341D91B281FDB6DC698F7820D25309A3BAF081971DEB2F6620FE3C025EB54D573685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725994, "uuid": "958143f8-ef0d-41db-af32-abbbfdcf6cfa", "value": "e2c01fb3adc4845e1ae802a2da8afff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725994, "uuid": "16410fa4-0b1e-43d1-b59f-5d0b81719a06", "value": "3072:yB0ckVPxIiT8Vl7xAaEt0S+0tKnkBsT2Z3KVuGHyKOiZPCPU2jJIB83kVPxIiT/M:K7CaEuS+sKnka2NKVuGHyLiZd2jJIbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725994, "uuid": "c0fffd8c-ca06-4651-b293-be00e4844840", "value": 243204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725994, "uuid": "ad579b54-b787-4679-b3c2-0ed7008a3acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725994, "uuid": "f8d16e6b-e1f6-41f3-9f39-3bb3a5d3b5e9", "value": "c73947cf188f442bed228f62a3ba5611009fdc2f1878aaed7065db95ede05521_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961c73be-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725969, "uuid": "0f464c77-665a-414f-ad8d-cacceb5a2bad", "comment": "Malware payload", "value": "2d088705b36e472e48c738491ee8c7c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725969, "uuid": "831d89d8-6248-4c53-8d8e-1e25e72c6aed", "comment": "Malware payload", "value": "c7a101df74544509c8ed89a724d83e38c19f1693541db5321eed61a881f730dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725969, "uuid": "c148281c-163e-4f84-ac63-2912d5353e82", "comment": "Malware payload", "value": "6c010a0751e9814f190d5c5288d7febcbd416464", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725969, "uuid": "8bb33af3-52d5-431c-b153-4636f54baf1a", "comment": "Malware payload", "value": "84f559b3ab48dac939432624db9494e58e066b8b11865d2676c6061225aeeffa16e346690e199caa88749ab267b47e9e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725969, "uuid": "992b2a35-15cf-43d4-a61e-1221e2c882f6", "value": "T1C5A34A5B76E900BBE1B7963888670E45D772F81617619BEF03A0425E2F633E18D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725969, "uuid": "e63cabac-285f-44c5-b006-b7cb1cabe142", "value": "6dd2ca0664df6012dcfd465505baad50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725969, "uuid": "f705b5d1-0b93-4f67-b202-5b1803605c3a", "value": "3072:asAwoPt0PRG7nQbwAwZDuf+0PpgqOOAlw:bol0pAMwAwZS/qhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725969, "uuid": "adad6857-80d6-4530-bbd9-b9a215266656", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725969, "uuid": "57cd08a8-583a-44bb-8dd0-5ebf14bc3622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725969, "uuid": "7e46407a-0305-4f82-9649-9bf68e0b23ce", "value": "c7a101df74544509c8ed89a724d83e38c19f1693541db5321eed61a881f730dd_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0843f9af-3c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776647133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647133, "uuid": "4a36b447-7773-4b89-8e7a-41b120c87fc4", "comment": "Malware payload (Smoke Loader)", "value": "f467913f2804676632ab82f9d3f46755", "object_relation": "md5", "Tag": [ { "name": "pw-8871", "colour": "#6F7328", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647133, "uuid": "34013bb3-c625-48e2-99fd-a2193a6aacfc", "comment": "Malware payload (Smoke Loader)", "value": "c7c506ed3e073c24a1e9999dfd6c99ef6f1eb37878d0055d5710445280feac46", "object_relation": "sha256", "Tag": [ { "name": "pw-8871", "colour": "#6F7328", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647133, "uuid": "9adffb40-cec7-4a26-9437-ed57a5207133", "comment": "Malware payload (Smoke Loader)", "value": "5cad02b6ef9b8a0ce8d072dcdc864c2315671183", "object_relation": "sha1", "Tag": [ { "name": "pw-8871", "colour": "#6F7328", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776647133, "uuid": "da3c63ad-665d-42ad-a9aa-cd76555f1c4e", "comment": "Malware payload (Smoke Loader)", "value": "fa63f577909d5164d9387bd44b81d3e123dd21198ae08af9645d16be4e88b2c797f079d78899eeefe371d10767633195", "object_relation": "sha3-384", "Tag": [ { "name": "pw-8871", "colour": "#6F7328", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647133, "uuid": "8fa0c78f-8152-4909-a011-e1bd4b49e768", "value": "T1E50733EDB94E5C720F635A3BF0916E04867C3A479F6B65665D6CC3C172FEE838802684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647133, "uuid": "c4175221-c71b-4f9f-8fa7-61f1de1295a1", "value": "393216:zRRHr9MghM5FsITF3IJ5tK9J/xvTjYDFvLEwBwyZN1EH/VF6SjPQ2alu:zPHBhMv5IJ5s9J/xvTjYDFvLEwBwyKHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776647133, "uuid": "d6a08979-ff2e-499b-8263-147b6b5ba4af", "value": 18240030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776647133, "uuid": "62c4d6b3-19a8-44b5-9acd-8b83761049c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776647133, "uuid": "38bd3526-13fe-4405-b292-4ada8db1db80", "value": "CS2CheatExternal-4.3.7.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76289eb-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725595, "uuid": "5303120b-eac1-4e6b-a525-94966432b94b", "comment": "Malware payload (EvelynStealer)", "value": "df1e311b0fc6441fc11aa77b7666dfcf", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725595, "uuid": "c76279df-7546-4388-8d19-c1b39f747dc0", "comment": "Malware payload (EvelynStealer)", "value": "c82762647dc8ec40838013752ad4ba14a9a203368af3edfc2d5e8774034f4a6d", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725595, "uuid": "e06c614c-2185-479f-b9c0-839037125ba3", "comment": "Malware payload (EvelynStealer)", "value": "502e042af677919eda3750d9976247455ebaab9d", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725595, "uuid": "2b1bbac6-6b08-4480-bad5-11a31978350f", "comment": "Malware payload (EvelynStealer)", "value": "b0d73a57cf23577e61a7ccf8e99598f830bc1309280d8d110ac4b1b2e378647a52e9f9084f068369901d3008cc00600b", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725595, "uuid": "68c3699a-d554-461d-a90c-970562a1c764", "value": "T139F30902B39720ECE577D1345ABBE133BA73FC654630A95E65448A383E11F50BA78F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725595, "uuid": "198dd0f4-b431-4c40-8069-ef14d9e2234c", "value": "a16132b8d2b8418962a45133e6f73326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725595, "uuid": "08b634f3-8b2b-4372-86ba-25c9d9c946c2", "value": "3072:2ER8njmuYv15ostIyzv52deTP/NSYXXFYw1giCh:h8njm992sm22deL/jXFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725595, "uuid": "8b5b1f95-b6f5-4346-85f9-61dc5306fdda", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725595, "uuid": "5f244d06-5d8e-4b22-82f8-413492a9b122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725595, "uuid": "a027536b-5ac9-4aad-b210-973862ba38a8", "value": "c82762647dc8ec40838013752ad4ba14a9a203368af3edfc2d5e8774034f4a6d_d8f17512-f1d6-4a13-8e32-1b3991991ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2367d16a-3cb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776688410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688410, "uuid": "0e131f41-5f3a-4e21-bc57-a3ad11e21aaa", "comment": "Malware payload", "value": "a1a33ffb129bbda9bad22fa761b3a428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688410, "uuid": "41d68d09-ba29-4cf3-a708-576900831319", "comment": "Malware payload", "value": "c848ca9fcb7ea125bd71410885b7bc602b78b49712cd8b0508e6f6a2542f1940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688410, "uuid": "1c49736a-c27c-4147-84c6-a6358cb3211d", "comment": "Malware payload", "value": "c8057290e5ca1cdbbd2aa390edd7a6709a8ebb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688410, "uuid": "78cf91b0-6521-45ac-915b-f2e2d1f4282c", "comment": "Malware payload", "value": "c39f4679cf736eb8b7a610983578dc81be6b05bf6e32d5733ccee950309c85225ad84dd6b96f6e018050821166edb20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688410, "uuid": "a215dd45-92c5-483f-9390-a833ffb34eca", "value": "T1B95376A0AB67756A3A2A234438D50CAB4D384F4523112567524EF7FDFD4EE120BCE2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688410, "uuid": "9c662581-d8f3-418a-a746-47086e5689a5", "value": "768:AVirIe3pGXy73zAgogoyG088SMG6vrWsB:AVirIyGiz8gqMasB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688410, "uuid": "8cfed3c9-fedf-4686-878e-df001ac1f961", "value": 65859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688410, "uuid": "05cb01ae-539b-480a-b2f2-0d3087943dde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688410, "uuid": "368967b4-7fe1-4cbc-bc05-b68241799ba0", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dada76-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724895, "uuid": "7bb22af5-8353-4ad4-84a1-9a3d1b213c42", "comment": "Malware payload", "value": "53c9c2eb086fe4601a2fe68885d07382", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724895, "uuid": "947a0379-a2d7-4b87-85d9-e8c3e20c1033", "comment": "Malware payload", "value": "c84fe6f7f5daecb3a28fb2c7f30e427ae31c8f56895e20f22526c8a21c264fc8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724895, "uuid": "4e484dc3-cfec-4e68-9f24-a2b079d72a8f", "comment": "Malware payload", "value": "c83b7a59406f837f47e37699f44ff8bc5de06179", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724895, "uuid": "b627fa3c-6d1e-494e-9fc5-75c8a8b555cb", "comment": "Malware payload", "value": "55f84fbc10b274c8426680cf5d1eb7667586021818fa9ee00c36c433615fad1edc71f204cfb06bd6173d079492397a2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724895, "uuid": "29e94c51-5407-4ce8-8b18-a538d6bf8046", "value": "T19CB35A57B2BA10BBE1778339C4670A45E772B8514761AFAF43A0469A1F233E09D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724895, "uuid": "34ce3fe0-7d4e-4422-945d-accb1f8359fc", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724895, "uuid": "bf1ec758-22e9-4ec1-be43-cc477530b5b4", "value": "3072:4iAlEjbNhpPnvgCBhhVQezDZ4C9x5q9EG:AlcrtgyRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724895, "uuid": "83a9c790-1de6-43e6-8493-d6e3e729de90", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724895, "uuid": "ff26a394-24f6-4d6d-9980-262f200ed744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724895, "uuid": "4981ed26-47f4-41d3-bd5c-301c21e9bd76", "value": "c84fe6f7f5daecb3a28fb2c7f30e427ae31c8f56895e20f22526c8a21c264fc8_DWrite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79e007d-3c5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776650460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776650460, "uuid": "1c0b711f-2372-45f6-94b6-031025569cfe", "comment": "Malware payload", "value": "323378b146fe03c8f53c5b4b54e807c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776650460, "uuid": "cc07e3c5-3fb6-4612-b0d7-cd80333c55bc", "comment": "Malware payload", "value": "c88e1dacce96cafa2038f7433fc9e42e7b26714c36e98ed59c483360a4b7cb58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776650460, "uuid": "4ecf13ec-fb9f-4e88-b218-3bd1fcd1e37c", "comment": "Malware payload", "value": "a5476ac08448c62b13a98f6dcd3f510ac14a0a2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776650460, "uuid": "a5101a94-22c9-4b49-ba66-5e6c12c3dfd3", "comment": "Malware payload", "value": "4d9a338df9dd305ca7b4d892c254f6da1b089b15c097b3358f9ba16f0401cadf1445d70dfd289ab683ed76c4e6a50786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776650460, "uuid": "5552782d-c29e-4c2a-b3b2-81fc5c22bc79", "value": "T160E4F757A89550F4C1FEE134C666A213BDA13499073427E72FA187F10B26FF86A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776650460, "uuid": "5c1aa594-0270-441f-b86c-b45abb24c241", "value": "12288:ciZLBtBn77RD3w2AJK7g9rb/TBvO90dL3BmAFd4A64nsfJEGF0k:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776650460, "uuid": "f8c243fa-25e8-4ed6-b11f-21705583eda3", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776650460, "uuid": "653c34a4-8fde-4dac-a929-4ba3d98048a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776650460, "uuid": "0cb0c38f-a19a-4614-973c-2ae55f3acfa6", "value": "c88e1dacce96cafa2038f7433fc9e42e7b26714c36e98ed59c483360a4b7cb58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3c8894-3c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776645021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645021, "uuid": "2ba9cd50-9a92-4f80-b39d-4fab4d235027", "comment": "Malware payload (Vidar)", "value": "10cc721560d084fe0330089b068a2f4e", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645021, "uuid": "1ab1fbb4-9514-41c2-b667-2d0f7cde4cbe", "comment": "Malware payload (Vidar)", "value": "c8911d6381a1556effbee662943551ef3685fa115f1121c4c378f2ac6d3f9cf1", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645021, "uuid": "86722868-7f1e-41ae-8c9b-2809f49b627c", "comment": "Malware payload (Vidar)", "value": "af2eb8bbd8a526f8f05852553423770db3e60584", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776645021, "uuid": "940c1673-dada-4a83-87b1-1806b0c4237b", "comment": "Malware payload (Vidar)", "value": "3ac9abd7e7828066d4dd4f47ce4f80ef00e31854157b0730fb202381a59b57d6edd18538d215528dbfd66df6378b2d44", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645021, "uuid": "e8cac5b5-b8c5-42f2-89ca-1df2a5b6a3f2", "value": "T146F423A6C6C1E8E9D806D0BA7F4F41BFED519DE5192AF21F6D78E04034090B2BD1B6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645021, "uuid": "50fc50bd-65ff-47a3-a498-e463af7cc2aa", "value": "12288:8h28sP8d930JXWZGhxVJHps5JKMDUfowlleNO8Lcu6c2578L8s5skzViQjp0u:Es20JIGrpGJ5wlwNO8wb5n6s2i20u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776645021, "uuid": "8f3d5c3b-1e3c-4804-98d5-2f276d3bc4e0", "value": 766500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776645021, "uuid": "fb1bfc79-9219-4f05-baf9-273f251eff11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776645021, "uuid": "2be59723-fb53-47b5-8031-0ce06a675042", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e448c-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676450, "uuid": "d7cefb46-7ac6-445b-aaa8-87a375a987f7", "comment": "Malware payload (ConnectWise)", "value": "036b730ddd91310e2607aad9a3ce9ff8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676450, "uuid": "94b6c6eb-bed3-4ab9-9f6d-c12af232a563", "comment": "Malware payload (ConnectWise)", "value": "c8de7e0162e459b2cfb2c85f5e5ff554f1e70eaab8fa58a9fd5afbc93fbef969", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676450, "uuid": "8656a72d-674e-446b-bf5f-54616a58a9c0", "comment": "Malware payload (ConnectWise)", "value": "5450e548cd7f05067d9314e21435934fa9e9c72c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676450, "uuid": "b9c95e1e-10b5-403e-ae7a-cb4983e53442", "comment": "Malware payload (ConnectWise)", "value": "8b81f439a249e2327604c951e3d9caa4aafb164ad2fec8d24b396a96cdaa6f541469fc25edb8139963231f6df287a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676450, "uuid": "4686e40c-9dd9-45c2-a444-de2dc36c8581", "value": "T120D6232523FD405AF8F74A79FD3682E46D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676450, "uuid": "b2131bd3-ba30-498a-8bc2-e60f0ae0dd4f", "value": "196608:bWh0cGweWh0cGdWh0cGIWh0cGaWh0cG0Wh0cGpWh0cGm:bWaccWacsWac3WacJWacVWac2WacH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676450, "uuid": "1b930d82-e04c-4f2a-8915-4f259b796b14", "value": 13361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676450, "uuid": "67751532-2ddd-4bc6-ad99-7e1f67f71684", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676450, "uuid": "4671e540-f3c0-4b2e-a183-cb2c6ab108ad", "value": "c8de7e0162e459b2cfb2c85f5e5ff554f1e70eaab8fa58a9fd5afbc93fbef969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa71536-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724876, "uuid": "f2ecae9d-f8d0-42c2-af8d-ea27bb4f9df5", "comment": "Malware payload", "value": "0942693aef91fbd9757ecb55c8a53636", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724876, "uuid": "666bd7b0-1101-4ead-b740-671ae9ea209d", "comment": "Malware payload", "value": "c8e333d219ef97b7cf0b03dc8e9dd9c71083abb351f659a4f6e4f09fcabe9145", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724876, "uuid": "ee112ca8-916b-4e17-8316-27d252cdbf48", "comment": "Malware payload", "value": "88cb0a7531fd94ce2250ae2a9136a87b991131f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724876, "uuid": "db12142d-b108-4b9b-b81d-3ddccc3ea418", "comment": "Malware payload", "value": "2f0da01c1293cab1b5cba271160688ac1b7cca58db5d6dd6a68fcb7bd99f8a053d9a58ff39b5eaa26a174123d7ed20a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724876, "uuid": "f6d68d8c-78aa-4e3b-9b43-38d36b0c508c", "value": "T152A3494B62EA00BBE2B78678C4930A49D772B85557619FEF03A4421E1F273D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724876, "uuid": "854dee2a-be77-4b40-a680-5553f67bc281", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724876, "uuid": "906784a9-ed4e-4279-92cd-22f8721da862", "value": "3072:B3WHVWRRWAo2QVAChQNwvrXT/7nM4L3zm2Q9ZVbZacTihsrH2jcv:tW1UIE4ACh4diI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724876, "uuid": "880296bc-fe82-48e4-b994-72006bdc1fe4", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724876, "uuid": "776360f3-cc16-4194-bc18-33c8a40de7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724876, "uuid": "1e70cb40-bb0e-49ef-87c0-af8574e9bb6f", "value": "c8e333d219ef97b7cf0b03dc8e9dd9c71083abb351f659a4f6e4f09fcabe9145_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee19b3f-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725796, "uuid": "0ee64b96-5552-48eb-ade7-3e1bad53c068", "comment": "Malware payload", "value": "d2357c11c2a50c3bc98ca2f3f4c6ef65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725796, "uuid": "5e87245b-7402-468f-bf14-37a0b5a95440", "comment": "Malware payload", "value": "c94e1178c6bb0a504e0c0502ad1eae647cc9e33064784220413050bd95adbfed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725796, "uuid": "bc1e87f4-197f-4021-97eb-ecd1cc9664ff", "comment": "Malware payload", "value": "515b3bc7a88db1619c06366e21b7a7b2c2bf7070", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725796, "uuid": "de527130-37be-4368-9079-08cf270a0d9c", "comment": "Malware payload", "value": "6c163ef4013ef4025921e1195ce3af4ddfb0431d8f54e2a7ee305d16b9dbcd562aa2403f5b63fdaa5c61517924c2f003", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725796, "uuid": "286f4c79-9861-41b9-975d-af2d6a79059b", "value": "T175A34A5762EA10BBE2B78638C4930A49D772B8511761AFEF43A0465E2F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725796, "uuid": "c50b36b3-1819-430b-b67e-ff8059943fcc", "value": "ca2cc89d744b30b4fd945d67c7483af6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725796, "uuid": "517355cc-99c8-4c29-9ee5-fedf72b09b0b", "value": "3072:iKvXPgNZIPFA1cQ6pZ2ahqSvmSOo2iePG3ufWC+vr//T/7nM4L3zm2Q9ZVbq+b2J:LXPe2NPbpZ2OqcYOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725796, "uuid": "a20f8a87-9d37-40a0-8264-ddc062c1abb3", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725796, "uuid": "7a7cff97-93e4-4995-826f-cc10bf886be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725796, "uuid": "d0a16664-5a19-4afe-8944-01a3934dea41", "value": "c94e1178c6bb0a504e0c0502ad1eae647cc9e33064784220413050bd95adbfed_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60de9847-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776725020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725020, "uuid": "72dbb99d-7840-4277-87ba-283a9ae8aa70", "comment": "Malware payload (EvelynStealer)", "value": "fb709c921303fa462173b911482036bd", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725020, "uuid": "0f7592f1-c33c-4828-ad00-3de417bcaeaa", "comment": "Malware payload (EvelynStealer)", "value": "c9a44c6428fee879e59aa212a95c316e508b06775e2fccc690ae2acbc94493c7", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725020, "uuid": "57590b57-46e6-4b7f-84cd-9c5036946b83", "comment": "Malware payload (EvelynStealer)", "value": "0b12919052cb83fab315e8ec7352d131600a0792", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725020, "uuid": "7271e096-b39a-44fb-ba59-9934cfa0b1cc", "comment": "Malware payload (EvelynStealer)", "value": "bda504eca165f2b0ff01ff7f76555c5dead718cb4ca316ba5e45adfd7f43e3af8f2937dcadbf3235e19ca1f36500e946", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725020, "uuid": "e26a35a4-fa24-412d-87a5-63d28a492f3d", "value": "T19AF30906B3D720ACE677D5349ABBE133BA33BC654630BD1E65548A382E10F50B939F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725020, "uuid": "bb7c1fb7-692a-46fd-ba7d-bbf3751d5d1f", "value": "95e7d34416b53e889ee2c3f9fdf091f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725020, "uuid": "fa52eab8-6933-4d7f-a915-720a4723d993", "value": "3072:C68YsG7o32H1HJw4PZsilqt10qoHcnZw/giCiT:C68YsG7o+u4Pu0qLocnQVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725020, "uuid": "674dd0dd-c487-4274-8e44-605260d25f5c", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725020, "uuid": "23ea9de5-e538-46b2-880f-632d3947fa4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725020, "uuid": "75fd5656-a2d4-4686-8277-85705ef02464", "value": "c9a44c6428fee879e59aa212a95c316e508b06775e2fccc690ae2acbc94493c7_e602c3d4-3e49-4da6-a0a2-21dd48ccbfff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6fc047-3c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776670009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670009, "uuid": "b1f72041-f8c1-4a4f-ba99-d2a30d7c5dcf", "comment": "Malware payload (NetSupport)", "value": "be9fa54db8a3205e2c5c7fa6ac655e7e", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670009, "uuid": "c59b4a12-0908-4be7-8964-bb1f04b4a93a", "comment": "Malware payload (NetSupport)", "value": "ca25b2b24fb937ca722f2adb158dd10975c8b0223dcc96c99c085da76ecda571", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670009, "uuid": "60af586a-707f-4367-8792-22d0f8faa6d1", "comment": "Malware payload (NetSupport)", "value": "05ab6e39b4212c98ca3fd044d45a9dd9bfa3a8d5", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776670009, "uuid": "74bb2ab2-031d-4103-9019-67d794844f6c", "comment": "Malware payload (NetSupport)", "value": "eaf53d38f1c44c7d9d299d8a18a9e3103e726381202ca3a433227f6175d59da6abad7c15fbb2cd0ff6320b3acefb1778", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ZevoroTech-com", "colour": "#AE094B", "exportable": true, "hide_tag": false }, { "name": "zevoroz-com", "colour": "#A87317", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670009, "uuid": "1949a770-931a-4a2f-8cc4-78a325ba55d6", "value": "T13BA2D130AB7CE265EB5C4AF3B6DA794D8FF850585680428AE9CCFC060A4FADF1156178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670009, "uuid": "b25cfe64-4a72-4f4c-84a1-1a74d8c225d9", "value": "384:kXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5N7m:kXKuqXS69Szi/urdMt5lBUeuhJrsRxLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776670009, "uuid": "8e4fb3a1-c81f-4c83-9e5d-4f4a829bf90f", "value": 22143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776670009, "uuid": "799cd023-a419-45d5-8752-5016daeb3b41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776670009, "uuid": "00957543-3093-401b-8645-27e28051a246", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216494ff-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676810, "uuid": "4a82eadd-039d-4506-9e8b-18bd5c1921e3", "comment": "Malware payload (ConnectWise)", "value": "20227b6e8b4b29587ca4a2b1cba1541a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676810, "uuid": "5d5d1c41-77cd-47e3-87ae-3d17ee7f5ca7", "comment": "Malware payload (ConnectWise)", "value": "ca37079aeac04ca361e48d38e7bd252cf623cbe29f77b3fdde85ac5d9744cd60", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676810, "uuid": "b7a3924f-1f1a-49e6-8afb-306c55514493", "comment": "Malware payload (ConnectWise)", "value": "993522af28da2ee41446381979ba6f4aed151e82", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676810, "uuid": "593f774e-a444-4e27-abef-d58a96222b95", "comment": "Malware payload (ConnectWise)", "value": "5ee887593d9b1c078f16da12db9147e9315812df016dafc4a18d47eaa92143bbbca80b69d7fe07884ad5fba7a776bea4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676810, "uuid": "3b774671-06bb-4ccb-a2e5-fbb57eb10ad9", "value": "T189836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676810, "uuid": "84a67e7f-38e5-42ad-87aa-06c065a0d43b", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676810, "uuid": "a8a3d71f-6526-4dc2-be69-76a3440aca50", "value": "1536:poG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYp7jJx:zenkyfPAwiMq0RqRfbaWZJYYppx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676810, "uuid": "a02a087d-beae-467f-a0c5-ed49c5a91125", "value": 83336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676810, "uuid": "7296ff29-82c7-4cca-a9e1-b5a635e7fc86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676810, "uuid": "a37ef2a3-4c64-4217-8976-bd2cfb86fa03", "value": "ca37079aeac04ca361e48d38e7bd252cf623cbe29f77b3fdde85ac5d9744cd60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d533d0be-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676682, "uuid": "890c9a09-f069-483a-99dc-020f79dc2874", "comment": "Malware payload (ConnectWise)", "value": "fd7e692c80c0320baf6ea53f6a197f26", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676682, "uuid": "c444fb45-de19-44f5-a2d7-e1531c120f84", "comment": "Malware payload (ConnectWise)", "value": "cad4f9a28f346d1f39b466bef406888e4c56f4ee43f54e1980c7dc88670e2f25", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676682, "uuid": "bc5d6eac-00e1-48bd-bc9a-cff447150d81", "comment": "Malware payload (ConnectWise)", "value": "2db054a8c51235404f6e5d136a0c4f06f0a7d56d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676682, "uuid": "fca4fd9f-b66c-4f62-84e1-2e104a5ae8e6", "comment": "Malware payload (ConnectWise)", "value": "3f018c4f7c1a94ff9f63a1d96712e31a2f711b56aeadcc06844870626e45da39cf26950fa7b2dcba7afb8704d042712f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676682, "uuid": "5327d4fd-5c85-42f3-9454-595e1416afc3", "value": "T17D646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676682, "uuid": "d901c247-eac6-4bf7-ab13-efc7764e3941", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676682, "uuid": "aacc302d-427e-40d3-beba-aedfb2adb50e", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9uC:h1iw7gryNkSV1hy1Z1u2JLI9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676682, "uuid": "0f07e99b-7c32-46fc-87b9-e93b5da26bf1", "value": 312720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676682, "uuid": "22eb1b55-896d-42ae-a236-46ea79aa5d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676682, "uuid": "4101de02-c24a-4bb6-ac67-a4c8c1afa8bd", "value": "cad4f9a28f346d1f39b466bef406888e4c56f4ee43f54e1980c7dc88670e2f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7e7177-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674062, "uuid": "bf66b3a4-ed5c-44a3-aa09-68a39326e78e", "comment": "Malware payload (ConnectWise)", "value": "48c9782c5eb8ad089a49180cea5aecfc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674062, "uuid": "e8ac54aa-4892-4883-ba7a-3688971cdb7c", "comment": "Malware payload (ConnectWise)", "value": "cb04a8a6904ecf3b5bcd60b712451277aa11567a177764495ed822e68b021e7d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674062, "uuid": "38ea1106-1201-4d53-9bc8-04dbc404d7ef", "comment": "Malware payload (ConnectWise)", "value": "242bc410ebbe819b9c0ab023670e8f9ab66cf00b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674062, "uuid": "16efa8a3-4c6a-4fa1-80f2-733d6f6d9ee6", "comment": "Malware payload (ConnectWise)", "value": "bd085f68011842566b7dab400fe9b7f584378830d642fd175333a2e834f6b07ff909e1101a3f32b82fec748303246a57", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674062, "uuid": "b0364fdf-4c2b-4f83-8316-2c6845298222", "value": "T1F6D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674062, "uuid": "f93ae578-753b-479f-a05a-09ff6ab56e56", "value": "196608:0Hxcp9ym3nltDUJViHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3uHk:SGplpNGp7GpHGprGp8Gp8Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674062, "uuid": "a77b2d3c-c7e8-4109-a9c1-a418d4e0c220", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674062, "uuid": "8bcacc5f-6485-473f-b229-d5b92be90891", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674062, "uuid": "01174689-c04c-40f2-adc3-e15d7e50f713", "value": "cb04a8a6904ecf3b5bcd60b712451277aa11567a177764495ed822e68b021e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec46559-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676511, "uuid": "8ec6e89f-d345-4318-a8c4-9b631a4edf81", "comment": "Malware payload (ConnectWise)", "value": "9bdeae232519af211bc0f635afb18716", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676511, "uuid": "8a856d33-7181-41d4-a19a-8a85719acd55", "comment": "Malware payload (ConnectWise)", "value": "cb626dd3b91409c5471f4ab3918e3bdc394197d1824e0dd3a15805a11e7cec94", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676511, "uuid": "7dc3ea17-3872-4ac2-b053-5d503746b2df", "comment": "Malware payload (ConnectWise)", "value": "a3adc2942959b49050c5350257dd0c27f42fc0ec", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676511, "uuid": "8cc9c3cd-e3fc-4050-803a-7b55ec31afb8", "comment": "Malware payload (ConnectWise)", "value": "74e28b292a1fbbeccd87a32662d8101dda82b44b87817eb2db9a70f3ba171e54349b5958780025e259e05f522e6a1a51", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676511, "uuid": "febd6f59-1e48-4cc1-af61-5adbfdfa5236", "value": "T1C546F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676511, "uuid": "6bab16a2-5c17-4ef0-9884-c27b182bad25", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676511, "uuid": "61876afd-51c5-45c0-b4a3-5c6e55e47529", "value": "49152:0fRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:Yqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676511, "uuid": "805c7bc0-ed7a-4b7c-add5-66b89890b14c", "value": 5649192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676511, "uuid": "78f2854e-f580-4e3f-aa18-c81fdbfc1b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676511, "uuid": "66392fbd-2bcb-4464-9e86-09911ad5893e", "value": "cb626dd3b91409c5471f4ab3918e3bdc394197d1824e0dd3a15805a11e7cec94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc37e7d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725690, "uuid": "75b5bed1-b599-417d-a5de-3c61d27409fc", "comment": "Malware payload", "value": "4d5b5384d09b735299143d49b8397b80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725690, "uuid": "c6f308ba-a0e6-470f-b42c-2afcfc5662d6", "comment": "Malware payload", "value": "cbbb25a03a664e156ca5237b3f5b0d431ecf98ee978cc85a336369eeabd7c1e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725690, "uuid": "383f60f3-5fc1-4898-9946-bc413c206e87", "comment": "Malware payload", "value": "7f2195d41a56bd7688da1adc68dceaccad25c3e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725690, "uuid": "c32de4c5-bf04-4cf4-8c30-8bfd87e9330e", "comment": "Malware payload", "value": "e18a173d72c686579230c168b38a69f2ef0162f555007064296a2fb7d24d8b48b22b83f5d584dbae9405990e148007f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725690, "uuid": "41459b92-5b8e-4a84-9e7f-be00dcc7ab93", "value": "T102A34A47A2EA00BBE2BA8678C4530A49D772B8551760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725690, "uuid": "f8b7abac-0d21-4616-8d81-8a36a0c292db", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725690, "uuid": "20f053ae-42af-459a-b27e-e166fac46b49", "value": "3072:84TeXQwDasaAmiTQhAS/xYN0s51756565rnIryHe/CCQK:TeXbuFaTcAS/0oV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725690, "uuid": "562173dd-e6d3-4336-a829-dcc7332f107e", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725690, "uuid": "66c2fddb-e9e5-4591-9268-645cb8bb62c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725690, "uuid": "6e12fa39-1e8c-4110-9896-d4d893fab32e", "value": "cbbb25a03a664e156ca5237b3f5b0d431ecf98ee978cc85a336369eeabd7c1e7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aec094-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725376, "uuid": "eb9c7b76-9562-4aad-9c09-447fca62a704", "comment": "Malware payload (RemcosRAT)", "value": "e130824839afb594b573fdba78370160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725376, "uuid": "d8c3dce6-c0aa-428b-9c32-eaafc1cd4223", "comment": "Malware payload (RemcosRAT)", "value": "cbe62f4d3ddb9b3f625ec6315af402036832efb2f90640e5a7def913b9e79378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725376, "uuid": "2ce05105-86a7-4272-9314-93e26f41b232", "comment": "Malware payload (RemcosRAT)", "value": "3d6e52de103cbcf472f0465c14355be6472b739c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725376, "uuid": "6bcce77a-aa26-41b5-bc68-b626f0bbcb40", "comment": "Malware payload (RemcosRAT)", "value": "c2ad075b84a4d1f6da1b7476e32d0be8569d401ee66a03e32225d2eaadf96e95266c69d6a54c2dff569cfd019512dc27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725376, "uuid": "3a72cb5c-116e-485e-8290-1a04c6d4e286", "value": "T121D45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725376, "uuid": "f7de05e4-f888-4fb2-b0fa-2486e1acb211", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725376, "uuid": "52c570ba-c331-426d-90ad-244eaa04f633", "value": "12288:GSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr9:LGuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725376, "uuid": "a29b05e9-1de2-48cf-bc92-8ea4e863209d", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725376, "uuid": "1e4953ef-5d16-41a9-a997-506699a6c57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725376, "uuid": "5aefc567-6d06-4ac3-b847-66bb835126e7", "value": "cbe62f4d3ddb9b3f625ec6315af402036832efb2f90640e5a7def913b9e79378_7a830eef-663f-4661-896f-faa403243c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8d87f9-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724902, "uuid": "3e6c0dba-0a56-4f3b-9032-f51548d12304", "comment": "Malware payload", "value": "cc1b1979c20f8e6946a6abcf1f9977e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724902, "uuid": "4219bcd6-6435-4196-a424-e41ec113bfd2", "comment": "Malware payload", "value": "cc26c623a2b6e72ece95981eac73c89e6ec8d804290152ce34561ad14f6a8615", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724902, "uuid": "6e216a25-9c03-480b-a872-7e84953f30d9", "comment": "Malware payload", "value": "f33aed9ea287a2213307b42e54ee9c8364f523dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724902, "uuid": "b5c70e2d-da26-4048-bf1b-26edf7425462", "comment": "Malware payload", "value": "8ed1736c9027bb95e8d41ca1eaf718f5b1aa17b4e0ec64b94de0e87d1dd49ea41494ddba20ca5b3041790d14fd431ae7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724902, "uuid": "85fac12a-6916-4e07-a3e2-5fb7b1a207f8", "value": "T1AF923A0AE787A4BDC916E2F849FF1B33B075793215359F6F2324EAF94F41940526EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724902, "uuid": "e156ba22-385e-4cdd-ad64-59504a395424", "value": "b363afacecba727a8297cb88b97804b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724902, "uuid": "653dd5a9-19b3-4de7-abb0-c6ec02d77e14", "value": "384:kTm19Q3T3JlIqpHGYuwvA6Bh6mckVPxIiThpMMMqWLXNln:ki19Qj3H5zuEYmckVPxIiT/MMMBbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724902, "uuid": "8ce66778-2ed7-4fdd-86b0-1fb9992f6425", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724902, "uuid": "45d9bad2-a4fc-4d1b-9968-0f3e4f91c5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724902, "uuid": "5de3a23f-6de0-4faf-a755-27e44f081439", "value": "cc26c623a2b6e72ece95981eac73c89e6ec8d804290152ce34561ad14f6a8615_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f50877-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704844, "uuid": "82c6f4ba-0e1d-4af3-91f3-e2dddc199fcf", "comment": "Malware payload (Mirai)", "value": "86f9de9aad81e9ee3e7ebac16f2c6c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704844, "uuid": "ea71ed56-2fe9-4872-b067-aef7899c18fc", "comment": "Malware payload (Mirai)", "value": "cc67085207ae331c7cbb7738c7561e4abbeceb3ed3cc58c9c1b8d0288fc0893c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704844, "uuid": "844a2370-5c9b-4a2d-8747-5cfd8ac5cc67", "comment": "Malware payload (Mirai)", "value": "8b8a6c596391a0e31fcbbc3aa723484335c7dd12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704844, "uuid": "6efe40ca-9e75-4bad-a786-636e16484a54", "comment": "Malware payload (Mirai)", "value": "d6aa1dd23aac2f7436d64105c89eeba14b9ee8ccd15ae7c95a1f10699693ad3d9f42019ae52ca940c30e6945c365ddae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704844, "uuid": "28071609-824e-404a-b9d9-4e77aebe03c7", "value": "T10E03F16CC6038D30DB111777E5F95513BA57FFB8C1B665B323A427B91DC698403246E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704844, "uuid": "5ed8cb7f-602d-4aeb-915a-099afc2fdefa", "value": "768:yZlN9dtEw5BkURToTlZgOoEOcQS4gBJjOTJHQaxkJ2CywCGOPHB9LHk9q3UELAw:yZXjtrPlRUlE7lkOTGaxkYCvCv3LHNLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704844, "uuid": "dbb99e3e-c50a-46b6-bc0c-699cdba538b5", "value": 40500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704844, "uuid": "4ad9275e-f520-4a02-8936-6d62d3d30e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704844, "uuid": "31091c20-0b0c-4ac1-89ce-e40ab525eaa7", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc61607f-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725174, "uuid": "e5f88f33-b6ba-4a44-8f1b-317f6e68c695", "comment": "Malware payload (RemcosRAT)", "value": "762e10f534fe3e4f16386754aaffdbe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725174, "uuid": "421f26c9-3d9b-42c2-be9e-d0c7f4154de9", "comment": "Malware payload (RemcosRAT)", "value": "cc920b1b12c338917890297223d10c34de5a4ac70502fd2a4e00fd9653f2f8cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725174, "uuid": "a8a7394e-e1f0-4fce-a795-67b723f78341", "comment": "Malware payload (RemcosRAT)", "value": "2be9d1043cc1a5209674d30f0c39145776c1faeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725174, "uuid": "356c6339-0b31-4331-a45a-89e1a9cd6911", "comment": "Malware payload (RemcosRAT)", "value": "32b66c9e9dabc540614c2d63efbcb53e47751b804bea034b9111bc592d51bca626feeda7c38c0d656a718369053dd5cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725174, "uuid": "1acb3e0a-d094-40ff-a7bf-9953d05c5d62", "value": "T133D45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725174, "uuid": "9ca32638-54c0-44ee-972b-d05227bd23ff", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725174, "uuid": "f50b62c6-9a6f-4c36-992a-0cbddb01caa8", "value": "12288:PSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5hdr:6GuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725174, "uuid": "deedaf0d-5d33-47b8-a3a3-431096dd0990", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725174, "uuid": "4092b356-6917-4386-b80b-18b607952340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725174, "uuid": "b7511a0e-eb79-43f1-a58a-e0a5bacd49d6", "value": "cc920b1b12c338917890297223d10c34de5a4ac70502fd2a4e00fd9653f2f8cc_881c3c54-12bf-4071-ba07-097f118da093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c24c65-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725329, "uuid": "cdf86912-932c-4130-8092-87d625a34c23", "comment": "Malware payload", "value": "0a52eb6398f6fa955f326e44c8fd4641", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725329, "uuid": "15acff91-8cd9-4241-af76-d347b997286f", "comment": "Malware payload", "value": "cd28ded9d669d5cfbd09c212f1a73f68d7872984de72172f9f26e9923286826c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725329, "uuid": "f5fa2964-2de8-4b5d-b45c-c1bdcdc601ad", "comment": "Malware payload", "value": "0b6eb6074959ea827a93ee45b64825c8fa069c02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725329, "uuid": "83585901-b361-4d39-b657-4f84e7b4e5f1", "comment": "Malware payload", "value": "3f5b6e0930b58f07333d9b974fcc0be13e9e1fd3ba53c84acf8c7ac239fb4f9279c8406320fac6ca7c8b265796a251d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725329, "uuid": "f72fd368-e472-4145-900e-851572e92194", "value": "T1C4B36A0B62E540BBE077D23985A34A46E7B2B81147619FEF03A4465B1F237D18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725329, "uuid": "b5813a51-d13c-463f-a033-79a0fff3c7d7", "value": "43501fd48065720e9fd2d24a68ead8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725329, "uuid": "5533844e-c6d6-4823-85a3-9c2933529286", "value": "3072:Jdw50aYcaKf0duwCqeYKhXpBEVJsxlDb36T:I5FY60M3YaESrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725329, "uuid": "848a8541-2552-419b-af3c-6b1a74d5f25c", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725329, "uuid": "dec293e5-194f-4b87-857a-64bab7c18db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725329, "uuid": "a18e224a-df08-4de0-b7e2-9e63946979f0", "value": "cd28ded9d669d5cfbd09c212f1a73f68d7872984de72172f9f26e9923286826c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5774ada6-3ca7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776682484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776682484, "uuid": "93401326-4904-437d-84b5-79a64747a444", "comment": "Malware payload", "value": "6f65ad0831c30280b17ae00b7cf60e18", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776682484, "uuid": "d1302ee1-3b66-4aac-a5ae-8fa0e46a6429", "comment": "Malware payload", "value": "cdaa5e794921dedf24b8147abe34bf00ccad995e1edae6dbb62089b9468b1aa7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776682484, "uuid": "99025d57-7494-418d-b49e-ae39cfa7a297", "comment": "Malware payload", "value": "fb645343fcf0ccc3d13527cabf29b7ed5b3ffec0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776682484, "uuid": "3ff1d14f-5278-438f-a495-3a18702b1465", "comment": "Malware payload", "value": "31aca4cdabcaf097eb89fcb8e4225f91e6e9aebeed6261acd50bac8753f71b1b090780b5c169d1ea470de93078361e9b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776682484, "uuid": "40232bb8-5cc0-461c-b319-5dc6d49d3239", "value": "T154136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C55A9CE218B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776682484, "uuid": "9486ac29-3809-4543-9f25-b044621a834e", "value": "768:bPs9NyXsZztC59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bkHusZvco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776682484, "uuid": "a4891939-569e-483a-8518-834cfbc53b67", "value": 45490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776682484, "uuid": "bcf01483-c9bb-472f-887b-ed97c6e97ce6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776682484, "uuid": "474e5175-0809-4a1f-8c04-c54f97f85820", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c2caef-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687105, "uuid": "b93e5149-7575-4a42-a683-b40dffbf5d5b", "comment": "Malware payload", "value": "89ec27193660f86d40955029fad2555b", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687105, "uuid": "83ff8ed1-8da5-47c8-969c-5139d5f13d2b", "comment": "Malware payload", "value": "cdd5b658271b5319df355aba7fbf4d19ec13e185cbb5d6b189e2fc87309cd88f", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687105, "uuid": "0c587c96-dcbc-428a-835b-fd790987e626", "comment": "Malware payload", "value": "b3cc544973e583cfdbb7d9dd7f64595b8e71d934", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687105, "uuid": "d3368616-5b97-431a-90f7-8109954cff47", "comment": "Malware payload", "value": "bad0f0d98fddaa4fd071f7bd2e3d10727b95a3024a5ab7ae2fa77f643a9a8a4f98d8d17a8382e7d9b74e24c28ec80473", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687105, "uuid": "74108ed9-b160-40e7-b06d-4f7133e1d622", "value": "T15AB5D03BF28B653EE06A2A367972E210583B7E3065164C5296ECF48CCF751701E3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687105, "uuid": "a8d7d06d-4057-42b1-b12c-eb4781a613d0", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687105, "uuid": "c0326044-9c7a-4cf2-ac01-2183de52aff7", "value": "49152:9uI2hEVrD/G6Uyun/ggS76zvJO5WImt0XDR6KG4VqYq2:95OEVrD/xUX/gL7kBO5WIw0XDR6Pkt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687105, "uuid": "7b74d041-68b6-4355-a6e2-73a894082eda", "value": 2344217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687105, "uuid": "ea14aac3-a504-4b43-b870-ecff9c98215d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687105, "uuid": "0ffaaa18-fd90-487a-9016-9d984b157d2d", "value": "cdd5b658271b5319df355aba7fbf4d19ec13e185cbb5d6b189e2fc87309cd88f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2381d1b0-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776687122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687122, "uuid": "102b5877-2294-4634-8167-9eb09e9a3b04", "comment": "Malware payload (RustyStealer)", "value": "85ac792e6f31225ef327899db800dde3", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687122, "uuid": "9f84f799-1db1-48d5-a021-c6e6ea654fe0", "comment": "Malware payload (RustyStealer)", "value": "cdef68e17e381ceadc63a28410cd1ff0101eb54cd01c337d3f0fc64aec139c0c", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687122, "uuid": "3d504dfa-410b-4c44-96ac-84cb667f21b0", "comment": "Malware payload (RustyStealer)", "value": "183de19ef281f5dda6c1a4fff3ee30a8d0b19c1a", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687122, "uuid": "30afedd9-0d9f-4f0b-954a-2b780d18dc4e", "comment": "Malware payload (RustyStealer)", "value": "9f8ee40f7470909273e9d2599557d4968e3fb896368418b5915c927ec4520fde47962ca39cdea50d4c46ba489f1f7589", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687122, "uuid": "4ecc225c-89c0-409b-ac91-c35ba15e03b4", "value": "T1A3255B03B69545BCD05AC078834B9672AA33BC8E063079BF17E4AB303F69F656B1D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687122, "uuid": "cf7915fc-3cf6-4d16-91e2-c6bcb1bb390b", "value": "a267bb0a99cf4aa3e218db37da088d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687122, "uuid": "4ed76d3d-2902-4781-98db-d30d876b931a", "value": "24576:GqBu83CVFAisIyAxY/agNg69MeADQZaMOY:GqBdyVFAisIyAxY/jgqlADQZaMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687122, "uuid": "fb26f815-e19e-44fd-a8bb-de619b83cd5a", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687122, "uuid": "6cd15078-6b67-44d9-b932-97f4305f8b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687122, "uuid": "d5585a2e-f973-4592-81e6-2cd28befc548", "value": "cdef68e17e381ceadc63a28410cd1ff0101eb54cd01c337d3f0fc64aec139c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502908e3-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725851, "uuid": "857e08a2-4082-480b-9868-80e76f7bb74e", "comment": "Malware payload", "value": "7b5589716e7c328930066664de90e77c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725851, "uuid": "1c93d1a9-a5b4-4374-b18b-955324c166c5", "comment": "Malware payload", "value": "cdf2ed9e0b1e64c2ebb1b0d9d8adaeee4c97daeccf9b29b79f3273744d3e43d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725851, "uuid": "faf53cef-b32e-4768-8568-3f75d02872e4", "comment": "Malware payload", "value": "6cf1822dda1493b77b60c1aca54fe6ddf8e6dc84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725851, "uuid": "b9e2660d-bee9-4683-9c63-c8ca813e77c8", "comment": "Malware payload", "value": "ab1c29822bcce1bfdf0fcd263a26769ada2174de3f8e20fd1f3e0a4e1a2fcdb8ca830df65959e778f23270170b2e528b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725851, "uuid": "ef967dce-f11b-4b1a-8c2a-8a512970e7b1", "value": "T168A34A4B62F600BBE2B78678C5534A4997B2B8554720AFEF43A0465E1F233D18D3DF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725851, "uuid": "1f8d3fde-784e-46fc-ba33-308fb1c65942", "value": "89a97c0efa41b17c5ccb77f897c17c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725851, "uuid": "9ac2c8b1-abff-4db0-83e4-4b73bd62cc99", "value": "3072:PLLD8KfFW2ceGiHQbQwW7JkqAtpFrpqpqpv2kTindCpp:PYKtW2ltMQwW7aZ+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725851, "uuid": "bdc6d980-64ee-46db-af98-16d48fb3cab7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725851, "uuid": "d6357372-3fcc-4bd2-b160-ce77896a0ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725851, "uuid": "274d264b-bdba-4cf4-ae03-c6d3e3f5ca61", "value": "cdf2ed9e0b1e64c2ebb1b0d9d8adaeee4c97daeccf9b29b79f3273744d3e43d8_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e11c8b2-3cdc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776705313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705313, "uuid": "c02efac0-d9ed-4d15-8cbf-092f2ae2059a", "comment": "Malware payload (AsyncRAT)", "value": "f25a290bff7d92b0f40a065abf474807", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705313, "uuid": "e1166e30-6c33-4a2d-a848-948a8022f1e2", "comment": "Malware payload (AsyncRAT)", "value": "ce3728b36e4d3fc7158178c03d9fdac89f01560a7a2963ff3b46b1b595afa15e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705313, "uuid": "0ef119a2-9336-433b-a5a6-e240ba9a5a29", "comment": "Malware payload (AsyncRAT)", "value": "1a124a15cfc62aa29c8623049f8cf38c659058fa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705313, "uuid": "db2d1816-ee79-4bef-bb48-33327af31c20", "comment": "Malware payload (AsyncRAT)", "value": "3a0a8687ed4a8b3a5bd48309ca5c94cb0828564045a6b80ac76c98df88b961554fd497ff3d90ab39261a033deaf29d46", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705313, "uuid": "fffa94b7-7b7d-403c-aa83-5da56ac309c0", "value": "T119C512D1A78DA57C27AA1B9624DE27CFD2696D4F39F49223CC491C8F40CB857E04939C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705313, "uuid": "90b474e3-91b6-45c1-82a6-d747458aeaa4", "value": "96:flHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlH3:2PKL3VxPW+ijF5ipSpYg+HZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705313, "uuid": "0ff55640-4eb7-47fd-8e11-73fe54af4294", "value": 2587527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705313, "uuid": "c67f2610-02ba-4d79-b01c-dc18459512df", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705313, "uuid": "f66e64aa-356d-4eaa-92c7-bcce7a446e87", "value": "PURCHASE ORDER AND SAMPLES_003947KGB_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25de10de-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776724921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724921, "uuid": "de04114e-4097-4691-9c4d-27aa8129b620", "comment": "Malware payload (AsyncRAT)", "value": "2e4fd5a58c60d1591bc4f27df78991f5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724921, "uuid": "649dd48a-16e5-4a51-b0d9-cd663a4b3a29", "comment": "Malware payload (AsyncRAT)", "value": "ce64e0d852b4e48a26aa0ac4c1840bb861c1d51cbac95387473bc7b63ac1bb0f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724921, "uuid": "6d12e215-0cc9-4060-bd0d-ba9b8bb035e0", "comment": "Malware payload (AsyncRAT)", "value": "08dfd54f21115b88f2f706818b856ef553932d91", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724921, "uuid": "07b3697f-0c58-48fd-8583-c0244c751cb4", "comment": "Malware payload (AsyncRAT)", "value": "2d881f5fbed5258e7796d4f70b9fe926a8f5ca9ea1d28aa8796d29fff59c5c2c4bcd0ce4ea8efb2b848c95d58ffd0a2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724921, "uuid": "03052104-f51b-4012-ad70-642bf021b465", "value": "T1B0B34A1B72F640BBE2B6823884974A05D7B6B8454761AFEF43A1425A1F237E08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724921, "uuid": "7e31a0c0-ece2-48df-9aae-805afe55b795", "value": "ffb74f31e87b8cba424df1a04cac76c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724921, "uuid": "f0fe43f6-e098-40fc-8d3a-ba9e7033607d", "value": "3072:DFrShv3i1ulGvwQbgQ8tW+u+3Z4Cv2GWwD80p5wCDvmXT7RLyzfWC7PlCqHZkWEI:DEhfi1s3MgQ8thIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724921, "uuid": "2fcd2858-1770-4509-a6fe-48a1bba4be1a", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724921, "uuid": "3ff26388-9e16-4dcf-aa06-75d5534e169a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724921, "uuid": "65e5af6a-0121-45f2-b306-d936af7c516c", "value": "ce64e0d852b4e48a26aa0ac4c1840bb861c1d51cbac95387473bc7b63ac1bb0f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254ee7f8-3c65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776654054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776654054, "uuid": "8c82ca68-b066-4c06-8768-aaa69edb218a", "comment": "Malware payload", "value": "876c7f6f53b4eae687e8b58931dbbe7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776654054, "uuid": "d8f13cd7-68be-4093-b418-e23c8a84ee82", "comment": "Malware payload", "value": "ceb54bde173eba25fec723583d56ebde10bae2d447f147de9d637348d6251d68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776654054, "uuid": "8316c91b-cf59-4ea9-8ca2-fe5bb55c7c3d", "comment": "Malware payload", "value": "5eea52db8af117f665a5dcbab16a2bfb9cd417f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776654054, "uuid": "dd7cb21e-b0c9-4022-a8b6-c13db0ee77de", "comment": "Malware payload", "value": "358613af4ac2011e62deab57af5e19c53eb9cef064537dbf0ea5f3db7d79b15158a6ddec790bd9651b8d87e5d139fdb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776654054, "uuid": "3469482b-f955-45fa-8833-42a5f79be934", "value": "T1F9362873A09154E4D2EED574C6256213BEE0389B273423DB7BD076E11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776654054, "uuid": "8a22d94d-6278-4ac5-b6e4-99f36c183915", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ4:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776654054, "uuid": "d82068a2-c2ec-4a83-9492-6c42bb6b5a3e", "value": 4980736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776654054, "uuid": "e50f3542-a63d-4d5f-bcb2-ac961d993993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776654054, "uuid": "89a05fa7-48fe-41b3-beff-ce9bbd1fc5f0", "value": "ceb54bde173eba25fec723583d56ebde10bae2d447f147de9d637348d6251d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e37a21-3cd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776702643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702643, "uuid": "11c96957-ab85-4517-bfee-746a0776c2bc", "comment": "Malware payload", "value": "857f83e8afa19db4e295da8ca8ffe255", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702643, "uuid": "3680ea16-b044-4f5b-98f7-83b8f57d44d5", "comment": "Malware payload", "value": "ced3ede4f66ff4671023a7cc9cfb2eb03936dc124ed6b8045a88e9da3cf09424", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702643, "uuid": "0e902e03-0bd5-4013-bbd7-ba2104499386", "comment": "Malware payload", "value": "05b58d3aa4f8f418d7b0b93bce878ee6df2c3b21", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702643, "uuid": "3e06d9bc-918c-4e90-8888-cb41f387237c", "comment": "Malware payload", "value": "9b83d06e60884531729d75f7877a804dfcfce84ddb08d26f61a8158b5796db4c0d04aa08eeb8f2c43548e746a5a65163", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702643, "uuid": "cc2974d3-932c-416b-9455-7bdb40706df3", "value": "T1E513D15558A32A71C2D108376FAEA209C2EE1BE1207A305E07EDB2D5DF675F3D6B4C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702643, "uuid": "1cde068c-ac59-4ed3-a34d-41b7e6652c11", "value": "768:MXGBvwESElUxyXcTYDyN2++ywtZWDxT9So8A3mHCQg8u6OrtaQmdBOCIHB8KX0:oP3E6SQCCOZWN9f8YFj6mmdPIHzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776702643, "uuid": "f550ba13-0517-4019-8ea4-1466b4c5bdc3", "value": 44869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776702643, "uuid": "799b5db9-9ef6-46fd-bd13-79cd74de5e3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702643, "uuid": "ee909764-4dd9-4dcd-b266-dd0ff60b155e", "value": "5521_PDF COMPROBANTE DE ACCION DE CARTERA_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37030517-3cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776700898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700898, "uuid": "31a21d05-fd8d-4705-ba53-ddd99627b039", "comment": "Malware payload", "value": "fbdde6c18d2d3edca182f2b936e78161", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700898, "uuid": "c8402d42-f6e6-43b9-97a2-5bae5d8b99a4", "comment": "Malware payload", "value": "cf1764fe956c1b1514b2980ee023187fd22bd2c73dbebdb3b1c8b459cc61e9ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700898, "uuid": "72047877-1296-4e9c-8ee1-51b3e7332cf1", "comment": "Malware payload", "value": "5fba90a8c7491f4a7addac922768dc70e25fbe5c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700898, "uuid": "f98d975b-d9c6-4c9b-960b-ed39f3b9caff", "comment": "Malware payload", "value": "87e57878da67ea0f94dbed6dc65afb8c0e8bb418349d872128a7b278c07411216f9712ddc366cedda13f2d1106c5fc5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700898, "uuid": "9c25b1db-4629-419a-83a6-3b2a20bb5c91", "value": "T14AF61237B28A653EE06E5A351A73E220553B7661AD134D1ED7F408ACCF252A03E3B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700898, "uuid": "907ad514-b67c-43d0-b9ec-e2a8246f875e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700898, "uuid": "db4710b3-4e1b-4c87-906f-09d2601113f8", "value": "98304:LL8NcpvoF/tlDo6agNqvsO3tRTRga7wbQWn38AK1AFTwKKoPvBjUG6KeEG3Txmyf:q8oFI67gHeaQZsAdGKTBjteVxnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776700898, "uuid": "799c48b2-064f-4973-9fac-e3f67c761768", "value": 16306435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776700898, "uuid": "4b5db4c8-b91b-485b-b55c-6f3b4396fee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700898, "uuid": "5c724a7d-d9e2-44a3-b39f-457023ebd9ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4623f85-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725617, "uuid": "9974d6b2-12a4-4e96-a7a9-a06398a2bdde", "comment": "Malware payload", "value": "b11f9e5c0c43220563b9b29b98fa0902", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725617, "uuid": "76fdc97a-045a-4eee-8e48-35fe2c149473", "comment": "Malware payload", "value": "cf7eba5d700334230fde16da8191f765132649e6342018c69cffd267943effb2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725617, "uuid": "b476f1c1-3306-4608-ad4a-586524fab785", "comment": "Malware payload", "value": "30379f326fff40184d0bef8f13b9f5414447c5fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725617, "uuid": "abcc21cc-a0df-486d-bd1b-0c1d1bac6cdf", "comment": "Malware payload", "value": "3b26f8d833a71cec6b2eda6f9af6bca280c38f6a6df753b57017c0e9bdc2162e3af3275c5d37a1de0a4f52394932d95c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725617, "uuid": "57f518d3-bc54-48d4-a42f-098bba9cc6be", "value": "T1C7922A0EEB87A8BDC816E2B88DFF2B32B175793115356B6E1314DBF94F40940527EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725617, "uuid": "23bca327-6490-4a58-957e-15c98f791559", "value": "b363afacecba727a8297cb88b97804b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725617, "uuid": "5157a8bf-9bf0-4069-a726-43484cf58ad4", "value": "384:0Dm1913DcyseIqpHGYuwvA6LghFmckVPxIiThpMMMqWLXNRtr:0S191F5H5zuEomckVPxIiT/MMMB5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725617, "uuid": "682c828b-b91c-444d-9947-98ec455f9027", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725617, "uuid": "8f58fa47-76cb-492a-bac0-95f878d6ee2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725617, "uuid": "77cf38d6-133c-4ba4-aa48-a05954a0b349", "value": "cf7eba5d700334230fde16da8191f765132649e6342018c69cffd267943effb2_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c69fff-3c80-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776665731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665731, "uuid": "5cc164ae-8f4b-4f4c-b3bf-6e7ea3e6e143", "comment": "Malware payload (WeedHack)", "value": "e5b73d8b99c43aae1843cf4843f490c6", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665731, "uuid": "3e00508a-fa04-4f28-9560-d57ceb1fe98d", "comment": "Malware payload (WeedHack)", "value": "cfd08f037e6441e658943d460ef0e3205135777c06a040593e262b720fbc4a12", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665731, "uuid": "dc22e1f8-f136-4407-a99e-87523f52726e", "comment": "Malware payload (WeedHack)", "value": "9fc5553c535d52e05035d87244e4a297e5170d01", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776665731, "uuid": "80142fe4-f4f0-46db-b6d7-f4830baf1f4e", "comment": "Malware payload (WeedHack)", "value": "7b11f638246d790e1202d5aba13d64846d346aa4943ec4ba5e519bf196a011b082f3ec458d3d214cb2f2b37c588e8e77", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665731, "uuid": "86d75f3e-b194-43dc-a0c7-24e30735a9ed", "value": "T19D0512918CF64B35BC4C6B70611090906FFA700EBEDCDE73BDC16D8B9664AFA0A57294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665731, "uuid": "19be7f21-3069-4202-84f8-3ee8b038ef90", "value": "24576:Vx6k71D4qFMD4stpItn0ITfxRaR0TZUZ0hUiJk:Vx6kJ4qeJH2GG80S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776665731, "uuid": "6aeb903f-5c9b-4e3c-9e87-7931f3ed2555", "value": 822375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776665731, "uuid": "b041e827-2efe-434d-a1e7-f0c1ea70a2cf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776665731, "uuid": "4fe77db5-59c2-433c-88fc-481d3c42b493", "value": "New Purchase Order Printout 0010979742.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411cf006-3cf4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776715518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715518, "uuid": "dbc0e4e4-317d-4578-916a-8477e202f613", "comment": "Malware payload", "value": "11ed95186840a87a77ac17bfc9d21c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715518, "uuid": "e2e57004-9555-4b11-ad08-4f373365aa68", "comment": "Malware payload", "value": "cfe32a12fef7a6bfcf5c493d8001157e5ee7268d11cdf2de328868b5d7d7404f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715518, "uuid": "5ef3bed6-cdfc-4107-a8b1-73dfb95b1c99", "comment": "Malware payload", "value": "658a258e1ae42b49f13bf8acf5ace732fec181de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776715518, "uuid": "f0979c30-fdf6-492a-ab59-30036ac15f73", "comment": "Malware payload", "value": "6d61fd6023a68f587e43e344ac9fb2c616af63036b6306921e3accbbeafdfb321b397bf4befcd9239a721690b6f0b962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715518, "uuid": "f61fcecb-85b5-4ae8-8df6-0858a22a8337", "value": "T147165B31764AC92AD47E05B01E2CEEAA922D6E360B6144D772EC7E5F17754C32232F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715518, "uuid": "b0c9210c-a31f-47f4-84ea-9a62ae0ffc97", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715518, "uuid": "76f010d2-56ce-4c14-8da9-f287d7943c6c", "value": "98304:KQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJTXaZXAl:KQN5tgqSsl/oL+Tqv146w9Dbi+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776715518, "uuid": "c56359d9-dc6a-4316-a63b-28f7ed732fd2", "value": 4290366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776715518, "uuid": "6c5f4f77-eb2b-4e91-8e38-7b13ea79624d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776715518, "uuid": "d4dc9d1c-d732-43f1-8e16-c124e1071cd0", "value": "CrownOfLust.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe27d46e-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688348, "uuid": "d01a7c78-e5dd-4424-9c3f-57e71bbcf4e7", "comment": "Malware payload (ACRStealer)", "value": "f92394456848fbb94317b915ff3df234", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688348, "uuid": "9af4a455-db63-41fb-a898-f24c172866a8", "comment": "Malware payload (ACRStealer)", "value": "cff57ae70077b0f490633081f94dcfb4c19516283043b778e6e035217bca42bf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688348, "uuid": "5997bb9d-e3b0-4c98-9061-a85de61d21c7", "comment": "Malware payload (ACRStealer)", "value": "ccdecff9f2ae98f6f1def999e5928f78a74f4a47", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688348, "uuid": "e52001e9-4e3e-48d5-b201-b376a76274a6", "comment": "Malware payload (ACRStealer)", "value": "0a74381d069de2761cf9995685d0a42317e1d6741677ac24731529b97f1e24ffd6698578df586759d76b886fd2ab2686", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688348, "uuid": "2c1e91c4-17da-473e-b70f-7bda34f16ecf", "value": "T17F167D1FBDB95CADC08AB13084336606F6A5BC04576227C71AA1F6242F7B7E05EF9B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688348, "uuid": "a763136e-638d-44c9-a425-1bec51455274", "value": "d551de12e37f9791bfaf7f333733012d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688348, "uuid": "53090bc4-a4b5-45a3-8c03-30db665a2753", "value": "49152:bi6u1ducaiyE3E2d5x7jcpt4PxQJZ4R7Sxj5QcTfI0lOm:biry/t4ybG7Swy5cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688348, "uuid": "f7ffa0e8-d793-48c6-9188-b4240be4540f", "value": 4387296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688348, "uuid": "c77979bf-4af1-4361-903b-7a2f76062e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688348, "uuid": "0cff1f6d-27b1-4f40-a87c-9eddeace7063", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca8a595-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726087, "uuid": "95105785-75f7-4445-9617-9dea6721a899", "comment": "Malware payload", "value": "9605add5043dca3eeb79e6ec47eb36f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726087, "uuid": "f3139df8-7f56-4940-bcbd-bc17b6065cbd", "comment": "Malware payload", "value": "d044df0e67952c40201d70abd676f9b4ce4b168d85ab538d269b6e55b08205a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726087, "uuid": "4b50650e-4b8f-4741-82f9-183eead2a365", "comment": "Malware payload", "value": "d88cb622982b06e99fc0bb14b005c7dd91714868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726087, "uuid": "a050b5b5-c4ae-4e07-8d12-2d8a6689ec34", "comment": "Malware payload", "value": "34b46f1e3893dd92805799a8bc82bfeb76ab0014de67fac16940fd39576e5837b0e8d4cfa911241ef70893f8b3445225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726087, "uuid": "43d0012a-19c7-4b99-ac62-97be18c3548d", "value": "T13DE72306A7F901F5E1BBE2388AB36617FA727C259B31979F0251160A0F77BE09D39311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726087, "uuid": "43bf1047-e9b7-4b22-8b67-d2e70722d159", "value": "5a2c9d7d843879ef766643800713bfcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726087, "uuid": "e5218691-fa74-41ad-92a5-28955a18f329", "value": "786432:Mf+JyRKQE8zWx0GaimRmCJP251XIOXJ3w3Oukjx2tVuEmVLxleqXpsJodaZTIE/M:Msy3GavmD51X7JQZxtVuEmVLWqnav/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726087, "uuid": "eddaf7f5-412d-4f90-a0db-c85115cbd4d5", "value": 66177952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726087, "uuid": "41ba7915-17d5-4bf6-88ea-60e0a1c8e85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726087, "uuid": "8d28c581-60a9-4514-bf91-4d364fe4ff8a", "value": "d044df0e67952c40201d70abd676f9b4ce4b168d85ab538d269b6e55b08205a3_OneDriveSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6f78f6-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674656, "uuid": "3043cb0c-0927-4c12-97a6-925d51b2cabe", "comment": "Malware payload (SimpleHelp)", "value": "d916af66dcf63d62c4360943b12ca5e3", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674656, "uuid": "4991281e-6bcb-4a62-9c39-ad3c5dfbdc51", "comment": "Malware payload (SimpleHelp)", "value": "d07e48477a7e3386237ebb696e1e2ccb53ae5561ded38703766ef10453ceafe9", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674656, "uuid": "e8a35272-331f-4b2c-bf3e-04e1ed82f2da", "comment": "Malware payload (SimpleHelp)", "value": "b30b4f4424f6c444755b4a9bbd652360f964f0a4", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674656, "uuid": "558ef527-2720-4866-987c-c1062bf294cd", "comment": "Malware payload (SimpleHelp)", "value": "f5483c7db8d468064df251df04073ce6df2816512efd394becd4465b93d9b3f87146f2ced5d778442d076434ded4925d", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674656, "uuid": "26bc9650-d9b3-4335-87b5-da314e65fda7", "value": "T175773324FAA16DBEDF33D5FCC4464147AA5AA4A70389121327F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674656, "uuid": "5c483f02-0cd5-4151-90d5-cebef86338db", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674656, "uuid": "e9a0aef2-fdf6-4299-88e1-81f8e8f99869", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcR:K/jkCgpPUK8PyL7M8aE1VWhroHFcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674656, "uuid": "2a207347-a2ed-4ecd-9b6f-f5b4ff228f3a", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674656, "uuid": "d0cabd54-0b82-4e86-a791-41547d3a975e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674656, "uuid": "271da32b-c94d-4d42-89d9-0f4a9c555a28", "value": "d07e48477a7e3386237ebb696e1e2ccb53ae5561ded38703766ef10453ceafe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2829542d-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689277, "uuid": "34317f02-e593-4f4a-afab-7021f2661a03", "comment": "Malware payload", "value": "524bad04d1d2f0956ab987f724250fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689277, "uuid": "ca7cb49e-e65a-45fb-a02c-9e31707525b8", "comment": "Malware payload", "value": "d0b08f7df1c9a56e3430871bff4cbbd459a7cc57a27a2dfa70f24da36ec9bf49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689277, "uuid": "22753692-0be9-4bf7-be80-f14ca683891c", "comment": "Malware payload", "value": "2edbf29175ac5ae63f8a8239ffbb65a03f41a859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689277, "uuid": "6ce20c0d-e568-4ea0-9b9c-37cae6a07193", "comment": "Malware payload", "value": "c403111df4dbbc3d6be84a8a0fa0b03f9909850176724d0b5bdc398796225ecc7ac62b979b8b23cd2df7b0a11a525063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689277, "uuid": "41e63e5b-54f2-4561-b878-176983c2686c", "value": "T1A6442A07A7AB40EEF0A2D635C9D24841FB727C595B6156CB03507AF60E727AC6E3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689277, "uuid": "eb32024f-477f-4170-858a-721942a08408", "value": "7a8c872f8e13d32f36a675b52eda1d6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689277, "uuid": "c58aca69-1e1b-4226-9672-28e1aa6dc2eb", "value": "3072:Y9G2U1qr+L6n2dIrOaWkwI1RcCtZKePAGVs5u9XLHRd:YMCgIrOa1bvDtvR9XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689277, "uuid": "f4898311-44c5-4978-a8b1-15fb47993005", "value": 267168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689277, "uuid": "e8f5f09c-42fc-46f7-9a4f-b285a0543391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689277, "uuid": "d9521050-ea31-4b14-b514-1e9a2f789030", "value": "d0b08f7df1c9a56e3430871bff4cbbd459a7cc57a27a2dfa70f24da36ec9bf49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7865d802-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725060, "uuid": "283935d2-fa6d-47e5-9706-c3de417320c2", "comment": "Malware payload", "value": "221cb999e8d538a5434ed812df1ffefb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725060, "uuid": "c21a6cab-7f51-40f3-8e30-f059567889d6", "comment": "Malware payload", "value": "d0d9bf2064534bade4ccae6e7dc11fa398983bb10e08b55897f8ec406e4af1be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725060, "uuid": "e7b8c1a9-5077-4536-a0f2-a9e726118af1", "comment": "Malware payload", "value": "aa267c747a0e8ab238e310f37305d2c5618c6eb2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725060, "uuid": "61b12a79-7528-4e0f-b110-ed839fe4fb82", "comment": "Malware payload", "value": "cd904417d6d8328e4660b84f5ef0a42fb8a5427988809e1ecf08f694f9257eb819f88b80c5b272ed0153ebbf247b9941", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725060, "uuid": "46424b9f-cea5-43d5-ae03-460f04dcc29c", "value": "T1BBA3394B62EA40BBE1BB8638C4530A09DB72B8514721AFEF43A4465A1F273D19D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725060, "uuid": "4fcf695b-d3bc-465c-bc33-0ca70b45226c", "value": "f86306582ae7ef5040867987a46e12e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725060, "uuid": "d4c0ed84-48fc-4eac-aebb-6ed88b3af7c9", "value": "3072:gyMA45KbE+c6GsOEQbQwWKqe9i2Q9ZVbZaZaLEt3LPjkSqvu:g84gbE+5hMQwWKB7Fqvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725060, "uuid": "15a49804-c9d5-4eae-8e80-e1abaa4e00de", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725060, "uuid": "54a6916a-1df7-4846-a1fa-300f234bea9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725060, "uuid": "2a128eff-98da-4f33-9d8a-bcd9806e939c", "value": "d0d9bf2064534bade4ccae6e7dc11fa398983bb10e08b55897f8ec406e4af1be_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e125e3-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725780, "uuid": "5c6599cc-e33c-45ac-b629-45d06104e435", "comment": "Malware payload", "value": "730d93ef0f3f595b13c2a860970196e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725780, "uuid": "29dbfd5b-2625-449b-8868-7a7632e6a719", "comment": "Malware payload", "value": "d141aeee85b1252cbf319d91fb200e559936a611642741f89924d27468974e61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725780, "uuid": "7971bfad-c337-4730-8350-595829a789fa", "comment": "Malware payload", "value": "b19ebb27eb26aaecf3b3497fab5e70bb49172c65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725780, "uuid": "ec54b446-3c4f-4e2e-912e-85c4ba142d0b", "comment": "Malware payload", "value": "bc96e649211a5d5ba36a4846f50f6a0a7ebe255bada029393ce32f8cfeabb42492d8fc815171e90f8bc5689eba7a69d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725780, "uuid": "a3cb1d55-d9f2-42ee-8c63-b1be4c06fb78", "value": "T179A3394B62EA40BBE1BB8638C4530A09DB72B8514721AFEF43A4465A1F273D19D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725780, "uuid": "be724826-773b-4943-a12d-0999a4a9c9ad", "value": "f86306582ae7ef5040867987a46e12e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725780, "uuid": "aace0b95-5a74-43d7-b254-274be3a91cd9", "value": "3072:SyMA45KbE+c6GsOEQbQwWKqe9d2Q9ZVbZaZaLEt3LPQkAVvu:S84gbE+5hMQwWKBKcVvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725780, "uuid": "7e23d63b-3847-4fc1-84af-a42b8a929c54", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725780, "uuid": "3f0eea31-d035-4b16-9411-cae38011ee49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725780, "uuid": "f2728295-3d07-4d60-8bab-55de8c011339", "value": "d141aeee85b1252cbf319d91fb200e559936a611642741f89924d27468974e61_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f782e6f2-3d09-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1776724844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724844, "uuid": "ba0c3cc2-eeb4-4967-abd5-06ade724c5c2", "comment": "Malware payload (EvelynStealer)", "value": "7ebeb95d6977e60fdb8eb52ec47fa578", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724844, "uuid": "dca151f4-8b81-4bc2-b656-76f6731d3b0b", "comment": "Malware payload (EvelynStealer)", "value": "d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724844, "uuid": "8d6df591-b087-4eed-99af-895e9a4aac82", "comment": "Malware payload (EvelynStealer)", "value": "fcb45e37241a8859d32d19b4fa31411e2e9f9128", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724844, "uuid": "a519f634-827c-41a1-b5f4-a67d50e98b0d", "comment": "Malware payload (EvelynStealer)", "value": "19a769ec299828d55e27fa6835648f00234d067625e75b8b9a52b605ad5e28159f582b093b36d9c97e806f65bb4f1a2f", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724844, "uuid": "1de3f7c0-52e2-4299-8280-76b0e0526052", "value": "T168141816E39320ECD2B7D1305A7BA533B971BC5945F0B96EA9448A387E20F50B53CF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724844, "uuid": "0af8b5d1-8d24-472a-b554-444f30ca70fe", "value": "3f01a1ca93205435b4a4028b8d16801f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724844, "uuid": "49e35f06-6ccb-4708-bd6f-fb3b2575921a", "value": "3072:6/QVhC/k3vkUwkyPgWpgX6Y1pNMiKsW7Qp91ndS+Bx/XyWgVhFl0nM2d:6oC/ocGUhYZ7KsW8ppFZtMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724844, "uuid": "6d54e7d9-c7e3-4cb8-a171-b95d3a1e31b3", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724844, "uuid": "28c33cb0-27d1-45f7-bec7-72a17807c2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724844, "uuid": "ed7ab69e-01cf-422f-b3c4-2f8d7964bea2", "value": "d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1_77170f53-7893-467e-8960-d09c15a370e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f32170a-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686873, "uuid": "564ae793-11d7-4bf1-aa40-9d1ced90e84d", "comment": "Malware payload (SpankRAT)", "value": "ba36c7932f3cce54a09c9a5ac3a19c3f", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686873, "uuid": "15514c97-a513-488e-8650-a5fbe1bd268e", "comment": "Malware payload (SpankRAT)", "value": "d2792e5c98beb169d33b3e324c05f1035288777bf20f6f603562f2f57f0f5a30", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686873, "uuid": "e6d58148-98c4-4fde-9b07-7a5c7d66c0b4", "comment": "Malware payload (SpankRAT)", "value": "a9d6a94890b424ff2639b4b4d6f43dc22d88f417", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686873, "uuid": "c4f88813-90da-4cb1-b824-736465884ae6", "comment": "Malware payload (SpankRAT)", "value": "8e77fdb94e86df9aada08980e9780b9e40563c5baeb3d5efd53c0f81f93627ce043d8fb39611e6935a06810bf4ede301", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686873, "uuid": "ed57d0ef-d61b-44c0-b968-eb7ba3ff631d", "value": "T108253C137E4689E9C48AC8788357CA624E6374DB0B35F9DF50C6662C3F6AAF52F1C214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686873, "uuid": "9ec456b5-8a02-4238-a87f-f2dbe0e7846b", "value": "c1f3c249a65681cc066e2cf79b8318fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686873, "uuid": "ad04160d-f574-4944-bc59-2bb020c24b95", "value": "12288:fqGVCzYjinI+Wm6e+tweILNZ6/C/OvfWHCgs69x6a6MHrGRv6Y1Lqau:fqiUPWmB+twbE/jvfM9oadiD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686873, "uuid": "eba59eba-0fe2-46d8-84d1-f58cfff78cf1", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686873, "uuid": "8b70a62d-de65-4cf3-86ee-9d6598d9b370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686873, "uuid": "5b47f203-5965-43a7-81cf-0bfc0418a680", "value": "d2792e5c98beb169d33b3e324c05f1035288777bf20f6f603562f2f57f0f5a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8be392-3d10-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727542, "uuid": "6463d083-98b4-49aa-aeef-809109d4975d", "comment": "Malware payload (Mirai)", "value": "175e2dc2dc4272ab20a8051e5199f522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727542, "uuid": "2a713f79-6ad6-49c7-9a80-fd923fbc25b3", "comment": "Malware payload (Mirai)", "value": "d2d3e12f505ffaf10660db9f53830636a926854c8dcadb499d9f6fc19b4b4324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727542, "uuid": "3ec15808-5897-41b7-95da-8a4eebd117f1", "comment": "Malware payload (Mirai)", "value": "81ac6793da797746bd425b941c2c460a57510e46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727542, "uuid": "f5b096c4-24b8-460a-acb3-16eb8a80167d", "comment": "Malware payload (Mirai)", "value": "acaae74a3c1e042048cf3b2b9991357b657db17e3752ff520e2480013331073f7cf2015f24e9d68659b87f83554fad38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727542, "uuid": "eeee3ec8-23c6-421b-87af-150ccd03b6d1", "value": "T1DAF2E792B8929D26C6E4237AFAAE018D336163E8D1EF3217CD215F007BCA51F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727542, "uuid": "9d2c3dae-64ec-4260-b50b-e7f82fc3101b", "value": "768:KIodLugYpYCaHH8L7uCMlnJEfC8waM0eCSCchTLY4o/z/rPN:KnCgjdH7b8wgYLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727542, "uuid": "cfe9a156-b259-4299-abab-8cd98879cd1b", "value": 37144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727542, "uuid": "73646a6b-c3ab-43f1-bfd4-dfa859b27485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727542, "uuid": "0831bf0a-9579-4018-b427-16627f8c1404", "value": "00okarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698dd35e-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776688098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "4140ed9c-9415-4ea9-92ad-03b9be4e2cb8", "comment": "Malware payload (RemcosRAT)", "value": "44dc56bc4a1dd3ace7722db1598e529e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "4a605132-e314-4483-b1ec-f1bafc6688ea", "comment": "Malware payload (RemcosRAT)", "value": "d318c45c2842182c07e9bd0ad2c1c010f18cda1c5a2fd8883226cb89cbd47706", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "5ef17ac7-6ff4-4eb6-9264-96ab7ba622ae", "comment": "Malware payload (RemcosRAT)", "value": "8c192815a83d1f97c033cf90e4c7a3505385ff10", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688098, "uuid": "7a78df61-d66f-425a-8e56-3520c234b7d7", "comment": "Malware payload (RemcosRAT)", "value": "797d47499404b604d86ecfea119c25baf6659f5cce27df6b1e38c458730f9fc8888fcf0bcff770fba25f0128ef180d36", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "583dc121-23e0-4453-9c64-889be56d8f1c", "value": "T1ABB4D05172E1CA27F69E9630CEB2C7DD1B52FC238E17420F7256771E5C72AA1294323A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "5011990b-3314-413b-bc37-c12fc49989c7", "value": "6144:vZ+RwPONXoRjDhIcp0fDlavx+W/WEaguL1nH7DTdmsWciHnFpP/g7HoBe0VzsBg9:agw1n7EyiHLP/gzIbignpB1Vk2apmQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688098, "uuid": "e2883da4-f261-45d7-bf49-e1af1a03d97d", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688098, "uuid": "38e06159-c349-45c4-8c97-9a56c96f7c37", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688098, "uuid": "19f458a8-6cce-41fe-afca-f1eedfe9cc79", "value": "Purchase Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5962f0c1-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725437, "uuid": "f88a635c-662c-48ab-9ce4-73752bc11a79", "comment": "Malware payload", "value": "76ae96421b0e6d38dd4f1050bea83694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725437, "uuid": "cb738d22-3978-44f6-9ce0-7637fbc81bc2", "comment": "Malware payload", "value": "d34e20740a20eabfda62d108ca73952de194832d28f66ad32cab815405ae777a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725437, "uuid": "58f04852-f069-4782-a9f2-ade52465ca4f", "comment": "Malware payload", "value": "b1194ed96af58e91d1db190ba21869335cf1cf21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725437, "uuid": "d18795fe-7eba-4d11-95d9-a8e0dac1884c", "comment": "Malware payload", "value": "ee70148d1b9ff47582b7f5bd4d68d71d33acab48de1a46d8214e5801342b301abb90c457be5a2921256b9978720aebb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725437, "uuid": "91bfb73d-5bd0-4bcd-a780-d6359e7694b7", "value": "T12CC55A2B55A9609AE3E7C07CF1165752FC3176491E39A3BB14B683923730A2C9B7C372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725437, "uuid": "dcaa8c8b-db6f-40f4-a054-c6c6e39283b4", "value": "e2ea85db89f88da583668aa6b68d4cc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725437, "uuid": "721f3a2c-ff3e-4ad5-8c11-6c6d9c98bcdd", "value": "49152:sg8RM6cOVZmnn49o6GzEXBX8+QivqASwaPb96OFYPTsVhPEd8GO6RAkH7q6AxquB:l82mlthOHLwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725437, "uuid": "3d563c38-5aa1-4291-94cc-891d13616093", "value": 2502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725437, "uuid": "be8cf03e-bbaf-4bfa-94af-7484b3952df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725437, "uuid": "1f65d792-da46-4694-88d3-5b18e112049e", "value": "d34e20740a20eabfda62d108ca73952de194832d28f66ad32cab815405ae777a_aa7ea486-719a-48ba-9d94-a119b657dcd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d557dda-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727135, "uuid": "146ef3cf-e1fc-4bd8-8b64-86b9fe3b3ef7", "comment": "Malware payload (Mirai)", "value": "8bc1095cb07f251002aa4f745f030990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727135, "uuid": "3d020130-2695-446f-b725-3e0d6f93c78a", "comment": "Malware payload (Mirai)", "value": "d35677edc6a34b0a7f3062168eddefb1d2cc1ae202a29e2cd65ac894b2879f9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727135, "uuid": "a7185011-26a4-416c-ab77-f72edd40e06e", "comment": "Malware payload (Mirai)", "value": "a557cd086f3121c16cf1ff2f0d881ea68cd719ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727135, "uuid": "0ed407df-83c9-4e66-885a-4326e55d58e9", "comment": "Malware payload (Mirai)", "value": "73a1b70deb9b8b6b4a53222b72c255c0568fd372e8e72630340a9fe8add3589cdb98c05b012693f36107559c57d073c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727135, "uuid": "0917f17a-1743-49c7-9923-6466948ee7f8", "value": "T1933473369958DA9BE13156BD53FA8F3ACA7E33DB2341CD41BDDC903449A4A8F280BD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727135, "uuid": "ab4cc4fb-59ce-4fe3-87c6-c8e9250528a6", "value": "6144:UWplADHbuNJFRGYMLqtjOUhUPqmix8PFPl/0tOqsfmWoZLOB+GXMlZY6Tp7TMuj:bxoa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727135, "uuid": "d34a07db-723a-48f9-b947-6a92afa3de61", "value": 232288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727135, "uuid": "e0f83f7f-25e3-457b-9468-8be91aaad55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727135, "uuid": "1c30f426-499c-4c59-9c44-d8a93b5546cb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c49f36-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725671, "uuid": "aa6a8ead-1324-4593-a4e4-a4926d25d959", "comment": "Malware payload", "value": "dd5f598ceb6d220d14a495d0a333cf63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725671, "uuid": "39039286-ccd3-4fff-9b64-3d4a9cffe9a1", "comment": "Malware payload", "value": "d3776ff2d48df361b9035347da3f46c41133224afbbf0a19d29d916969e02c88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725671, "uuid": "84f39e82-ab64-4438-ab32-27de61621fd0", "comment": "Malware payload", "value": "7cdbdb4895165a814f9cf8909a9fb103c6b0c273", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725671, "uuid": "1bab8867-4fae-4cdd-abcf-6da885f610f1", "comment": "Malware payload", "value": "13467506eacc20b86b70c999e985294897e1292dbad03a134c15180d4056307035ba993c80c410f6e2b9b1eacd6459a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725671, "uuid": "b1b7fe24-20ae-4c5f-a126-82281d4e5158", "value": "T1D3A35A5BB2B640BBE1B78638C8570A05D776B8455761AFEF43A0425A2F233E18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725671, "uuid": "3683ac2e-41a0-4e03-bba1-77482d9c9427", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725671, "uuid": "9dbf3770-5abf-4384-ac53-576e67d6d57d", "value": "3072:6Xj7jVbm1OmGxRQbhABb9h7Z4Cv2GWwD80p5wCDvmXT7RLyzfWC7PlChHZkWEhce:6XLVa1LMMhABbL7X2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725671, "uuid": "14bb430d-2872-4547-9c96-64a8c952380e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725671, "uuid": "653e4075-143c-4228-80e5-67ba76b8e617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725671, "uuid": "4fb31d41-32c4-4dc0-aba9-9e2d71126a6b", "value": "d3776ff2d48df361b9035347da3f46c41133224afbbf0a19d29d916969e02c88_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885e393d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725516, "uuid": "e7a81b61-035c-4494-b7f9-00297703a9c3", "comment": "Malware payload", "value": "e4ca81381560b727081fa137d06ee510", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725516, "uuid": "6b46c9c5-8e37-4106-87eb-44eb78221bb7", "comment": "Malware payload", "value": "d38a69dee1d190f00ddd5048b7fddc4763943a4780b91c03f9159b589d4f2b5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725516, "uuid": "8de248a7-56ee-4739-8b5e-012cefb56543", "comment": "Malware payload", "value": "585619a0720db67fc759aa87ab9cd55b390ac3bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725516, "uuid": "1226e848-fe60-4bb1-8758-7116912fd0ea", "comment": "Malware payload", "value": "c295ecceac8e4a29758dd7516d4921951c35fc9c8f37764ae2b66ff899d3c11bec8c9487214de5e1ffe757249f7d3d93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725516, "uuid": "2ebce71b-63b3-4840-838b-4f40cc221640", "value": "T16BA34A5BB3BA40BBE1B68238C8670A45D776B8455761AFEF43A0425A1F233D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725516, "uuid": "393f6f4f-f537-468a-a444-79dc8db19994", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725516, "uuid": "df84e8a9-cdb9-4066-92c0-22855e96c4c8", "value": "3072:QVU5V3RNUOiGyAQbnA8i9tDoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHXvGOw:6e3bUT+MnA8i7DkXJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725516, "uuid": "052fc035-6186-408c-a90b-367444a1a3ec", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725516, "uuid": "4d4bfeb9-6855-448e-9ead-afdd68433c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725516, "uuid": "6dc904e1-3ed0-41eb-997d-fa9d63aa3dd1", "value": "d38a69dee1d190f00ddd5048b7fddc4763943a4780b91c03f9159b589d4f2b5e_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37812a2c-3d0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726240, "uuid": "3d8966f9-6296-4a29-9182-20da14a191f1", "comment": "Malware payload", "value": "0151982a6df12471d3b596d9d648e152", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726240, "uuid": "bf347dca-71c3-499e-b1ca-c12cb5104440", "comment": "Malware payload", "value": "d3ef47a9122cb416a78ac38c17bd19aafd292a869f3046326fb42fd3230487a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726240, "uuid": "babae071-2d8b-4166-9141-a0711bc5f40a", "comment": "Malware payload", "value": "fe93cc8b10f4173e0bb74c61f947c56c594c91e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726240, "uuid": "00dea4d6-c773-41b7-971c-67bbe73d614b", "comment": "Malware payload", "value": "77598747949ec10a04967e275d0279bd5e3959a5ce1dc001055f6b57536bd4d1d02829f75974f1d092047a36ca205261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726240, "uuid": "01151ee9-24df-47f8-963e-66c5245437a5", "value": "T138146271E88CC983C263117DA1ECDFAE9E3E33DA6785ED027DD0253156C6A9B290BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726240, "uuid": "af2fb4b2-7c42-4cb3-8977-b3de6974540c", "value": "1536:dToMcp9KGT8mdAHRtCd+U0PZewEH6SbmHdOZqVvhsTFK+pK7DKrtwp+Vp+wEibLV:iLM3Cd6gbmrOTlH7AtyjKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726240, "uuid": "b499c5a3-cda2-46af-8f75-5c6ee7c43c68", "value": 204048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726240, "uuid": "10584e32-4a17-49eb-bcc6-b176e9d7d90f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726240, "uuid": "04484ba4-cd3f-4941-9063-e76143ca7ca2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117e1e77-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676354, "uuid": "0fb634d2-48b7-41e4-b397-2aa7e2ce7c5e", "comment": "Malware payload (ConnectWise)", "value": "37997e49139896fc65082d00d2f3ede9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676354, "uuid": "58ef23f5-a6de-447b-aedf-4b685e83fed2", "comment": "Malware payload (ConnectWise)", "value": "d47469706015672787d8917fb198948bcae5d40dbecdab098b3c7bb3e8ac0325", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676354, "uuid": "2dad4cb4-dc8b-42b4-ac57-b5560cf61521", "comment": "Malware payload (ConnectWise)", "value": "5de5e46c66ad776f35ddfa54b86cd6d5403730dc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676354, "uuid": "81baf909-1743-49eb-bfae-f012f2b66dd2", "comment": "Malware payload (ConnectWise)", "value": "ce652e99a1c80a13be3f1a329a2afb6e07196f95502a6636defa928ce1470e14bb68538f4d0733c4404902fcba11ee7a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676354, "uuid": "97ab6f0e-003d-4ff5-aaa1-ed5dbfe9ddcc", "value": "T1F3D6232267FD0918E1F36778FD3A91E291367C658F12C09F2614786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676354, "uuid": "e66dbbb4-15bd-4cd1-9c75-13e5c9f8936f", "value": "196608:3rnLYG3zDhukOhrnLYG3z4rnLYG3zBrnLYG3z+rnLYG3zCrnLYG3z9rnLYG3zU:3bDDDgvhbDD4bDDBbDD+bDDCbDD9bDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676354, "uuid": "f1dbacbd-0dea-4a0f-9fd7-c276352b36a2", "value": 13430784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676354, "uuid": "ae303a5b-11da-4a72-b09f-00c3abb59e79", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676354, "uuid": "ebea5dae-b901-4480-81d4-2b438940ce50", "value": "d47469706015672787d8917fb198948bcae5d40dbecdab098b3c7bb3e8ac0325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237e44d4-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724917, "uuid": "dcef23f2-e501-4fe2-9652-711828a19766", "comment": "Malware payload", "value": "d26e7e8e6072f68c9de6878a4c8f68a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724917, "uuid": "c6121cd5-89e0-43b8-ba42-089cbde8618c", "comment": "Malware payload", "value": "d4fd4b65aea6fdd1968fd59046265a5d636f58309c28e12044a3abf145014f78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724917, "uuid": "1de120c2-b544-4a81-b915-3951c2c0da2e", "comment": "Malware payload", "value": "d67b45b61929bd68497b2b43ed611484d6f9abdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724917, "uuid": "51dfdd3a-6c48-4bc0-855d-3edb0394a29b", "comment": "Malware payload", "value": "470394321c9e854a131015c89d77f3887ab109b020f3352e903bb1e6131ad6802858083fae8769d4b93706429a1c3163", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724917, "uuid": "b39e7e62-4a33-49e4-b3c7-fe2df3023e92", "value": "T199B35A5BA2E500BBE1B79638C5A35A05D7B2B81517609FEF03A44A4B5F233E18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724917, "uuid": "bcd100c5-87c8-4736-92fb-7f295e45e1d2", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724917, "uuid": "eabb91b4-f822-4668-a6e5-a36ad69be06b", "value": "3072:T37gaO81xEMdLAf7Hbw/uZsIV1dJqckVPxIiTGwWfg1:1OWNm7H0OVoyg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724917, "uuid": "861cb312-7825-43f8-8522-e61b2940fb90", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724917, "uuid": "8976dba4-4c28-4917-aad1-8992b37faadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724917, "uuid": "08ad9144-afca-4cce-96a8-990a19a9fa6c", "value": "d4fd4b65aea6fdd1968fd59046265a5d636f58309c28e12044a3abf145014f78_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15acb965-3c5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776651021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651021, "uuid": "234a25f3-e135-4a06-81e8-82de22011707", "comment": "Malware payload (Phorpiex)", "value": "f9646169ac62734c62789fbbf33bf787", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651021, "uuid": "574ed309-7dad-4ef7-8e5a-2bb32f84eb19", "comment": "Malware payload (Phorpiex)", "value": "d55ec8ebbf308993bbb517f0281fe4296c8e9864e43ff51ba5e0b639b840b085", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651021, "uuid": "80810f65-a75a-4a3b-9a31-2aecd00732f9", "comment": "Malware payload (Phorpiex)", "value": "7183ece17d4444dc32dc934d8844318f28c5a76e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776651021, "uuid": "2d3cdb87-554c-4827-8e29-f92eff3dd49e", "comment": "Malware payload (Phorpiex)", "value": "a07c14ab529ea54dd6015b5f516c0a8f9605bc4a41842dfce35036693bb5e938b7b562ec3177022fa68f4439ee1b548a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651021, "uuid": "f66ddd9b-37fa-44a7-b612-48a0e1c6db8d", "value": "T16E32B20E2A174321DE4049B0F6B1464A157D0EE3B782FFDBE273D1CB0AD5E8584D1AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651021, "uuid": "6c15bded-6ece-42a2-9816-4c59fa1fd812", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651021, "uuid": "bdf66fce-a6a2-43cf-94a2-10657e896664", "value": "192:uhoqXpOBIlxymbniPFJxTEZmFhkeARmV:uhoMpVMOiPFwZLmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776651021, "uuid": "e4a9ece5-e3c8-42f1-acd8-225dbdb9bc71", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776651021, "uuid": "178becc4-f897-41bf-a0a5-4e24aa7326e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776651021, "uuid": "7268e76e-9880-4279-b679-ad1853ac1336", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c135bd64-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674072, "uuid": "c5935a9e-6d97-4bb1-afd2-84bd540fbda6", "comment": "Malware payload (ConnectWise)", "value": "1e2505dba9a0a7bfc90f37890bd1e3db", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674072, "uuid": "424d22f5-f2c6-410f-9c08-191a53a4f130", "comment": "Malware payload (ConnectWise)", "value": "d571bcf92ec400705df78345c3750925fdc3691a7cc55813b0a3fcd1b39e288e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674072, "uuid": "380b1869-6004-499d-ac8a-82903cf2f2d0", "comment": "Malware payload (ConnectWise)", "value": "f80d7363db31dbbc8fd33a32c5dcec2897bf7018", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674072, "uuid": "b194879e-a061-4319-9c91-0e401211e391", "comment": "Malware payload (ConnectWise)", "value": "81062c5e93811644b12c842dbc4168ee989bc8a9f2128aa1fa20b906dfe94d6e0a1795ab378615f89379a749ab901375", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674072, "uuid": "dd5191cb-98c8-4da4-af62-c156cee8f1c5", "value": "T140D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674072, "uuid": "83e61034-e9af-4936-b69b-2536704d2e63", "value": "196608:0Hxcp9ym3nltDUJVUHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3THk:SGplpfGp7GpHGprGp8Gp9Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674072, "uuid": "e9ae8c66-658f-49df-90b1-15dc6157236e", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674072, "uuid": "dc6a5a98-2e6c-443e-bc78-dbdca6212a15", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674072, "uuid": "c9251667-5061-4e01-9036-0f89a7ee9f7c", "value": "d571bcf92ec400705df78345c3750925fdc3691a7cc55813b0a3fcd1b39e288e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f44529-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726123, "uuid": "826d3647-7c0d-45a9-8fc1-ac937eb67af9", "comment": "Malware payload", "value": "06e99955e3d4f3421508e5ddabb9353a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726123, "uuid": "9976db23-6d83-4b50-a719-2befc65bba2a", "comment": "Malware payload", "value": "d5e77fe5fc4a64c5cfd6db1ab21133e129c8f7ab180f781c6526cf1adcaf8bb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726123, "uuid": "d5bd9a99-aefb-4128-bfd4-4cbaba7fb312", "comment": "Malware payload", "value": "ca639693e9d24bdc32a6edce4f4290aac443180b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726123, "uuid": "0a8bc1e9-672b-4ad4-9a17-43917db17edd", "comment": "Malware payload", "value": "f9dd6c7985c5051405e9092b226d1ac6e8b1acf87c9519c3074fc24be6de4f630f5727fd6f494877512c077f65170ec3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726123, "uuid": "6fbf7eda-fef9-4134-abbd-33c1008d8fe1", "value": "T111B36B5B72B600BBE1778239C8974A19D7B2B8554760AFEF43A0425A1F637E08D39F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726123, "uuid": "185c9c08-5656-45b8-ac91-8db0c6291397", "value": "ceb20e06b162e1cdd50a2dfe6c5688ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726123, "uuid": "4c83f132-e257-464f-a97f-6b5e9f277d43", "value": "3072:3ME0x0yzz4G9Ge4QbpQy0pUb3OTj5YiPWm2QjcUJZQijPG3zbHTEk1pHkuAY:O0wz40eMpQy0pSJhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726123, "uuid": "b60416f0-8ee0-4c86-9947-6ec8aff38b60", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726123, "uuid": "f91e2b21-68d0-464c-9814-f69dd4e7668b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726123, "uuid": "d4c224e8-094c-482d-8832-20bea34c09fc", "value": "d5e77fe5fc4a64c5cfd6db1ab21133e129c8f7ab180f781c6526cf1adcaf8bb0_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c14435c-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776666198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666198, "uuid": "a565b6d4-8362-456d-a45b-8d3c1537180a", "comment": "Malware payload (AgentTesla)", "value": "92f7f74d6b3cf8cbf1dfa145348c631b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666198, "uuid": "4a9b8cb9-025c-4324-a6d1-00d1063c8318", "comment": "Malware payload (AgentTesla)", "value": "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666198, "uuid": "10492a9c-e5b1-4519-8537-ab506e164c91", "comment": "Malware payload (AgentTesla)", "value": "049a4bc863ebcaf2178acf391ac0fee1696730c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666198, "uuid": "017e5171-246f-42e4-84ef-078f178f78da", "comment": "Malware payload (AgentTesla)", "value": "c30e9c49e9482f1347e7bf2afff9a68e0d602663db147f35828f436981b40d088c7c6af28339ffa926f1f87ddb1d96e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666198, "uuid": "60813307-6b92-4c26-8f6f-0e04c207fae8", "value": "T1A7C42F16EA21A42FF453CDB0697996467C2D2D321690EC5BF7801BA930B49ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666198, "uuid": "49914220-5400-4f0d-b3f2-a8fb3237313e", "value": "80c546a8b2b339eb138f820fdf5765f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666198, "uuid": "77fb0f94-7ca5-439a-bd4c-32b305597cfa", "value": "12288:v4eo6+WjBnLUzbVOYVvfhodhFuN24M+/rjNJi:w0+mavfSV4M+/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666198, "uuid": "90a5f883-d259-4c76-89fc-2896e72e6825", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666198, "uuid": "f409deac-dc52-4012-8d43-4efb7b6a1a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666198, "uuid": "31eebeff-361a-4997-b8e1-7a0cf6c1e3e6", "value": "abacus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1628dda0-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674644, "uuid": "f42fcc1e-52ba-4d1d-8718-ee40e3a14bba", "comment": "Malware payload (SimpleHelp)", "value": "36bce9ee2edaf4acab5a11c32a3ef165", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674644, "uuid": "69e85a55-8f7c-4de8-8447-8179c166f342", "comment": "Malware payload (SimpleHelp)", "value": "d621f0c26f35e5a64fe8c10bbdbcdaa024e1607befdc9d363bae4f0583f4e13d", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674644, "uuid": "2f203a1b-bb60-4108-862e-f9e0e8968d8d", "comment": "Malware payload (SimpleHelp)", "value": "76208050cdf62b318746cca7a6f8fc2b83f2c020", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674644, "uuid": "622c4502-c573-4c5f-a6b0-8a5395d5aed5", "comment": "Malware payload (SimpleHelp)", "value": "203125ea864b8021ed7907b042d666f5544d47b054c8b67bf53c655119d5dc283afa610c84f6c10e1852e32a88e23955", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674644, "uuid": "0357dc13-fdae-42a3-8dfb-fb656f1ef3bc", "value": "T1CB773324FAA16DBEDF33D5FCC4464147AA5AA4A70389121327F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674644, "uuid": "04a4af23-ae9f-485c-9724-edb43adb10dd", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674644, "uuid": "e20d77ae-9948-4fe2-8003-b4a2b186dd5b", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcc:K/jkCgpPUK8PyL7M8aE1VWhroHFcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674644, "uuid": "a2d76858-2298-4094-804b-43ef3dd14421", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674644, "uuid": "6fce8e3e-9e8f-4c60-8f41-f9f05cec3235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674644, "uuid": "e820b609-8bf9-44b9-811c-7988d2f9a48c", "value": "d621f0c26f35e5a64fe8c10bbdbcdaa024e1607befdc9d363bae4f0583f4e13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d466e63-3d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776720612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720612, "uuid": "fb39da61-5587-47c2-b23b-24d758e7d62b", "comment": "Malware payload", "value": "6212b443d45aaaeb5127b12cfd353d38", "object_relation": "md5", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720612, "uuid": "0a8fc2f5-21d6-44ce-9d89-12b4e578eb1b", "comment": "Malware payload", "value": "d629db5e142af0cd1b1f02671c07335d4163ee9c7010ab9faad46487c0f02300", "object_relation": "sha256", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720612, "uuid": "fc8e3706-ccb0-459c-b1dc-ed38a0b010f1", "comment": "Malware payload", "value": "ea33b9878b7bfd5dd0ca397d9e65b52b10f1ade6", "object_relation": "sha1", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776720612, "uuid": "8388e889-f5d1-4ba3-8bd6-1b49d1da9193", "comment": "Malware payload", "value": "61e9e85392903847dcb5e9f23a5a30817bcc088e88a82d58f275a17bc99123b69e6296de162b9de71532a6aac963f05b", "object_relation": "sha3-384", "Tag": [ { "name": "2-26-116-156", "colour": "#9AC320", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720612, "uuid": "8af5a8b9-52d5-4ce1-89d8-b4337521e949", "value": "T1E7545C16B7595C78E586C074830AA773AA3674C52F22FCFF029492393E59BF13B39609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720612, "uuid": "d86314ec-0a4c-44db-ae3c-47396839d7e5", "value": "0cb3d7f00665db129f3ca7ed8740e413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720612, "uuid": "b624145b-b7c2-4a66-b178-a5edbd30a7bf", "value": "6144:u0KXAMCC2dSHN5d98jzrmWwDzjYREHsx6Y:u0cYSpmjGPCEMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776720612, "uuid": "7efe5de6-b64c-4a5d-b16d-4945b3f3c3a1", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776720612, "uuid": "4f8dde50-1a85-4787-92b9-625cd5d92678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776720612, "uuid": "d9fa858e-353c-4a20-8eba-e0f8aad535bd", "value": "libcares-2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576d356e-3c69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776655856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776655856, "uuid": "900ed8a5-2854-430e-811d-9f6cdb472432", "comment": "Malware payload", "value": "5fb88c9ce7aef154af3a4b9980e3b8dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776655856, "uuid": "af326240-3896-4dc7-a1de-4c4c397e17a4", "comment": "Malware payload", "value": "d6aaac0882064a916ef174df75b67fdafbf9fd20591a3a0a848e85ed8878de66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776655856, "uuid": "40616b65-79cd-4c2d-9e33-7be43281e60c", "comment": "Malware payload", "value": "1fe8b876e5d9df13010e105209893f918018fce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776655856, "uuid": "2b383d01-089b-48cb-a4ca-950ee0298f41", "comment": "Malware payload", "value": "c3b9248e060cfce52d03fb6599b5826d8a1a4a7981a18a500450a2298ac4cdae1521d191e275246c0e6c90e57d5d455a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776655856, "uuid": "ef165f90-f02a-408e-94e7-71ea18df2f61", "value": "T13965F657E89590F4C0EFE174C726A213B9A13499473437E36FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776655856, "uuid": "0a07f72c-8ed2-45fe-a644-0d3911f6ce41", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+cleR8ddEGm:c8nxDgC7g9rb/TBvO90dL3BmAFd4A649", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776655856, "uuid": "d95ad2f6-2a3b-4230-b7d5-00cc5b799bda", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776655856, "uuid": "f869c228-96e6-4343-923c-a39e8a47be10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776655856, "uuid": "74df5eb9-ae69-4a4e-a661-485d447cce1f", "value": "d6aaac0882064a916ef174df75b67fdafbf9fd20591a3a0a848e85ed8878de66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0320acaa-3c95-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776674612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674612, "uuid": "792afa2e-eee8-487e-8dcc-d71da9c8ed45", "comment": "Malware payload (SimpleHelp)", "value": "f6be9987178097547cac3482c9873a9a", "object_relation": "md5", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674612, "uuid": "12dbb395-2441-40b0-8b91-eda04dd69d0f", "comment": "Malware payload (SimpleHelp)", "value": "d76169f752819c30e8d45b670fed51491afd4bc694664b43817d69adf47afa38", "object_relation": "sha256", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674612, "uuid": "45fa23c9-6a3e-4cb7-b508-0f0407400aa4", "comment": "Malware payload (SimpleHelp)", "value": "a6495eced291fa487f012a957292720069153428", "object_relation": "sha1", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674612, "uuid": "11db10ed-ea97-4946-ac3a-208a0d8c94e4", "comment": "Malware payload (SimpleHelp)", "value": "1d2b48f618d922ec1876d282a5e74082f50772be89d563306d21cef8a258af2ef719cdb62367c7c8a5465ec3649a7785", "object_relation": "sha3-384", "Tag": [ { "name": "185-80-234-36", "colour": "#CA5B3C", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674612, "uuid": "a8353fcd-ed32-4b48-b7f0-8ed82e803a80", "value": "T1C1773324FAA16DBEDF33D5FCC4464147AA5AA4A70389121327F149E68F207D0852FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674612, "uuid": "4f379b3e-6935-40be-a8c4-0f277ee402c9", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674612, "uuid": "e16c69b7-bc32-441e-a9d6-b0b8b8e785a8", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcm:K/jkCgpPUK8PyL7M8aE1VWhroHFcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674612, "uuid": "54cd9951-978c-4ee7-bf3b-97598d0a850e", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674612, "uuid": "a207337a-e1cd-47e1-9b59-1b33d4ae8613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674612, "uuid": "4f9c5d61-2526-48a5-ae84-58a322bac05a", "value": "d76169f752819c30e8d45b670fed51491afd4bc694664b43817d69adf47afa38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc696d44-3cd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776700317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700317, "uuid": "9889bde4-0fc5-4e26-ae95-4f1708f151ac", "comment": "Malware payload (Vidar)", "value": "69d4d7a73c05a16163538902004a67de", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700317, "uuid": "48a2465e-8f8c-4839-9359-7a918739e038", "comment": "Malware payload (Vidar)", "value": "d795ee8809505c7722b9ed56e0e9f4e534d4a63ac845a3fd8e6cb1e8f14c888b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700317, "uuid": "b5ca2eb3-8165-4441-af3d-55434cdec66f", "comment": "Malware payload (Vidar)", "value": "f6f27de6efc9fed845ce80763bd7db3db97f753e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776700317, "uuid": "1eba257d-be7e-41bb-b859-7a7bdfb13455", "comment": "Malware payload (Vidar)", "value": "bda2ec889c063b974fa7019d9771b09b283f108b26e0ea554306d8c643c803e30f96eb068d6deda240966b06f7934014", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700317, "uuid": "d513806f-e66a-4d88-87dc-b9d7430427e0", "value": "T14BA59D17BCD108B6D06A933688F652A27B71F81A0B3273D32E51AA783F7A3D05E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700317, "uuid": "14c9c2f4-5649-40cf-8877-4e40c97c09c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700317, "uuid": "8eff8717-88fe-4ec5-b5be-45061bca98e3", "value": "24576:EXYcS8cHJ60qeCCLQV2rTX3vDfxZ5VdbjI7RD79GizstWiE:EXY93HnC0q2rz75z3q7otE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776700317, "uuid": "f3dbab0d-766c-4dec-b295-c83eb2de87e7", "value": 2150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776700317, "uuid": "b7f1d9d6-b7cf-4358-a338-34512f3f37bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776700317, "uuid": "5c45fbc5-da82-4d7b-beb1-9be31615aec7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184923fc-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776724899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724899, "uuid": "8362dd72-4aed-4729-8fb2-ec6fe07b9d36", "comment": "Malware payload (AsyncRAT)", "value": "b55b7bbd3839add149cfefd5174216b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724899, "uuid": "460d8d4c-3621-48c6-a4e6-00171cba81c7", "comment": "Malware payload (AsyncRAT)", "value": "d9401240286730bce910dab1b50569790f75247bf8398f4297cf2b3a77a3236b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724899, "uuid": "8b900823-6001-438a-8aff-7639cc819dc8", "comment": "Malware payload (AsyncRAT)", "value": "f3d19dc1e66e0f68b0354f30cbcfdab40e36b55c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724899, "uuid": "7eb38b10-3741-4fdb-a691-868e85978fab", "comment": "Malware payload (AsyncRAT)", "value": "edaa3f899c094362f08126498352c866582a048b259e8244394b0b375a3ee4725547d91774195240a417d226abd61a21", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724899, "uuid": "a0df3d30-4114-4da9-87aa-a19a66e247f0", "value": "T10EB34B1B62B600BBE1B78638C8670E09D7B6B85147615FEF43A0466A1F273E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724899, "uuid": "941205d1-21c9-4e73-a8b8-4366eb776d0b", "value": "ceb20e06b162e1cdd50a2dfe6c5688ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724899, "uuid": "e48da71b-d755-4eba-8f82-f4ea151eecab", "value": "3072:/PBNWmctmyGjsQb6QgGk/Rw/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMm1F:hNDctLLM6QgGerV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724899, "uuid": "f7de600d-a91e-47c9-82e1-cd22dd468a02", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724899, "uuid": "a856babb-1d1a-46e2-8bca-bf392250540d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724899, "uuid": "4df39c8c-cee5-4b2b-9f5e-325c7a366317", "value": "d9401240286730bce910dab1b50569790f75247bf8398f4297cf2b3a77a3236b_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc03aab1-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676748, "uuid": "0e57e166-82a7-4733-a595-50b4eefa310f", "comment": "Malware payload (ConnectWise)", "value": "8d1fdc44f9532228a8d72a6f369ab1d2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676748, "uuid": "a43a1be8-ca18-4879-a199-82c3f791fe64", "comment": "Malware payload (ConnectWise)", "value": "d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676748, "uuid": "b790f436-d6b9-40ee-b3b8-8f4a1443e186", "comment": "Malware payload (ConnectWise)", "value": "429dfd298420fa25a0635938c97ba31e868fb8d4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676748, "uuid": "1f4a99c4-f1d7-4e17-9086-48d38d562783", "comment": "Malware payload (ConnectWise)", "value": "3be82fc68b3e21870f9e8be91368317b97bc74f0759d273246758e8023e2acdc6b5729cae54010c7481d5bbf4de24b8b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676748, "uuid": "992e71ce-6844-4fe5-b51d-0e9f308b1218", "value": "T1AF646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676748, "uuid": "38930dc2-d688-40e7-91aa-04962b3890ca", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676748, "uuid": "9d5f3ec9-76ac-4559-a7f6-27ecaa8a8edf", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676748, "uuid": "3a95f684-31ee-4365-ba2a-5cb67bf23890", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676748, "uuid": "567b4b86-6db4-4bd2-83a5-f295dff45550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676748, "uuid": "5174f3ed-afac-48ad-92f1-e74109ff99ca", "value": "d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f232a8-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725965, "uuid": "9b9aaae7-ee8e-45e8-a589-30359fbec4a8", "comment": "Malware payload", "value": "e83f7c65a561adddc29cb4c0f73686c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725965, "uuid": "c79dce46-43cb-4cae-87a2-56a71c6c9d8a", "comment": "Malware payload", "value": "d9f6a4b487a0f78fd25459b9adecc9895f38ef64792bbeef31f814a25f029306", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725965, "uuid": "8a9abb23-cbc6-4bc1-be81-4201200477e2", "comment": "Malware payload", "value": "eaa6d7000f6fabbb66bd9ee429f54b2609f370d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725965, "uuid": "5bd072ab-60c0-4e8c-aa76-eff25a0167f0", "comment": "Malware payload", "value": "10817f0aafb96cdd3ae9fd19b481591077241f4414b288939e828178b71f562b4cb986d0405a4415e4acb0d74ef89368", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725965, "uuid": "78de5b7f-2ba6-42ca-adb9-ec1de3e68d64", "value": "T19EB36B5762E501BBE1779239C9A74A02D7B2B81547609FEF03A4464A2F237E18D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725965, "uuid": "bcd2f572-2d1d-4da1-b4e3-03acb3ea9b68", "value": "91f0ec55a69a7986660a75566b12437f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725965, "uuid": "0cb2054a-c66c-4990-95d3-2fa1fc9687f5", "value": "3072:sR38IKictTKkd2omkS8VKPxmN0kBwZFp0q:sRHKiOF8kSU7dmXp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725965, "uuid": "53d5906b-dbf0-4f05-a594-02a1d455b4bc", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725965, "uuid": "f542cd10-2f6d-4c51-b3af-13d1a2e68668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725965, "uuid": "c4cc73b4-d48a-4a6a-8765-53844227eb2a", "value": "d9f6a4b487a0f78fd25459b9adecc9895f38ef64792bbeef31f814a25f029306_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255e611c-3d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726639, "uuid": "8a8ad839-cb0e-4fb0-b3f3-bd188dc5361c", "comment": "Malware payload", "value": "cc46b208bd8bcbb0abd85d1b1d6ba693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726639, "uuid": "758379f3-24eb-40a6-89cc-eabb0aebd287", "comment": "Malware payload", "value": "da5d5c0dde19a546fdbf901b19260ba21e0c1e179caa001cde6d7bf0a4a62ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726639, "uuid": "68c99311-7504-4aa4-8990-7e36c2a0b493", "comment": "Malware payload", "value": "3f636897ffaee84ef7f9afec4cb43976931c7562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726639, "uuid": "7159d380-723c-4334-855a-bfaa81337505", "comment": "Malware payload", "value": "6ee75c1c7709586265a71b7069009ad89ab03e2a4ceb526c8d5ee5703b16fc6e89bc88a362804fed94bfaa6cc14c5341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726639, "uuid": "9dfabc56-8c81-4ff6-b8f1-d0d922f16330", "value": "T1C43465759B6CCD97C42ADA7E10E98F6B9C7D72DB2205EE127CF49034E985A8B2D43C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726639, "uuid": "a2de1587-f848-45b9-9be4-3b9f0a901f70", "value": "1536:KxK9fm8h5D8cVKLYMrZ+erMvDq+jLyhisTFK+pK7DKrtwp+Vp+wEibLH7NaH+:OSfYLYk9WgTlH7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726639, "uuid": "b565f364-fb63-4561-8ce1-45a7cebe2f9a", "value": 232288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726639, "uuid": "923bdca3-fc8e-490e-bb77-5be49eaddb42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726639, "uuid": "0e782f73-8a56-4f59-bc67-a7184237b6da", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030e36bd-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676759, "uuid": "27065631-681d-49c2-ac21-4cd1013cf273", "comment": "Malware payload (ConnectWise)", "value": "45874cba663ffe673280c1c040569dca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676759, "uuid": "c32769fb-cf58-474e-aefd-45e061aed406", "comment": "Malware payload (ConnectWise)", "value": "dac55656a12f81a67decc838d372175fd976c8d29d3524406f4f608e7a71b794", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676759, "uuid": "91968256-7995-4075-b7df-7e4ec3e37b05", "comment": "Malware payload (ConnectWise)", "value": "51c88d5c69a0d2f9c0ab245afe1ed7e9322e3515", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676759, "uuid": "06c4bcbe-ba2b-42f9-b16e-5da7b49f39e7", "comment": "Malware payload (ConnectWise)", "value": "e47be5a5ffe45ba0db63126a3656e3225ea61de3065bf31867b365284677ae79c13d5145ec0f4cec149201f4fb68e7f8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676759, "uuid": "e22382ca-88cf-4a23-a243-effe6f505465", "value": "T11C646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676759, "uuid": "fb4c12a2-3586-4e40-84a1-7ac9b631201f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676759, "uuid": "141861cc-8ef8-4de2-aee3-73d9c9a0b236", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676759, "uuid": "02f37c2a-50de-43cb-a027-cb653c5c4e1d", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676759, "uuid": "cabce1f1-f581-4314-9574-a926a1a63f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676759, "uuid": "8bdb7628-a593-46f5-8005-9029ce2e6f58", "value": "dac55656a12f81a67decc838d372175fd976c8d29d3524406f4f608e7a71b794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ba1da-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776697681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697681, "uuid": "741d26e8-5801-4a08-ad81-db401feef064", "comment": "Malware payload", "value": "7a3f31657e51724cb5bf106914349a2b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697681, "uuid": "65cb1441-e7b7-41ff-b873-49b164892560", "comment": "Malware payload", "value": "daf217b407e09aefea0cdf82dca7e7c426238a03f8492f4a8ac904091b09f710", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697681, "uuid": "0895a9c3-2ecd-44b1-a445-879b26389273", "comment": "Malware payload", "value": "a79ff5adefe0fcf30160d047d19df9cef8503086", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697681, "uuid": "4e1ac7a6-25f8-4275-8d98-8449954c339c", "comment": "Malware payload", "value": "5290b73f981c5ff4a409aeb4121eb36c519ab89b04725091f7bbadfca69441952d4ee7c5290a6bee8430f3540cdec228", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697681, "uuid": "a974879c-2d86-4d19-8d90-6f8a5ac712aa", "value": "T14DC571304BCB16F49ED7476692AC806353E18E5E9B37A8269C4DF990AC3160CD5BF3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697681, "uuid": "2705d9aa-23a0-4839-8d1a-1819f8388a04", "value": "96:euuagLA3cbxFH/sDTRUdfecxOudqdxoo6Ldaooxo/ya0ibXhXRwoId/tSF:euuagSkH/sDlKRAHfToDElQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697681, "uuid": "2b9e5a99-ff64-4b5a-9004-90c26ba7ea33", "value": 2595608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697681, "uuid": "dfa56b8f-40d0-476b-95c9-61212c0cdc8d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697681, "uuid": "7fe5ff4c-0019-4186-8a11-1928ebe04304", "value": "e-dekont_html.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfa9b5b-3cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776719860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776719860, "uuid": "7e670a92-85af-4e11-99c2-150d44a935e1", "comment": "Malware payload (Gafgyt)", "value": "9dd048f656f0350194b2334960b1238d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776719860, "uuid": "658669ae-fd16-4dd5-8ffe-47f73e0130e5", "comment": "Malware payload (Gafgyt)", "value": "daf726a0c68fc24afee3c80cd0ac68adcc9874b6b2315aa07692acb475fc4882", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776719860, "uuid": "bfb145b4-6e04-4d59-83a8-9ed001b3b567", "comment": "Malware payload (Gafgyt)", "value": "785dd9eb51d8ab1c72402b2610a315a5c08ae220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776719860, "uuid": "773cffaf-2cb9-4118-a917-ca285dabb304", "comment": "Malware payload (Gafgyt)", "value": "1ee0a1e545d05d250cc2d996e2c1e9d5a26dbc5befc829e14c66e2726aaed1dc543bf940f27b969d76519a1d4f13f46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776719860, "uuid": "02ea8935-b797-4e36-8182-924c33f4a52f", "value": "T12A83B4197F310EF7D8BBCD3745A84702209C5B1622997BBABC74D518FB4A54F0AD3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776719860, "uuid": "529ecbe0-d10f-441f-9fba-2869408dc652", "value": "1536:/H2cHJONniygawR7DzlbpmFAkguRzxp2ZeWZ/1:/HtpO4JNpbpm5x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776719860, "uuid": "1f0da536-d7b4-407f-9df9-f6ad32e9229e", "value": 84316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776719860, "uuid": "7cf64138-357b-42b0-8052-21d1e9686e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776719860, "uuid": "6783dbb8-17b3-491f-b2fd-ca59edba9cfa", "value": "rhombus", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc319da-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725844, "uuid": "0f3334a5-f74b-400a-beea-e720ed323c49", "comment": "Malware payload", "value": "ea12c9ddca308f888c01a5c654e286b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725844, "uuid": "0f6ea46f-7a36-48c7-b77e-7ce7f9cbc1f1", "comment": "Malware payload", "value": "db1b906d14e30bcc140b8decfc3bfa598bcd66914c5bf17daae482aa1a0ddaf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725844, "uuid": "9c36aff2-3230-41b1-aeec-1f6b6c6ba227", "comment": "Malware payload", "value": "d09d4f4a2f3cfe171572fab90bbed243a9f4de20", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725844, "uuid": "9baa41cf-9d0e-4eb7-861e-5045d436a249", "comment": "Malware payload", "value": "e95b97e4d51c614c2c8c111a4f5a290fe00f262708df855ef4f7c2c1da771c9810853e106fde020d9e6e9c2bb94f39f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725844, "uuid": "70f7e294-656e-4fb5-ac37-e48d9708983d", "value": "T1F2B3495B72BA10BBE1778338C4670A45D7B2B8414761AFEF43A0469A1F277E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725844, "uuid": "947be361-2c4c-4648-9076-aeded7352a84", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725844, "uuid": "7b0e33f8-2baf-4127-9e05-30dd05e9a595", "value": "3072:jx25AkXaFxZpAnRFQwnLdVQezDZ4CNx5qVpdckVPxIiTlpabnu2:jpkXIzKFpnLkAbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725844, "uuid": "6b70b841-ce81-4618-ad35-48206d98963a", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725844, "uuid": "0a4d4d2c-6a0f-4067-8e59-77ef2b83abea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725844, "uuid": "7b2a13f6-1c53-4264-8f61-dc0f58b3b303", "value": "db1b906d14e30bcc140b8decfc3bfa598bcd66914c5bf17daae482aa1a0ddaf3_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b1316-3c71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776659454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659454, "uuid": "e50beefd-3fdd-4b51-831d-b9ee7f1bfc66", "comment": "Malware payload", "value": "fe66053a1905ab7ab1c2e817924eed95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659454, "uuid": "ba79948e-d12e-40f7-b05b-1049df9d196c", "comment": "Malware payload", "value": "db2b1183a337cdf116ec3158067f70502e4534b6c27dd3a984c0bacb030732d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659454, "uuid": "75786ffc-b174-4550-b8b6-26a07989f3d1", "comment": "Malware payload", "value": "0cf69967e114923342baf9c831e89f20a2d00352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776659454, "uuid": "6a85c4ad-1fd4-4346-b5cb-66db3c0c4c59", "comment": "Malware payload", "value": "b017ff25ce9061bac3d74b49bcb72b29e69e5294a58a4fe83a7768d24d46b2ba0150f6952475ac2f1a5c6e9e33539dc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659454, "uuid": "279b1673-71b1-462e-ad87-919090c06199", "value": "T12A45E657E89580F4C1EFE174C626A213B9A13489473437E76FA18BF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659454, "uuid": "7f0d73ec-77b2-4a7b-a067-fdd86d4367fa", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPlif:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776659454, "uuid": "fde7d9af-2f22-44f6-9857-5ae4ddd96999", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776659454, "uuid": "d3142cdd-2465-4e3c-a390-e66573a930e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776659454, "uuid": "49314f80-f956-40a1-9539-15f13d3fd973", "value": "db2b1183a337cdf116ec3158067f70502e4534b6c27dd3a984c0bacb030732d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e275a0-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776687226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687226, "uuid": "745ac68a-48e2-4e9c-89fb-2bb2c46ce97e", "comment": "Malware payload (SpankRAT)", "value": "cfbf2d6204c7db92e0287567bb53ce81", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687226, "uuid": "1e19a5dc-c2de-4886-9c3d-9bcf639bf9e3", "comment": "Malware payload (SpankRAT)", "value": "db607062132a32605905bf6d4dea6a748724e3cfdf61250e512a958715861fff", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687226, "uuid": "d1b2a76b-2f4e-431c-8582-7c7581ced46a", "comment": "Malware payload (SpankRAT)", "value": "e1507366fb64eccc3183611e83ee3b20d9261ffd", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687226, "uuid": "a84e01e0-c2de-4168-bb46-d04ccc6ef391", "comment": "Malware payload (SpankRAT)", "value": "dd2bd581981182cd1c3dfec2aaded2cfcdb17c708af8c2d82d4e812dd88e5165dfd6be7e6fd990f99a3c0dcf689be9c8", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687226, "uuid": "2a642b89-f155-4c7e-90b2-235cbcc76666", "value": "T1EFB46D13F6994A79D09BC03883479536AA76BCDD0721BAEF07D416203F69BE16B3D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687226, "uuid": "2fe5d78c-8473-4321-ad63-bcb65f29d9e2", "value": "6b49ff5426bfaeb4260b55e0b1b6f8fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687226, "uuid": "81b86df8-cd37-4b3a-b658-a36ca3423001", "value": "12288:bIn4Pl/hfY4RpguCMily2AvK2RzeW1hUTG:5l/C4RpgTMSAvPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687226, "uuid": "a759a635-10ed-4ae3-b63b-5357da82d1af", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687226, "uuid": "5ebd82be-c0ad-4d21-a5d1-ed4a126690b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687226, "uuid": "aca952fb-a8c6-47bd-89c5-f4983a5e5ef1", "value": "db607062132a32605905bf6d4dea6a748724e3cfdf61250e512a958715861fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737bec15-3cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776713885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713885, "uuid": "aaf34cb4-8538-4b31-a321-91b4f4368a19", "comment": "Malware payload", "value": "0dabddb9cbe1c15117e8a57ce0abd88f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713885, "uuid": "a0c79500-099f-4346-b499-48f4dbe37e27", "comment": "Malware payload", "value": "dc5cf42efa0f32fd942f2d714499e5dea790d603d0e377e75c18962e399f30f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713885, "uuid": "6b608864-7bf1-4e8c-8fe3-85c8c7d1f9dc", "comment": "Malware payload", "value": "2317fd7efee6e894c5271ebd0fee3a7890ec8980", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776713885, "uuid": "974e70ab-a24a-4c01-ba26-507729cd0a27", "comment": "Malware payload", "value": "363ba319ebfd3290c1cd85e4b5cd8f596f657f1b4f65e8be6984460e96179803a974957a3315321af03cde9837a87e14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713885, "uuid": "86d6c06b-3d3c-40fa-9b5e-2b2b7adc4dc1", "value": "T1112379EE4A9F72D981824CFCAC24DB11B201719CF2E92610763BDEC7FAB5BC75086525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713885, "uuid": "6b1553e3-b898-47f2-945d-7132010ef742", "value": "768:SsUHgCbu7FjegcpQsOmOPot6Kqr7NmnMn6KdOvapOvBtk9PXBLQ2C:DUHjutegcpQsOmQot6KqsypIk9Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776713885, "uuid": "961caa0c-82f8-439b-af98-c33f5bfa0caf", "value": 46218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776713885, "uuid": "62ae5b21-ac6d-4cfd-8c10-f016b846e54b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776713885, "uuid": "1b588761-e17a-44aa-9aed-9ea61f6a98b0", "value": "2241_NEXO OFICIAL DE REGISTRO DE CARTERA_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95624660-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SpankRAT)", "timestamp": 1776686883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686883, "uuid": "97d43696-324c-4c50-8d51-f776e3efc629", "comment": "Malware payload (SpankRAT)", "value": "eaf539daf6f1f9c69efbd6030eb3605d", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686883, "uuid": "2b7c8cd4-58d9-4bc6-803f-98ee7214bb24", "comment": "Malware payload (SpankRAT)", "value": "dcebc67d362e3d8e8bd2452e9cba57b1c19054899cf4fe42a9d84fa1649ca210", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686883, "uuid": "16e694ff-e71f-42f8-a721-e1f6a04a5d90", "comment": "Malware payload (SpankRAT)", "value": "67290021cabece66889689bff70727fcfb165d24", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686883, "uuid": "a43271e8-c01d-4ea4-951c-0c48a127b002", "comment": "Malware payload (SpankRAT)", "value": "10a83d8606b0d6b8e6b7e00970b96e5a88ffa5b7f89477f5e20b77a953bd6cf82fd1fc460aa5b8882de09f2c59500133", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpankRAT", "colour": "#F9B1F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686883, "uuid": "7c9c3de2-624e-482f-b838-c8493f573be2", "value": "T1B2055D03FA5985E9D59EC03CC75785366A37B89D0B3166EF22942A183F67FE12B2C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686883, "uuid": "2906f423-aa48-4610-921f-985b115c33a2", "value": "91a180c32f0b25ac86163ec9ed546b0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686883, "uuid": "378b001a-ef88-47aa-8828-148bf7ab125d", "value": "12288:sngCm+qyJY/FhjnSxamzrpS4qgP+RLdKFzV9fFx/3HCTMC:8QcYthbSxB4gVf7fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686883, "uuid": "56ecb5ca-5a1d-49d6-9baa-cf4b5a7f7ceb", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686883, "uuid": "d6ebbbd0-3aab-48ab-b4fc-d0a60a25fa2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686883, "uuid": "726a7f40-3b9a-4833-95d8-1b78668ec8b4", "value": "dcebc67d362e3d8e8bd2452e9cba57b1c19054899cf4fe42a9d84fa1649ca210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aaf8fa-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727154, "uuid": "0389bc85-9776-475e-be10-8407fc077f4a", "comment": "Malware payload (Mirai)", "value": "a0f5fbc4f222a7d809b1dccd4530bc31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727154, "uuid": "8c851d39-ffbc-41d4-b02d-100e55413a82", "comment": "Malware payload (Mirai)", "value": "dd0233c9f69d0e1240fe0381e0e08490bb495d7311ceebdcab2ed835cfbb847d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727154, "uuid": "957e12e0-8319-42c7-b551-73bb0bbc7e6d", "comment": "Malware payload (Mirai)", "value": "9f57092ebdb015656f1592ffe1d2632dbe179911", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727154, "uuid": "a83e8468-4548-4ba1-842f-c06072e5f2b2", "comment": "Malware payload (Mirai)", "value": "a9deb2037624dde65f7e13a3cec5f727e5327fc3f8c018e0695fb4ea9a355333e7aaa6d17a5b152b81b79a72fa129af1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727154, "uuid": "c71f3f9c-5ee2-42f3-b487-bdd0e2dcfc33", "value": "T117735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727154, "uuid": "b176d051-4221-4718-9b23-94f45dd80376", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fVc6t:IfmhxCMRkg7IF+7ScA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727154, "uuid": "b922f99b-4145-449c-b52d-b4912129429e", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727154, "uuid": "d57da274-dcd2-4a15-8057-9a1ad00829aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727154, "uuid": "5e917893-253b-4484-bca6-2414b29a8a07", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033c03e9-3c81-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776666022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666022, "uuid": "7d070b06-5613-48b8-adc9-10503a118a6b", "comment": "Malware payload (Formbook)", "value": "5dad10ef6a73d14f37dabce5c29ffdd4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666022, "uuid": "cff122f3-2a38-4706-a6fc-016629979e67", "comment": "Malware payload (Formbook)", "value": "dd1768b5779b29847e91476b77e4b3c506d0a3ff4ac430e0f06292fd1b17a390", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666022, "uuid": "f3186f73-b87f-41cc-bee9-b17ea668e12a", "comment": "Malware payload (Formbook)", "value": "a62cab296f9101f7484b60356d30edc508d0087b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666022, "uuid": "b5c550d2-6bec-4d39-babc-e71ec03184e3", "comment": "Malware payload (Formbook)", "value": "5ec0db9ecb003e7361aef5ce1bca4e4e2e40cbd15019ce3a99815aeeb5d6ef27f4dc76a711b818d1005abc76c2b168ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666022, "uuid": "924c4688-2dc2-4250-aa9c-443d0898a4c7", "value": "T184245B3E0F94003A79B293BCC5787892B91777E23A46979D12B036D40B73D229DD136E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666022, "uuid": "868a9c1b-747d-403b-ae3c-cb315dff8175", "value": "3072:mAHRJq3jCyPq/Yo+FZXSgFQ0nIImASR1eiRYzrk4tTXATBQcNP2qmyP4r:mAxJq3WyPXo+/YdRlYzoEXATBrPm3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666022, "uuid": "67adde60-012b-4da2-a9d3-f844edc17222", "value": 211436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666022, "uuid": "d7271535-845c-4c30-a13d-168b6974c911", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666022, "uuid": "05ee3fb9-bb6c-4c6a-bbdd-b2a3613d7d68", "value": "WhatsApp Image 2026-04-19 at 10.16.11.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42a2ed8-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725697, "uuid": "3e0a53c9-af19-4300-a54a-9fdf78007371", "comment": "Malware payload", "value": "8400c4c5ae1ca586981b2c36a964ba4a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725697, "uuid": "438f9456-7989-46ea-b157-2d726f8adf1f", "comment": "Malware payload", "value": "dd5236252ae24f532d26c91e385cb313bb98f0418e24738d34ff246683cf9216", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725697, "uuid": "7fd19972-7174-4103-aa67-fc184954065d", "comment": "Malware payload", "value": "2599890d91469fa6357636967c98e6371077ee39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725697, "uuid": "cdde7f6f-6e56-4684-ac83-384b5e8b4de6", "comment": "Malware payload", "value": "ee51dd5993807cc78483f4e805bc6c496d4688135f94ea756fd0722ea5c5594556725d5c97bb0177a9e7137f8a868ffb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725697, "uuid": "7457c298-435f-4c85-978f-9916e347fbf6", "value": "T1F0A3495B73E900BBE1768638C4534E49D772B8524761ABEF43A4425A1F233D18D3EFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725697, "uuid": "58a32004-047c-4157-8520-26d31719598b", "value": "3f65ea29d90fcb98cc03781edfc42862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725697, "uuid": "2669baac-41df-4841-aa4c-479367ea7862", "value": "3072:jLe4hllEwXGysQbEAanzB5bKJMblIdj9dLRIXy:W4zlEcyMEAant5+Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725697, "uuid": "2b3e3009-a442-495c-8318-ea5737f8f9e9", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725697, "uuid": "2cb7e746-9f96-4973-a315-5cc64854d0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725697, "uuid": "750644da-bfff-47e6-98f1-341f890d8cfa", "value": "dd5236252ae24f532d26c91e385cb313bb98f0418e24738d34ff246683cf9216_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285d131d-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776687559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687559, "uuid": "6c223cac-cd65-47e2-8ee0-1e8d51dbf137", "comment": "Malware payload", "value": "22cf97016276a4d3bef7d8eaec142ac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687559, "uuid": "0f0d4d45-9ebd-4aed-a0ec-3be8593576a2", "comment": "Malware payload", "value": "dd9e2da1bf7d1d90cfb825deb26fb3c1deeca5785278e782ab3d69717990213e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687559, "uuid": "d12c2239-868d-43a0-b3b3-8d758e9ae6a5", "comment": "Malware payload", "value": "3aac56e2548d3617efc4bdf7bbe79864371aac3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687559, "uuid": "72aac8dd-5cb2-4b25-a1f1-f2f1483ac257", "comment": "Malware payload", "value": "9c74a7ceb3ee4f56820b15d55d88df3b3d650984bed0acc79f29797b91b22754c398c987ee2feed91d7c0962ea61abd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687559, "uuid": "b31a9281-9e8f-4ca8-a938-8e7f459d3aa6", "value": "T17576D805ADC42BF6C82D8B3544FACE9552B05E140AF18A361668FAA9FC772747F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687559, "uuid": "47c027c9-bbbc-404e-9bb2-21fc392dbb87", "value": "49152:hyLLYe0zLPXZLfsvB5Qikyo2Km+YU7pbyIpKtpC5Er:NxGMHItp4Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687559, "uuid": "2d1e9a1a-95bc-46f3-8aee-b45ec3c134fc", "value": 7143617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687559, "uuid": "c65bf65f-a717-466f-a136-ea4c44bb8f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687559, "uuid": "56b7a784-53c5-483c-8e61-a703cda411c7", "value": "krane_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fed58e1-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725073, "uuid": "e659d5e1-4c36-4fa2-8376-c41221e980bf", "comment": "Malware payload", "value": "62ad7c8fa41adaf46437d66a4956ac1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725073, "uuid": "35486dfc-63b0-4b0a-94f2-79e45ee73d80", "comment": "Malware payload", "value": "ddfe289a6b3d63ce1e824882c7eb8cfddcdd6a346535fd65d69f35c0e9293f42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725073, "uuid": "2d77ce4e-e28f-429d-9575-22b69faa1ebb", "comment": "Malware payload", "value": "9d0d94ccb82977dfc27963e28e1385c5e4590920", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725073, "uuid": "d9700c02-0fc5-47ec-bc4d-30c1ff699711", "comment": "Malware payload", "value": "92d85ed5c5be1a27972896ed7742b694d2bf9f7eb9735c71e1a4649c8e434f1b9a3fc7be2af939e83d28ba607b0390ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725073, "uuid": "3ff5c2b1-e588-4e72-aa33-14dcd970fbcf", "value": "T17CB34A5BB2BA10BBE1738778C4670A4597B2B8414761AFEF43A0469A1F273D08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725073, "uuid": "cda07837-e5dd-4fd6-b83b-d84b02c52a60", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725073, "uuid": "9eb36a59-b015-4c89-8a79-6493642f5a31", "value": "3072:7p3QQah85ZpA4rwgw3LyVQezDZ4Ckx5qVg6MckVPxIiTlpEwe:xaabDw53p36AWwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725073, "uuid": "10a4e3b3-b2c9-4de7-a994-333e6e5fa36b", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725073, "uuid": "407a976c-17c9-4e17-8157-45edd7222d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725073, "uuid": "7501e7ba-3ca1-4f2f-ab9d-bc03f834c2a3", "value": "ddfe289a6b3d63ce1e824882c7eb8cfddcdd6a346535fd65d69f35c0e9293f42_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c1bc11-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725572, "uuid": "de3e3310-b3c5-4230-ad29-2826fd56f898", "comment": "Malware payload", "value": "bb721165534f26809f224942a96eac00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725572, "uuid": "b0ad6a0b-494b-436f-b793-ecec08f6d026", "comment": "Malware payload", "value": "de7fa8bfa30a4d4c7957be2a6b843b613c3ff5ca46b1264c37871db063eeab32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725572, "uuid": "0063036e-1d6d-4c28-b99b-fb61976be9a2", "comment": "Malware payload", "value": "2f52834fc1f9d48d8c9b4985507fd1ddc245fd01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725572, "uuid": "01c9c380-61f1-45b9-a5ce-536a9e2b3416", "comment": "Malware payload", "value": "0dd7041ba4085372c266c9048c6a80ae984e2403d2a1ec935462d009c4f3545629101dba44025fcb1f00a10bfd4bf12a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725572, "uuid": "d570c2e9-424e-4832-80fa-9cca3d8a6ac1", "value": "T1D2B35B0BB2EA00BBE1779638C5970A05D772B81557609FEF03A4465A5F237E18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725572, "uuid": "9e3bd74e-7cc8-4e1b-8a45-dbbca7d0d070", "value": "fe6afface4d702d2e462b67c0e2f91e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725572, "uuid": "24c89f40-2d5a-40d1-9fc6-6f8c10d08c7f", "value": "3072:jCiLqnCobdUyn/EXH/dCegzusEpckVPxIiTX0xa+h:dLuPN/EXfdeY04+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725572, "uuid": "c52f4a7d-f595-49e3-819c-024f65a83121", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725572, "uuid": "4191610b-1a0e-41cd-90d9-869fb0a560b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725572, "uuid": "e61998c6-8054-431c-96b1-79b9185acef8", "value": "de7fa8bfa30a4d4c7957be2a6b843b613c3ff5ca46b1264c37871db063eeab32_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0345b9ab-3cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776702959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702959, "uuid": "3824b1db-d940-432c-b294-d6a6eb8bded7", "comment": "Malware payload (Mirai)", "value": "6429603850d048d83336e21c35953fef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702959, "uuid": "ffb04c70-71e6-440e-b321-e068e0e3aa06", "comment": "Malware payload (Mirai)", "value": "de8a25c23e0f02b22b9441161c221773a47c634421bba4a1b82dcee20ba042cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702959, "uuid": "c7f9284f-826e-4503-bfb6-230b94a461fb", "comment": "Malware payload (Mirai)", "value": "02b530099ac6995ea6db4b60e51a863f1a5882ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776702959, "uuid": "79ce015f-0c4f-4c43-91c7-eea0270d1a7d", "comment": "Malware payload (Mirai)", "value": "6717277a533c017bf85593c7bea7d7f8a96eb33d751809bce9c8980bf3642058392497cc3ca754ef3ed2570a9c7ff32b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702959, "uuid": "959fc2b3-d22f-4f02-b254-9c05bb7c6646", "value": "T1D65302614638B7C2EBBCE8B8AC8699964F6B4F3E25917993137088DDD197B13C6700C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702959, "uuid": "b2c210cb-524f-4b6c-bedb-5ac387d5c2fc", "value": "1536:y9vZKLwqj37i8q3/lJy9TujRi0SPLFA2dnripWi:GvZK5jm8qvDlitPLFA29KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776702959, "uuid": "d2bbede6-87aa-4ac2-8646-20fbca0c7794", "value": 61980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776702959, "uuid": "b8e820fc-8938-41ac-8226-3ca58f7cdcae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776702959, "uuid": "c53b78ec-fe4e-4e13-92ce-f03f9cc5ce22", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df1722b-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725016, "uuid": "b3e8cb7e-945a-4f55-8f8b-465c1af13855", "comment": "Malware payload", "value": "9ca0ed43876c52725a22d54791855de1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725016, "uuid": "d70574c8-05eb-4224-b3b9-f3cd8320f79c", "comment": "Malware payload", "value": "deb8a3c387741d25834f3a25e4c0ae2ef44fbbc30871f818ab5b588115eb657b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725016, "uuid": "e9c37302-fb55-494a-b0b2-bb6e0fcfa037", "comment": "Malware payload", "value": "d1beeb42406c9e1abaab903e68fcf38bff3e7253", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725016, "uuid": "ec4617c5-0884-4b42-83cc-5d5a11f29ebd", "comment": "Malware payload", "value": "c041f687f196c2b0d396419d22f71bc0752583195cf1e2f13035d51146d2d734a5ddaee924d1c39f9842c5c60cdf0527", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725016, "uuid": "522f0176-55bc-432f-a557-2be9f292c4ed", "value": "T1DAB35B4BB3A500BBE17B8679C5630A4AE7B2B85117609FEF07A0461A1F273D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725016, "uuid": "8f87e245-e6c7-41e9-ba45-a13c4ec96f98", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725016, "uuid": "5e18c6ce-fd95-4314-aa81-88ca04f7876f", "value": "3072:rEQ8UHW0N9XprHEuXoNLJxSjjtD31Qjy:PWCtuu4s9Dajy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725016, "uuid": "9a92032e-b285-48a4-a92e-bb0c8b80f9dd", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725016, "uuid": "555806ff-f95f-4405-9087-519d8e7a7152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725016, "uuid": "eee35279-71ab-427f-a147-cba3a329d8a5", "value": "deb8a3c387741d25834f3a25e4c0ae2ef44fbbc30871f818ab5b588115eb657b_WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b10a297-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727078, "uuid": "729da265-1b16-4bb8-bb9a-69f1ffd153e2", "comment": "Malware payload (Mirai)", "value": "43a73c3363361ed0a26e7702a1ac8607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727078, "uuid": "524a8665-f241-4e27-bb9b-d9c5b3f576dc", "comment": "Malware payload (Mirai)", "value": "df0bb778608f33dacc106430a7d7b7ff117c7a80ffe0c9d108cca8d71633db14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727078, "uuid": "98babb3c-04c4-4ac8-a235-179a7871fc4f", "comment": "Malware payload (Mirai)", "value": "ced2f94755e9e055fccf54de852dae004f32ddbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727078, "uuid": "44184fdb-26a9-4187-a03f-eade7833188e", "comment": "Malware payload (Mirai)", "value": "3cc6b6119ac1aec990103a3f62623023e38d7f6ddafced91810b123eab7de2578044ecf6167fb0e8f59b6551650133f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727078, "uuid": "cca9ae75-0715-43c1-a038-8cd11c1182fe", "value": "T1E9F2D00789884707E17E0A3A9CBEB74E1941D62DF9C0BCA789F1B4674802B1D9D1EF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727078, "uuid": "213e19b7-16f4-43be-900d-baa0234801ce", "value": "768:mzbGjwng3vdO5994SKAT1M1bVnykwtYcCrV5PsqnbcuyD7UHQRjx:WdnA4994SuTykwKcUUqnouy8Hyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727078, "uuid": "adbd0143-814a-4a6d-9144-3253fc0efa55", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727078, "uuid": "52581b69-8a63-4362-ad95-1f34c78e398b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727078, "uuid": "45875d41-1feb-4bed-a9ea-2b47a01e2321", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65639302-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776697540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697540, "uuid": "ae70b97a-0ebe-46f8-bf7b-1aeae7dd65bb", "comment": "Malware payload (ValleyRAT)", "value": "14d5d449a91f2c31e06f32d345756363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697540, "uuid": "993bf079-c6a7-4018-901d-3c68d2d84098", "comment": "Malware payload (ValleyRAT)", "value": "e0002f6ce06c3cdbad7fc298d23c93270ed3c641e1f55f03190675fbf5694fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697540, "uuid": "d7e3e5f6-3e7d-477f-9ac1-980f5830da95", "comment": "Malware payload (ValleyRAT)", "value": "98da186f24ae1abc66e12e56461a6cc2586fa996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697540, "uuid": "09949431-6a2a-4864-bb1c-36ac02b5834f", "comment": "Malware payload (ValleyRAT)", "value": "8628d97244dc10a438c2c3e57d7c366392104070433669e6b59d88486f8011a8332c1a4ec17540ff26f382b06dd0e932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697540, "uuid": "83662b7d-e14b-4890-80c2-85f2024abd47", "value": "T132346C21FD85C132E593113096B5DBB60ABE7971076441CFEBC42A3D2E64BE2A67831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697540, "uuid": "877efd6c-f7e2-45b8-a2d2-b69fa588189a", "value": "f00eed2fb27d554bc204eb9de3e24171", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697540, "uuid": "6d0e7213-e514-417a-a240-899fa91ec5c4", "value": "6144:Ghj29biepfx9nvoLx6vJ8fjSUDBJrmTKIFGhVWKKJZOFrw:Mq/pfzvoLM3UDBJr4KcGzWMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697540, "uuid": "fe1b20ec-b7e0-40ea-b7a7-2bbdb6efd977", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697540, "uuid": "c5552e64-05de-4005-a98e-912e6bb85c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697540, "uuid": "6b801fca-34f3-47be-850e-45932045a98a", "value": "14D5D449A91F2C31E06F32D345756363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40164682-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725395, "uuid": "b32e5da0-d752-4d21-9f63-b954b4ac0221", "comment": "Malware payload", "value": "25f086dd89e22d4c4189207187507c8b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725395, "uuid": "87c7a734-2f01-4b09-b1e7-a8d89808f994", "comment": "Malware payload", "value": "e0268bf23020fffb39927c437d520e4d5f3e50ec1ed89bd518a06c7605a01e82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725395, "uuid": "177e0c3c-6b2f-4c39-9c60-0f3303ebcba6", "comment": "Malware payload", "value": "4f1c20ecbecc5e19d2a7581ef596093756dae95c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725395, "uuid": "637e952c-6fc5-42b9-a6aa-bf88a9a66c33", "comment": "Malware payload", "value": "c3775d995c531b3d47a294f927c616b435723d6b0461d8ae15b7335eb31b4b31ba19b1f296ab668fdc59f0c1265e875f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725395, "uuid": "5c25e9cd-2366-4b2d-9d78-cfb4ee5d38ab", "value": "T147B35A4BB2E500BBE177923989670A46E7B2B81157609FEF03A4464A5F237D28D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725395, "uuid": "0c3f3c6c-f5a1-47f0-8c65-672760b3db1d", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725395, "uuid": "048eb86e-c4ee-4ff7-9fad-7086e433abc1", "value": "1536:AErS28AvV9hYi2pQ8paAk8FdkTH4S1s8BKJ6TocMJUxETsWhXdM9dlrzPLP5jBK:nvz68dA1Fd4Yu46T/MKxmNkVzPLP5jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725395, "uuid": "40002561-4c38-4627-ac92-b0206d30d7ba", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725395, "uuid": "cacdee93-992f-466c-90fb-16cd97192659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725395, "uuid": "d1659b9f-4a18-4bbe-8268-c3383c41fe41", "value": "e0268bf23020fffb39927c437d520e4d5f3e50ec1ed89bd518a06c7605a01e82_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b560c50f-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776687367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687367, "uuid": "efc87066-b0bd-42ee-a067-2d98d1be33a3", "comment": "Malware payload (AgentTesla)", "value": "b8120d1878579d94128d2a1640e44107", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687367, "uuid": "530cd3aa-a3d7-4c8a-89c5-a8e5370ced40", "comment": "Malware payload (AgentTesla)", "value": "e060c3b7f6e59dfb5fdd8fa268dad27a31f1df9d9a1a7503f4ed48f4d92d76cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687367, "uuid": "36f9d44c-fc06-409c-8773-cd152cebb1cd", "comment": "Malware payload (AgentTesla)", "value": "4cf2dd0004ca5df83f3e58fa88fd05439b9b04fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687367, "uuid": "c9490307-52a8-4840-947c-da460e3e6dcd", "comment": "Malware payload (AgentTesla)", "value": "88744b20535a1140cdd6475f6c90b26daec2621b99046470b76b1a2eb6f724e88394147d17f71d4de6ca21c09e73ca52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687367, "uuid": "8cbda838-4243-4a3f-bbd7-788becd7511c", "value": "T168566218D0A6B00D58D2DF5AA562D0F148CF786F2E0F8AB7A02F957C1C56F93D91268F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687367, "uuid": "4ce01d11-9376-48e2-af48-1cb038ec5142", "value": "98304:C3FNDSD3IakX2vNLiceSV4vv9+h9+OMwVaRYj5qKehYoFERuJRBl7aV6jp9jrcoh:gNQ3I72vkc9KvviAOMwVF5qKeWQEsRBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687367, "uuid": "bb059286-913a-4dcd-8103-66e36b14570b", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687367, "uuid": "0a6063f2-199a-4c58-ae28-082d67b4c562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687367, "uuid": "ef8df2df-8741-4686-b329-f5b70bb50eae", "value": "Remittance Receipt.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8b05e7-3cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776686892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686892, "uuid": "e9fe3e81-315e-4dc2-a0f3-a08b777a5376", "comment": "Malware payload", "value": "2b268945a623435713dad8ea2efbb869", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686892, "uuid": "7c016c13-b3bc-45e8-b1c1-91468f9d66ce", "comment": "Malware payload", "value": "e090de60f8295b3282982c38263371162004749fd0439b5a645f9ad80c2b0a0a", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686892, "uuid": "6219447a-e626-45ae-982c-e35b12ab6c01", "comment": "Malware payload", "value": "68266bd7e63356fc9b8d845d5b7d86418b299574", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776686892, "uuid": "ec91499a-debc-400d-9691-85fdf7ea7458", "comment": "Malware payload", "value": "ed899994bf793e55febaaf4682eea9f3764155fc6bf5a69b3a8bde119e2c42b05ba2bd354520e31114d23777996b9613", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686892, "uuid": "f6a3c9b0-4b6b-46af-bda9-978bdb9d7f05", "value": "T11F055C03FA5985E9D55EC03C87578536AA37B8DE0B3076DF22842B287E67FA16B1C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686892, "uuid": "db425faf-d743-4fc4-a833-38f789e6d3b6", "value": "15e2d3ee06a87e88abfe586a3e6675c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686892, "uuid": "9317ecd4-11ee-4093-b4c1-05383ed74f0e", "value": "12288:IW6tZrrytghCO5WN9nuAjHm5r4V1FlNh9+sm5vH+JBRF:8tZrrecb549nBerZ39aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776686892, "uuid": "c568149b-5dc6-44f3-9c82-251cce193ef2", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776686892, "uuid": "53aea3fc-f6aa-4c17-8656-457cab4e6d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776686892, "uuid": "f53ae4ac-03fd-4fd0-9f7e-5d6df13233e0", "value": "e090de60f8295b3282982c38263371162004749fd0439b5a645f9ad80c2b0a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1396abb9-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725750, "uuid": "e265300e-e72d-4fd5-bd00-81e41b4e27aa", "comment": "Malware payload", "value": "50da77725aa6190bc49722e9d2f69713", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725750, "uuid": "f8ec6eed-590c-44b3-9332-3b34df1a28ec", "comment": "Malware payload", "value": "e1336fd9d1a22d26e2edc3c186dc9d157dd03c833a28dd0cfccb0e58cd1c5a2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725750, "uuid": "d94cb61e-fdc3-407a-bdf2-1d6b779e2064", "comment": "Malware payload", "value": "5ad166bfc4fc1f623007f60d36dc5db92319297e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725750, "uuid": "6f02a17e-2172-4a6c-89a3-c2de18685639", "comment": "Malware payload", "value": "65d22b105d5ca180c58d091d2cd24f1c8929f4547ddd85a799f909fe1779dc0f0836139405cc92168e18a1f9e37e88e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725750, "uuid": "938144a2-ba56-4bc1-bfaa-67a46e6070aa", "value": "T147A34A5BB3BA40BBE1768238C8570A45D776B8455761AFEF43A0425A1F233D18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725750, "uuid": "41a30498-57ea-471a-9caa-30a450447daa", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725750, "uuid": "93ea48dd-ac57-4c7f-97ee-c8e041271a17", "value": "3072:vunU5V3RNUOiGyAQbnA8i9tIoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHXvGq:Oe3bUT+MnA8i7CGc06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725750, "uuid": "0648dc19-ba8d-485f-89f4-c44304e9d4c6", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725750, "uuid": "6a98beff-2aa4-4b52-9505-c5423ca64eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725750, "uuid": "529d8b8b-64f6-444d-8093-9cad5709937b", "value": "e1336fd9d1a22d26e2edc3c186dc9d157dd03c833a28dd0cfccb0e58cd1c5a2b_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6523a669-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776688091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688091, "uuid": "c4c3b7bc-5a89-41c5-88bb-32901af4f7d7", "comment": "Malware payload (Mirai)", "value": "cc7472331e4846537fb84ee306d7e8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688091, "uuid": "b029bc72-1eb1-4854-bd3e-60ff35105d52", "comment": "Malware payload (Mirai)", "value": "e160606358362aeb58906e73e05efd6d1e8420263d2d8478b6875845266f06ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688091, "uuid": "8e2ce50a-4da3-4774-aab2-260373a64818", "comment": "Malware payload (Mirai)", "value": "ae69d5e0b1cfeca653610277ae1c5d8c2b0c03c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688091, "uuid": "a72c0056-f2d3-431e-b83c-b2e3dc1329b8", "comment": "Malware payload (Mirai)", "value": "e81987f74da9f9c20ea0cba06bdb49e62b6f39de12392da94a0619e6241e1c651a3bec9d644d8cdb5d876874aef28e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688091, "uuid": "91559042-4d4e-4cbe-a5b7-8d0603893fb4", "value": "T1FA138EA2C06DAFD8C1488674B8284F781B53E445C7536FF99AE985A68047EECF60C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688091, "uuid": "5c7ae4a9-7cf7-4e0e-bcda-011fd1ce5aa3", "value": "768:NanapGwtbGbh/EEZYePDznRVrgrq7OhGdv/qzCvoBJbCb:Na4Gwtq6ECrq0Gp/qzLLbCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688091, "uuid": "77c86fa6-bff3-479f-9cd4-088bc48126b6", "value": 44348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688091, "uuid": "1437744c-e321-4ed8-ae64-ffd629f58fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688091, "uuid": "362b8022-b683-482c-a8a6-e789e8e3bc7c", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c1f026-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674081, "uuid": "e0804ff4-8e53-4d60-a1f0-a479889b52a7", "comment": "Malware payload (ConnectWise)", "value": "d0fa14c9479b3009ddcac090e065f256", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674081, "uuid": "723293d2-19ce-4b4f-9358-ee90be03aec0", "comment": "Malware payload (ConnectWise)", "value": "e19d04d129630b1dc516ea9869b0870af3412e2b42c71a5854f2215c8ca1f63f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674081, "uuid": "dcd5cff7-d1ca-490a-a813-3f558530a112", "comment": "Malware payload (ConnectWise)", "value": "4ca9ca1a96d6a1fa81ca8b75f6fda9460c3bdbe3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674081, "uuid": "f6a9f5e4-589e-45ac-9dcf-9c770192bc3d", "comment": "Malware payload (ConnectWise)", "value": "1de7b7dcdca609e44d76eb609cad0a67d2318f285e6b51b00555f58c2ca8b7fb4549f59eba9fc68fc44b0449f0373cd9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674081, "uuid": "03b127b4-dbd4-446e-8a50-0f1cadfd44f6", "value": "T127D62311ABFCA668F0F62A35EC7A6470A1767C159D27D12E2324790E2D71E80C9733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674081, "uuid": "b997104f-be5a-48a9-aadf-001ff26104e2", "value": "196608:0Hxcp9ym3nltDUJVvHxcp9ym3pHxcp9ym3VHxcp9ym3ZHxcp9ym3uHxcp9ym3GHk:SGplpoGp7GpHGprGp8GpUGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674081, "uuid": "81ab21b1-0562-48f8-adb1-1e28d7fde53e", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674081, "uuid": "1c076396-4bac-46ef-94bf-d7fd858ac401", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674081, "uuid": "d5e1c24b-518c-43a5-a911-377472189eab", "value": "e19d04d129630b1dc516ea9869b0870af3412e2b42c71a5854f2215c8ca1f63f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac8a644-3c7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776664854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664854, "uuid": "10b93d7e-863a-4206-bad0-a4d0ecf0d4bb", "comment": "Malware payload", "value": "34d01682aeb14b3fcec86b69ec501007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664854, "uuid": "bd37a75c-ed55-4f2a-9591-52245c683cf0", "comment": "Malware payload", "value": "e2f9498b2a873ffa0f09a6a8e041510da799f3567cbbb5dea334fedec75ea16d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664854, "uuid": "5adb5d97-fb29-4536-8845-c833aad7af4d", "comment": "Malware payload", "value": "5a422762869f63265c6f50216908641b71c241c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776664854, "uuid": "46c819bf-08e8-4e12-9814-c6446bcbd598", "comment": "Malware payload", "value": "7b6d824980687a19a1dab61e99c9179c9b9a3be660ec3f9dceee3f704d9395a3ae0a291a49b28e4e3acee11685f0d509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664854, "uuid": "19eb54a5-b202-4eeb-a675-3aac7fa737f7", "value": "T14685F757E89590F4C0EFE174C726A213BAA13499473437E36FA18AF11B26FE466BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664854, "uuid": "9e441637-bfd7-4b49-ae42-72eed628a212", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzG:cqYUQuVD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776664854, "uuid": "334fd9f9-d5ba-479e-a087-66b22666f7e5", "value": 1802240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776664854, "uuid": "9d297395-5a7b-4e55-912b-52a101df4901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776664854, "uuid": "bba15e1e-f4a5-4c8e-b1af-e847df5a7538", "value": "e2f9498b2a873ffa0f09a6a8e041510da799f3567cbbb5dea334fedec75ea16d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bd7938-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776697427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697427, "uuid": "b4853ecf-a3a0-4350-8a97-90264683c668", "comment": "Malware payload (Formbook)", "value": "90eb4544e1509b6b1d942d1b13578b53", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697427, "uuid": "0e2b4f57-073a-41fd-ad3e-fdd6d31361b5", "comment": "Malware payload (Formbook)", "value": "e34026dc1422cbc2708192df2d577e1de13971f43b826e68c1c4cf0ea813d696", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697427, "uuid": "5fe69e78-c31f-405d-98d7-caca67ad4d79", "comment": "Malware payload (Formbook)", "value": "0373176783d213834be53f109f81ea108ac59a88", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697427, "uuid": "dd21f48b-a239-4752-a026-3181af0ca5c0", "comment": "Malware payload (Formbook)", "value": "b566036eb32dc06441029f70b817f5bca6ad86e19de80d861c5d98e745fbfa07ac3203c31430d3c6257a7c4affb997a7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697427, "uuid": "420ed1ab-c73b-4310-8b95-8e2278a5dd75", "value": "T17B95021189C46FB9CFEC561D90FE1A0EA3F04A8A501A798AE733BD47EFF7504521B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697427, "uuid": "49001e69-7972-4841-92e0-b9e1a50bdda1", "value": "24576:NHB98BvGa7VGvJ+aAsKWC17b0OE8+YV6MqhX8EjOVGF9Ae5ePnJXSFlTDCnO6:Bi9Q7KULrslGXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697427, "uuid": "7a0f53fa-6a26-4522-bb4f-689303990afe", "value": 1917233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697427, "uuid": "a22a25d6-005d-4a9b-a049-7e97ae13b5ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697427, "uuid": "0d547925-ace6-4783-8e7e-25630f76b4eb", "value": "AGIMERO #AG2026032.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae080e7a-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725579, "uuid": "ddecd6df-f0a2-473c-8b29-59405de2bc37", "comment": "Malware payload", "value": "dde9b5aa3d9b44c3a56762697603fbc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725579, "uuid": "82703cc7-303f-4b95-aed0-12d6b1610832", "comment": "Malware payload", "value": "e39b82aadc9e5db230dd0bf2730113497bebf395c09b4ec4c3e2ad9e325499ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725579, "uuid": "5b2e2e54-f21d-4d5e-953f-1b8979fad9e4", "comment": "Malware payload", "value": "7d3e156bf4e07cc4d4bdc84e8dd011c18f1c1575", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725579, "uuid": "ac260211-bd7e-4a6a-b5d2-f2da75993da3", "comment": "Malware payload", "value": "4b32f833ebf7e5197543ecc297702650c7675acc7b27b11e940cbb1d7556913904fb18c41108c022aba712449085634d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725579, "uuid": "c022fc61-be3f-4f3d-bd75-7e5275fec18a", "value": "T112A34A5B62FA10BBE2B68638C4930A19E772B85547605FFF43A4465E1F233D08D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725579, "uuid": "700c48f6-13c7-417e-beca-678877eacc2f", "value": "bc80dff36b8f5a610e743276dfcffdd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725579, "uuid": "78a14974-b143-4bd2-8397-0a2a869fd34f", "value": "3072:HjRoTuKPYGd9QbAQR+aw0HWvmXO/2iePL3zfbHsYr//TGWwd5175c7SG4ex8lZEJ:do6KAkMAQR+701gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725579, "uuid": "39c98fca-f6f2-4541-a90b-156f8eeeb6c7", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725579, "uuid": "421a13d5-6428-4182-a033-9ee2c3dd3903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725579, "uuid": "dca8c83a-3c2d-4463-9ad6-48cd53a067d1", "value": "e39b82aadc9e5db230dd0bf2730113497bebf395c09b4ec4c3e2ad9e325499ce_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba24c4a-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704906, "uuid": "185d96c9-6ab5-4bab-b55f-fc8a43e0c60a", "comment": "Malware payload (Mirai)", "value": "11fbea50e7d263ad7725b8cc554e2db0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704906, "uuid": "059df51e-f591-4c27-842d-935aeb9caf30", "comment": "Malware payload (Mirai)", "value": "e3b618a50211f008856dfe9b147961ffc0dff360fc6fad9d12ad22739e5111de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704906, "uuid": "6fa8d162-0a80-4ecd-ba7c-8ed40415bc94", "comment": "Malware payload (Mirai)", "value": "94a017e4de4c820416e5be122fa05aa35ca45b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704906, "uuid": "62648962-1318-4435-9868-9e0d4abf0c74", "comment": "Malware payload (Mirai)", "value": "0b2725008e34c01b6ba7cff23df8c6d6c0654aeb3f384ea0c64d22978013d9e79513f4ff44246c58b6efd4f957fd1a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704906, "uuid": "c08ed5d5-efc4-41c7-88df-8953c1850150", "value": "T19F83295AF8814B21D5C512BAFA1D164E331307BCE3DE72279E24AF7037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704906, "uuid": "d58c7287-3ea9-45cc-b5c0-909a6f45523e", "value": "1536:mpnP5zSAWnxKBig+Th7824kkbkqkP9aaE8tUcZI4iz2ZIPDrC7LO5LYtR:GzexDXJMkP9aaEB2ZIPDrCnOJ0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704906, "uuid": "175bb909-e7d1-4a23-a199-6f2fe1702a17", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704906, "uuid": "8dd9d215-2a7d-4754-9aa3-e94ed47f635f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704906, "uuid": "7ecb5bc2-7c21-441d-9ce3-5155061dedb7", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b33cab-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725299, "uuid": "318acd6f-feb9-4a50-a24e-dc637bcb4b86", "comment": "Malware payload", "value": "9f26abeae28ed4c1ebb6f5e58885af7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725299, "uuid": "dd2b431e-2c21-46df-9c14-a5d24bd7a4a1", "comment": "Malware payload", "value": "e3de9346491d8922e5cc364a8ca5c4d647d72c4a34aa26d1758c796a6e3e1bd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725299, "uuid": "2ce019d7-4e39-416f-a10c-b42818309314", "comment": "Malware payload", "value": "7e7642adda2784d3c3b876ab75595b9ec0276c71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725299, "uuid": "dad002de-d1cf-40e5-b380-f1dd44b93ab9", "comment": "Malware payload", "value": "9164f94b2a12904a1fb321ee535d2af1259614f57a762edce4da1d0708ef779967232e21c5891463696b3b2b79b69606", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725299, "uuid": "63071e9d-0d28-446e-883e-5c78ad61ab2b", "value": "T18FA34A57A2EA00BBE2B68678C4530A4AD772B8511760AFEF43A4425E1F273D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725299, "uuid": "d5bcac29-493a-48a0-98df-8a39af0b943e", "value": "e8c034d08212abae7541a812ef5cf01c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725299, "uuid": "8ad0fac2-bff7-40df-a425-6da2f3e97150", "value": "3072:hMTeXQwDasaAmiTQhAS/xYN0751756565rnIryH//C9cK:MeXbuFaTcAS/0dPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725299, "uuid": "9b7edf05-1666-46e0-a70d-2734557fa911", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725299, "uuid": "7ca7a40d-4612-4e32-87a8-ec8f5476354d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725299, "uuid": "91f3d7ed-fde2-4efc-9166-76b0d9942061", "value": "e3de9346491d8922e5cc364a8ca5c4d647d72c4a34aa26d1758c796a6e3e1bd7_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0b45d1-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724883, "uuid": "ad6a685c-1873-488f-9ae1-f8be8409f462", "comment": "Malware payload", "value": "754c39dcc52aedce4f482f103a9da22e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724883, "uuid": "7411792d-a7a3-42f2-9377-890dedbc1faf", "comment": "Malware payload", "value": "e41848d3ec6aebb34cd634bea9b7d096fb287910b65b5b9c5c0975592958a716", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724883, "uuid": "38d70550-8057-4686-8847-3da544b13286", "comment": "Malware payload", "value": "82a4b8a663e72c241becabd1807ed7f4471b736f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724883, "uuid": "36afe843-6394-429c-b7a1-5f8edfbdc32c", "comment": "Malware payload", "value": "e583825f75d52698f44a3fe40208c5af027099142160df51625ccd64650955867f8b728e69c686b4d91a56514a87b653", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724883, "uuid": "9f2cc412-8e55-49ac-ab9c-20512979fe21", "value": "T187B35A5B62F900BBE1B7923885A34A06D7B2B81557609FEF07A4464B5F233E18D3DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724883, "uuid": "f94269f5-418d-487e-ab74-52d281a40570", "value": "af93398ff2c69631f757153568f7cf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724883, "uuid": "31e5ae03-ac95-4148-8cbf-6b9ad9c573c8", "value": "3072:kx1oll4YSI2bdOASdo5Xj+ZsIV1dqO5NEWXc:w0lLeAdoZKVL5GKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724883, "uuid": "9a8741cf-8fb6-44b6-970a-a0ddedbe151e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724883, "uuid": "d23a1cad-80f8-4493-944f-f58eae6f6f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724883, "uuid": "887ac86c-9e0f-44e3-b51f-bf8daea0e30a", "value": "e41848d3ec6aebb34cd634bea9b7d096fb287910b65b5b9c5c0975592958a716_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f780f71-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725474, "uuid": "55e41a22-157f-4dd0-b82c-9cf964c05f18", "comment": "Malware payload (AsyncRAT)", "value": "e1f607fb30721f2b1b140f99ad83c015", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725474, "uuid": "7b0bd24b-9674-4a30-8ab3-277045c6e042", "comment": "Malware payload (AsyncRAT)", "value": "e41f1af836b7573725758186407dbc21293186683e75582563f6760f8aac1a46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725474, "uuid": "ff2014bd-4aeb-4fc1-ac79-66d1ec7b0441", "comment": "Malware payload (AsyncRAT)", "value": "da7724481949a427e79906aa1e2cfa1a4e15cb6c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725474, "uuid": "1d8413a1-5a81-4028-bd11-d8e4a23d1b29", "comment": "Malware payload (AsyncRAT)", "value": "cbcdf632a6b21b0e66eeca4d202a02272f2a9a5121c524d0dbd4287e2921a8d848bd600fd855a847e47934f06a57dff6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725474, "uuid": "d8d70e0d-1f35-4876-b204-0c065ed93b19", "value": "T164F24D083B944225D6FF7BF65AB375020770F5039913EB8D4CD89AAB6F67BC045047AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725474, "uuid": "01ea6293-f2cf-4f34-9d1b-539092da7d74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725474, "uuid": "83f3ca14-23e0-4cb3-9908-d605c547cace", "value": "384:sQL75gwVpuuIzSlgRg3J6LN8n4eMFbVcp/6AaK2MAU07pkFMAfNLTYOZwp3V2v9k:NLFgGJ+mn43xcOMvbFJ9YmOMhP35zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725474, "uuid": "b6f6072b-398e-4aea-bc0b-1095d4b88677", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725474, "uuid": "7e11250a-5692-4ab3-bac5-3df8ea9c1dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725474, "uuid": "985ad2d4-e045-4db1-895b-86e176ce87fd", "value": "e41f1af836b7573725758186407dbc21293186683e75582563f6760f8aac1a46_be14456a-fe02-4f24-a18f-4d15e8c8bed6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5addcf-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724937, "uuid": "2fc510bc-b37d-496f-9d0d-e6a6ef312921", "comment": "Malware payload", "value": "0094269dbc63e8528e8ad13996910c38", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724937, "uuid": "4fee4f34-d523-427b-b308-afc6cd556da7", "comment": "Malware payload", "value": "e43f17c314b55fd5cb523284ee2f132942c9a4dc28e917acd67c16901135586e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724937, "uuid": "b802328f-4642-4e1f-975e-93d59979e237", "comment": "Malware payload", "value": "e6828778602d87aa06e0cc758b6a760b198b5875", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724937, "uuid": "1542551b-cdd7-4267-8803-f43fa757a215", "comment": "Malware payload", "value": "bd53332b65eba0394ef9668fad1e7e03ec04ace3ee46a74caa4895b7f7346cda5377c999489fcd80d7e51d3c1f1d78d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724937, "uuid": "c22c44a3-eeb5-4f74-a664-80f8654d9dbe", "value": "T194A34A57A2BA10BBE2B68638C8570A49D773B8551761AFEF43A0425A1F233D08D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724937, "uuid": "f3566733-84a2-4d45-ada4-cda64c7226bf", "value": "500afcac24ada5096b15630df71ec442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724937, "uuid": "9fd3772c-794d-4bb4-b30a-2d9de0115ce1", "value": "3072:qj7FEVRoWiGqsGQbXAL/QiY72GWwD80p5wCDvmXT7RLyzfWC+YmSO/2nePGyufbb:q9ELobqGMXAL/DYUkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724937, "uuid": "d2a6d09c-67b4-4096-9d99-f4cc3b97b14c", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724937, "uuid": "88a9224e-dc3a-4acc-aefd-c20154435ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724937, "uuid": "6630e771-ad34-48eb-a236-68dbe29523eb", "value": "e43f17c314b55fd5cb523284ee2f132942c9a4dc28e917acd67c16901135586e_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213b44d8-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724914, "uuid": "35004987-b623-4975-a04e-891ab4ab9316", "comment": "Malware payload", "value": "76e566a492f899ec9d937c20ac1d5049", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724914, "uuid": "e90dc28b-4505-4c07-83fd-a2645a613014", "comment": "Malware payload", "value": "e45f4d649d694882af1817d65a15654b0ca49b109047c26ad6e5de19966cf51c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724914, "uuid": "dd36ca61-83e6-4132-bedb-4c3a7e5a29fd", "comment": "Malware payload", "value": "2085ecfda95a25a235e558fa6e786d105bf9fea4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724914, "uuid": "25a3034b-114f-491f-9589-fc9b63586147", "comment": "Malware payload", "value": "0c1b512ed2d1677652a2b88bb6792f954078da36b10e9bf8b19e14683c3bb5099a4c3399aca5c496f86b27a3c0f73c35", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724914, "uuid": "17f595f9-6e5e-42c0-ab4b-2527d0b695a4", "value": "T11BA3495BB2B600BBE2B68638C4574A45D776B8454761AFEF43A0426A1F233E18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724914, "uuid": "3501c0f0-80e3-4489-9240-0d51347ee518", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724914, "uuid": "b38e15f0-ec46-49d3-a638-720702eec395", "value": "3072:0lbNPzHPB/+WGPlQb6Ab7y35oyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHPvGt:YHZ/LWM6Ab7kZMBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724914, "uuid": "2eb5e99d-ad75-4439-a424-eb359f1aee2a", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724914, "uuid": "f184c72d-bd04-43ef-8257-914e0d248802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724914, "uuid": "0657a1b7-2daf-43d8-9aa6-5c5501c0344f", "value": "e45f4d649d694882af1817d65a15654b0ca49b109047c26ad6e5de19966cf51c_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbba64a7-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725710, "uuid": "9050eb4f-76ae-40ad-9d8f-550b0797a1ae", "comment": "Malware payload", "value": "942e4f07b71c2d8f0294d0aea990e86d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725710, "uuid": "003fd4c5-2262-42e6-8761-5146928756b8", "comment": "Malware payload", "value": "e4a41a7b0264270abcab9d10dd303a08f29560df0f05a89b346e1ad08804a82b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725710, "uuid": "87c300b7-2c7a-43ee-aada-891c592b8fd8", "comment": "Malware payload", "value": "83ba82968f3cc8d73320c58e032eb810baf43904", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725710, "uuid": "79eb0b05-b4cb-4ad5-9283-e7a5bb7c9e4e", "comment": "Malware payload", "value": "5e0f9eabf89ba1b92560041d6c2881130c02027566f33b57ec65cca87631d47c02086b42ef2041b250fccf5ed3d0b684", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725710, "uuid": "6e2c273c-b784-4e33-bb24-ea55a7c2aa71", "value": "T18CB34A5BB2BA10BBE1738778C4670A459772B8414761AFEF43A0469A1F273E08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725710, "uuid": "9d24fa6f-c3b7-44a2-a5fe-32ba19fd4d22", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725710, "uuid": "69a6099b-d696-4e4c-9984-135271b24600", "value": "3072:w3QQah85ZpA4rwgw3LbVQezDZ4Ckx5qV+ckVPxIiTlp6S:iaabDw536XsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725710, "uuid": "7b774fea-3ab0-4863-9c1b-40a478705223", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725710, "uuid": "d526eed6-26c2-46f4-a183-0ced0d3c9204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725710, "uuid": "dc2e844d-1112-4eb5-b305-9acfe2335f53", "value": "e4a41a7b0264270abcab9d10dd303a08f29560df0f05a89b346e1ad08804a82b_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeaa39d-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776697422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697422, "uuid": "0498bf5f-a082-48a5-9fb6-f160076aa94e", "comment": "Malware payload (AgentTesla)", "value": "8791137e89d3c835a1ee1d14f5894fc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697422, "uuid": "8b369fdb-e5e6-472c-815c-748849896dce", "comment": "Malware payload (AgentTesla)", "value": "e57a86c1abcc3fbf9a9b3b7226796e414ece2d0d072d556bf55e9a3f98c695c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697422, "uuid": "daf47109-e529-422a-bd57-ff0ee57f70ac", "comment": "Malware payload (AgentTesla)", "value": "cf9122f84054dfb57fdc688b515e53b7d8746944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697422, "uuid": "0a8debb4-d3df-4e06-99a2-4e742ba4e65e", "comment": "Malware payload (AgentTesla)", "value": "2a61ae5ea5757a23ed16f10b6955e42e92691b8b6c8ddcb09d2a24a36856af18549ccf78d19feab978534d91f57d0674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697422, "uuid": "483debf5-e38e-4501-a607-959e76e17d1f", "value": "T17F566208C0B4B5099ED2CF5EB967D0B0899E786E1E0DC9B3A01F957C3C56F9399106AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697422, "uuid": "34c1ac40-440b-4af9-9a22-614d11db5480", "value": "98304:+8EbDN+8Fy7Jk9stH+fq8ECBA/eJCcGNwFwDXIQVJbXEYR2YDCSiBSHXJGh3jnQG:abDo8Fy7qCei5GJCnNISXHTXhJDMo52/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697422, "uuid": "4e2452c1-591d-4cd1-936e-217381cc3764", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697422, "uuid": "4bbf0ebd-e687-4d51-9f36-9aa405fa7ad2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697422, "uuid": "3abf2476-28ef-4c01-8bd0-8095c7bf365b", "value": "INVOICE.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c965558-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727161, "uuid": "a9526106-f24f-41b6-b6ff-a240ce867833", "comment": "Malware payload (Mirai)", "value": "da1e6cbfa8480643c746cc72e2f73ae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727161, "uuid": "e6b0c38b-4244-474b-800b-6c2f28a87678", "comment": "Malware payload (Mirai)", "value": "e5b4e4d6a6ec9450c176d1783640dee0109bf38cd16f0ae0c4d31b465b1394f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727161, "uuid": "fa6fcf44-65c3-44b7-bb33-fa117a82375f", "comment": "Malware payload (Mirai)", "value": "5d66cede0215ba54564ccf24109e746656cf78f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727161, "uuid": "6e74b673-3dc9-4266-9c5f-2420d2e606a1", "comment": "Malware payload (Mirai)", "value": "5a6b489dcab1aa928119bea367a012afbb548d957bf9a58412e4cafa6fb3f00c4ac87ed2abe4301be5c98080e76a6a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727161, "uuid": "b89bf86a-a0db-45e6-a942-a6a983189c27", "value": "T1BEF33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727161, "uuid": "e48afd75-7c85-497a-9e35-3f48f50f8a4c", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6MjKHDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6OKHDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727161, "uuid": "588402e2-8cbf-4bbd-87b4-d18aa50c1f64", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727161, "uuid": "2d8fcf13-bfc3-4fc8-9e16-554a44240211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727161, "uuid": "7009bcb0-bf2d-4df9-858c-bfa7027388b3", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65638a9-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726077, "uuid": "f48aa63b-1902-4441-a22a-55a6d2ff8bcf", "comment": "Malware payload", "value": "468d766881dd1b676a6a33dc952e9d80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726077, "uuid": "b0bd69a7-e65e-48e9-ab06-08a787b21c73", "comment": "Malware payload", "value": "e60aaad86f7b34683979a9391aa31333207c6011d96b9fa2cfef262f6ee6c4ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726077, "uuid": "6ad45192-4df5-4ac8-b6a6-af0062672384", "comment": "Malware payload", "value": "e43cfd11184a36e9f0087714718505aa6eb62493", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726077, "uuid": "8b3b4c02-51bb-4c94-be92-396399e8eea1", "comment": "Malware payload", "value": "17148cbc1398b6820e37633e49cd6f525a648f8a2fbf51fcb69f8e8ad807247942087b9b6dba3355c3cb0e4593bffda4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726077, "uuid": "69b92079-1676-480c-8b34-b89f1b408691", "value": "T14AA3495B62EA40BBE2768638C4630A09D772B8560761AFEF43A4425E1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726077, "uuid": "513ee4c5-6b4d-4a2a-b22a-c9c8eee2a314", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726077, "uuid": "42057be8-0f09-4240-b736-5ccbb97b4120", "value": "3072:Gtd4yN6xpAqJQVAvfhxtTrB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51pyV:qdJkTB4Anh/uXdvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726077, "uuid": "19eeb181-75ec-46bc-90a1-1d39f97f1ec0", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726077, "uuid": "2f7bada2-3909-4b0f-9927-873edebca259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726077, "uuid": "4e306b39-68a9-4064-a1e3-a0012f34c728", "value": "e60aaad86f7b34683979a9391aa31333207c6011d96b9fa2cfef262f6ee6c4ef_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275634d9-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676820, "uuid": "aba0e45a-cb2b-4450-805e-6bdf7e2336d1", "comment": "Malware payload (ConnectWise)", "value": "61978ed87c3b50fc88f73c3aa74c3ec9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676820, "uuid": "6097b006-7e37-48d7-861b-f43469cf5e86", "comment": "Malware payload (ConnectWise)", "value": "e6cf3ddb7616525c303b9b02c692a37017af301ce88656e080a0306877e4a8af", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676820, "uuid": "7875d82f-abfa-4282-a0e9-c962f7f6bc4b", "comment": "Malware payload (ConnectWise)", "value": "efe501f038b464eb320da93886aa27b79282a811", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676820, "uuid": "3e52458e-b668-4053-892c-23a2ea7e5cf5", "comment": "Malware payload (ConnectWise)", "value": "92e0abaaf29dc6cf6268b21eead1c987d47f28bbfabf8429d1e99c329446f990663dc0d0349e3de3c266778e7dcece16", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676820, "uuid": "9e742400-4de6-499f-8f6d-c61bd58c7ef2", "value": "T120836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676820, "uuid": "079e30bb-efb7-4264-8edb-75af279fe00a", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676820, "uuid": "8ff70804-7c4e-49d9-892e-541c46499566", "value": "1536:poG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYp7jJe:zenkyfPAwiMq0RqRfbaWZJYYppe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676820, "uuid": "58f132ef-91b3-4b9a-aa41-7776ba32a81a", "value": 83336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676820, "uuid": "e9237d44-bf2b-4ae0-bcfe-ad4f86247e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676820, "uuid": "b43ede39-09cb-4330-a0c5-07a700eb36a3", "value": "e6cf3ddb7616525c303b9b02c692a37017af301ce88656e080a0306877e4a8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe625d4b-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689207, "uuid": "65ad52fd-ffb8-4cdd-8001-8aa510e8d822", "comment": "Malware payload", "value": "86a33a81ea20e34ca0ab78b4d21b5a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689207, "uuid": "cbe64970-81a7-4520-a617-43cdcf284e5d", "comment": "Malware payload", "value": "e6dc0e3229a1fa43bee721ab2165f36c18b9b5668b11f04de33d66490d240bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689207, "uuid": "fa38bd81-3fff-477c-b596-d582a94bc744", "comment": "Malware payload", "value": "aca3e4a5ff09dc52198c8510072f2b75df882e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689207, "uuid": "48e97986-729d-4514-8d9e-6ca60c44ada6", "comment": "Malware payload", "value": "a43148ee626be317cbcbd0f82580a426ddb6e4191d268349cb23632a4e3c6dea950f69a96d75a1816104681aef87c7cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689207, "uuid": "7da711df-127a-43ee-b82e-c77bbf803a09", "value": "T1E1B601D524C001BCD497CB34C1892AEDF2997AA94F75A41F7FC605422E339C6C9B6B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689207, "uuid": "639fe7f8-425a-4175-9d6e-1a44ae8b3b7b", "value": "bdc67eca7b3fa4969a9e1c93c5f30b62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689207, "uuid": "32ad9e58-b730-4f2c-b22c-06131ba07032", "value": "196608:KlemsFVOWeI0bNph9YCYCTojH+TWHms9wzWeI066Cx3kTL//dJjIZc:SoKhKCYCTojHBfQkCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689207, "uuid": "befb38e7-3f75-45d1-b1fe-d5c3189cf509", "value": 10432232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689207, "uuid": "c1b74441-e103-403e-b54f-4a628eab9571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689207, "uuid": "50aebed2-6161-4cb3-a44f-d9838c40661f", "value": "e6dc0e3229a1fa43bee721ab2165f36c18b9b5668b11f04de33d66490d240bf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397fa043-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776689306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689306, "uuid": "8091f73e-8385-4098-b80e-906b7343926b", "comment": "Malware payload (Gh0stRAT)", "value": "ce532f5c12deff2b3ed96360e496d0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689306, "uuid": "ee5ee9c8-3496-4ba7-a216-bfe1c8fc07bd", "comment": "Malware payload (Gh0stRAT)", "value": "e860ed332d1aa74330c61149893f59f97a288e14049801105b2a6d12b871f7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689306, "uuid": "ef70eecf-c1fb-41f0-abc6-3f06a6ed9d43", "comment": "Malware payload (Gh0stRAT)", "value": "ead5a41eba3c04de88431ecfab8662c963e19925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689306, "uuid": "9b9a6ea3-6f03-401e-94f6-5543e432b75f", "comment": "Malware payload (Gh0stRAT)", "value": "a9b19790fc1e43bd5d9fafaff97dd5f758b4a532250c2c1b7f904566315ec0dbb5eadf3cdbc9f280969d4131483f4ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689306, "uuid": "4c8f117c-6496-41c9-adf1-abb3a69cf6b4", "value": "T165B73323F5CB853BE4BE81724AB3E262953BBE1068268C56C7DC7458CE352D25C3E257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689306, "uuid": "a63d388f-6bf0-4005-ac66-12f8269d727a", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689306, "uuid": "61c1283f-7175-47d1-b5db-9dde575200cb", "value": "786432:UV3Yn5EcZ+FJp2QDclXyTWKYpaGhIwns1rDjI88o5R4ZP5C8dt03ttZalz8ygC:wYnyyUP2ZiTeaIIwnQnI8d+Zu3ttZZNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689306, "uuid": "2fcc0475-6851-4442-affc-2beee232c62b", "value": 48138976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689306, "uuid": "e22de414-07bc-43a6-9abd-6422ff995f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689306, "uuid": "2e8bfc63-bc79-43cd-a619-010c8201221a", "value": "e860ed332d1aa74330c61149893f59f97a288e14049801105b2a6d12b871f7b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609bc92b-3cf6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776716430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716430, "uuid": "514f9715-eb76-4a4a-9953-3160d7d5615c", "comment": "Malware payload", "value": "e79c1f2c819027bd2a6e11d0fabd54fd", "object_relation": "md5", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716430, "uuid": "3c62411d-be6d-461c-b6ba-0d27c9234afb", "comment": "Malware payload", "value": "e87c3103be2079bc1dbda71c675a717cd2da21615876d8661f0605cc5f9b8392", "object_relation": "sha256", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716430, "uuid": "73cfe272-38bb-4fc4-b256-bd51c575f150", "comment": "Malware payload", "value": "13217e9e9494ecfcb6f7a3106456265313f38dd3", "object_relation": "sha1", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776716430, "uuid": "3e14c4e9-4392-42da-893d-8ae53aadf35c", "comment": "Malware payload", "value": "d21ec39fdad6bfa40678f86e77989b5cb7f3adb004f4dae3ca74ed6a2271ab621710166d2fcc650b2bda173896d294cf", "object_relation": "sha3-384", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716430, "uuid": "713eaedf-e1c3-43b7-a560-464304559a54", "value": "T164F73309BB3DAD34FE342FFE74116AAB97015C42B79D5200B22FEB78CA5621584F658C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716430, "uuid": "4860afbd-7028-47c8-9071-4315ee70af82", "value": "1572864:Z1OlWIVN/AqkU6D50ainKH6ciE9W3a1fNl1nNt6N9eFRqt5:ZklijX2ai835vfN/nNtc96Rqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776716430, "uuid": "e88837f3-a4b8-4eb5-9070-149c215d48ae", "value": 75072595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776716430, "uuid": "6de0a140-d16d-43d1-a234-1c1de0e65671", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776716430, "uuid": "4a26c0eb-f75d-46b5-927c-06ee295d87e5", "value": "DivineX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d1e37-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725457, "uuid": "192681ec-884c-4019-b659-0f8f4bce568e", "comment": "Malware payload", "value": "8bcc5e427320b2a720f67a8de6aa4e82", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725457, "uuid": "a088496c-04eb-4e65-a004-b51f54a59bce", "comment": "Malware payload", "value": "e8e8529baebd03895b401963a0606295954f532a76b6f049548a9a5b6321e66f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725457, "uuid": "2130ec5a-ba66-45c1-b1f8-88f9ea4ca077", "comment": "Malware payload", "value": "74464652cdebc2a5991cca47cfd9b7f7fa030e0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725457, "uuid": "51d460e2-ee33-4db1-8f31-950023ed9477", "comment": "Malware payload", "value": "7e5a93c2a5c932098d7f8031c21993d11f0ef9099bf4ed17e2a9a751f3bd6d814bc8f8219ee7180d64fc3bc122051cfc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725457, "uuid": "69693292-b755-42e0-867d-b31eced91150", "value": "T1D0137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725457, "uuid": "95aa982d-8d54-4eda-bcf0-9f67422f1843", "value": "768:bu+c9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bu+Rcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725457, "uuid": "e3113d1a-8f77-47e1-8283-140f3c9ab020", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725457, "uuid": "f71f6b59-d4ea-4fde-9cb5-656695668675", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725457, "uuid": "a0faa969-7001-4faa-8606-8fd5e1d6ba03", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec43b26-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724963, "uuid": "ac7e8f4e-d418-4c48-9106-6feea75005cd", "comment": "Malware payload", "value": "98806863dd17aa9f1ed35392b18cba55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724963, "uuid": "556c3593-d923-4dc6-ab8e-7e46a2b81a97", "comment": "Malware payload", "value": "e95821952c985634fb5ad257023960d4936b9d33a449d2fd02c847f829f27af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724963, "uuid": "3475e67d-6934-44f2-a886-a68882cf3e9f", "comment": "Malware payload", "value": "6f7e54de8f6854e5cb15dd64a985f04d22f64863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724963, "uuid": "b8b3aed7-08d7-4190-a3e6-9fbf93cad280", "comment": "Malware payload", "value": "468b7551938b504815da66b171f35f66b7f56a23b02cdb3c3704b66bfa1ca75d454e41ab287b8779d1ea127c98bc582b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724963, "uuid": "6d4f0614-03c0-4cfe-8968-187493319fec", "value": "T1D266DF97B27800F4D077C53D8A1A9207E6B035898B3197CB16904B6A5F23BF69E7DB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724963, "uuid": "e0ea6517-6842-45ac-9f29-7efda075e1ce", "value": "1502c6bef062461a792d512991194f99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724963, "uuid": "fb2bd973-1d07-45bd-99d5-1f457a744a82", "value": "196608:VJ5JQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVRTKM8VP+nUMZni4zg:VnJQaPHrQqXs140qMhu8369sV+HLz9SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724963, "uuid": "8df71125-e3ab-4131-a064-b6e03ce6da88", "value": 7112192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724963, "uuid": "6923ce19-c876-4913-b970-f793fc63a640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724963, "uuid": "9750fae9-ae16-4d25-a520-b2c19c4d7fc0", "value": "e95821952c985634fb5ad257023960d4936b9d33a449d2fd02c847f829f27af2_708934f2-f9c0-41ae-ad67-a98327be8e89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a349d4ba-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725991, "uuid": "a69d5712-789c-4d5d-aab1-1c9ba349bf8f", "comment": "Malware payload", "value": "6495b872377af7d565e80d197c72880d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725991, "uuid": "be4462a4-d765-45c7-914d-db062eb70e38", "comment": "Malware payload", "value": "e961928a98071cfafc928d15f7e9e6a648f1b0eeabfc1959985c722771ae358b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725991, "uuid": "60fc0d25-a880-4ed6-bb18-6a044fe5892e", "comment": "Malware payload", "value": "3eb2368a5eaf858b043efe12205aa98ce4ec6ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725991, "uuid": "d8d4f254-299d-4ac3-8b96-c146ecf3ecbb", "comment": "Malware payload", "value": "eeb56658f3a4d020656b46c9b58d7f7b57e12745785c9c9df75ce811aadbf92944c320e5b36c340f78856b18393bb25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725991, "uuid": "41160913-22ca-4dcf-ac19-979565286f73", "value": "T1D88312DA85A37990FD9043F90397908DDCFD04E451E0A246534AB11BE8F87D52EF5AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725991, "uuid": "2fd1822a-b98e-4cee-b477-362d7815de20", "value": "4f2949c764ac3f86fc7cbe63e8408cf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725991, "uuid": "4ed372cf-7044-42ec-ad19-7f65693e5b89", "value": "1536:qRRnUd2dai4PMqIylhfmWv+kf2ANopP1wPbmWrnicRCXGfn2AHF:qPUsdai1qI6RWkuANoV1wSWrKIPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725991, "uuid": "d6ccadad-4116-432b-95cf-9cb677b61361", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725991, "uuid": "a2fea2b2-656d-45cd-9204-d184babd69ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725991, "uuid": "01350ba4-4bff-4f14-9636-813295a42955", "value": "e961928a98071cfafc928d15f7e9e6a648f1b0eeabfc1959985c722771ae358b_435b78da-8728-4d5b-a417-6a5003bf46b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7914bbfc-3ce2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776707881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707881, "uuid": "14d92c4f-cac8-4fae-b396-b3b5c421da12", "comment": "Malware payload", "value": "82d37e2ac3e32267e80d86e62ed5f2c7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707881, "uuid": "c2d73cc8-34c3-4d2d-bf63-227f32496528", "comment": "Malware payload", "value": "e9858188fa398d10078fc99a7f67ad16ae3d05132b4e08851be09e36ec640c5f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707881, "uuid": "362c6783-1f15-4cea-ba44-a02ba720d3c8", "comment": "Malware payload", "value": "0a3303aa1874df75a8ac725d730352b555d7e7ee", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707881, "uuid": "774cd987-051a-47b3-8005-bea44aa3dc4f", "comment": "Malware payload", "value": "914066338b6442a4118e4c431df781e78468fa57d3fdc4ab6d4f4cbeccd87c8990c01e91b74b62b6547f09e7966562aa", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707881, "uuid": "30221381-b5d4-42da-b0d1-c4bca35f70ef", "value": "T192D344CB89CECAED57BF6028461F6C52CA8F6513141ECA50BB5EBDA03F15CA071AB5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707881, "uuid": "975805af-690b-40de-be6f-7fa542b69e70", "value": "768:Cy1HuDXl6tXPo4tlCUdI0Aa2lmEsvBkc5xZIZ9CbgO7qeixyYUPg5T55BeODOu0r:5HlDxgfFiiD/NH1Zg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707881, "uuid": "9da91f4f-dbf1-44c4-af02-805fbe399a6c", "value": 138265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707881, "uuid": "d32ed648-a8cf-4386-9822-057acd7cbd9f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707881, "uuid": "84d9b420-422c-4c76-b583-3616678b1d71", "value": "USA_Audio_Clean_367.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558dcdfa-3cad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776685058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685058, "uuid": "d0490433-9a23-464f-a42f-e064e3118c6c", "comment": "Malware payload (Mirai)", "value": "8f0123cb64f05698bc7cf5266394addd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685058, "uuid": "e074fbff-cab8-4eb4-8c9a-eee37c511fbe", "comment": "Malware payload (Mirai)", "value": "e9d7c87b89f29913acf802db4f01b3338b6613149091865470b110436811ca55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685058, "uuid": "15cfe32b-5644-4b93-bd29-a3a6c5d1b830", "comment": "Malware payload (Mirai)", "value": "a218ddbe11359e448e45aad13b5207110ff94f61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776685058, "uuid": "cbf70169-919f-4d28-b6d1-ffe0814a62a2", "comment": "Malware payload (Mirai)", "value": "1a437c0e2f1c290464d858261e28675b50f1d01834a20fa501badab7fc5be1b9d26895bff71c470513862365f67f1566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685058, "uuid": "fc356456-dc09-4246-97d5-686378f9e26d", "value": "T1A3141E31984CCA87C526167D60E9DF7A8F7E72CA2746CD227CD450348AC7EAB7916F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685058, "uuid": "2abde796-9097-48a0-962a-8250e4cbc23b", "value": "1536:xjLua+rE8x9W+K2eMZcnVfK35WuF8UNNSCtCz7ieTlK+pK7DKrtwp+Vp+wEiwBBp:RLua+rEy9DK8IY3kUNNSceTyr9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776685058, "uuid": "530f2e8e-6052-4aa1-8c8d-055d337339d7", "value": 190560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776685058, "uuid": "838f579b-e1b1-4bb4-b7bd-680f49c285cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776685058, "uuid": "63102be6-c198-44ef-9075-2ce9b5246345", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb89fee-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725255, "uuid": "31661163-bd4c-4227-8009-f21dae731f4c", "comment": "Malware payload", "value": "54de91de99afdc5db07ef5c0594874ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725255, "uuid": "fbd1f8f7-28eb-4268-82a5-d989647de853", "comment": "Malware payload", "value": "ea5dcf8089792414c561eac4972434e01efa8caaddb0a02a5277bc13b292ca44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725255, "uuid": "1eeffee2-80a7-4916-bc88-34f5a03372b2", "comment": "Malware payload", "value": "d4a9eddf4b87d95c2f79e439836c34ce732fbb02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725255, "uuid": "c5e930dc-3fd8-45ed-a0a3-389512e5b4ac", "comment": "Malware payload", "value": "c2bf0a7a6448ce25de1388ac32943fc20e160f58d4b467992cb7568654e9adbd66a5767d81398fc02e8838265fea63ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725255, "uuid": "294f1b27-107a-4dea-bbff-fc1675a6bf8c", "value": "T1F1B34A57B2BA50BBE1778378C4670A45A772B8414761AFEF43A0469A1F233E08D39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725255, "uuid": "7e6f7216-880d-428d-b737-f14ae5748c4b", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725255, "uuid": "f0c9e2d9-3b0e-42dd-8a66-2b94ec639af1", "value": "3072:6TTXxQHNopvHzzSgG1VQezDZ4C/x5qVy8IK:AxA6VzXqkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725255, "uuid": "5e51ec70-480b-43c2-b824-5a2ea693e9cc", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725255, "uuid": "dd80f7bd-3dc6-4c8b-b912-64e4b5a7516f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725255, "uuid": "3eb3adf7-40cb-4ec4-b92d-63292fbdb76d", "value": "ea5dcf8089792414c561eac4972434e01efa8caaddb0a02a5277bc13b292ca44_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429d343d-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776673860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673860, "uuid": "d09ec518-307f-4c8c-8f02-19bce0b86286", "comment": "Malware payload", "value": "23409ea2709c2f3bc911f2c6f4ba98e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673860, "uuid": "05808884-4e41-4d17-b766-a2cf1a99cd80", "comment": "Malware payload", "value": "eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673860, "uuid": "0118f689-77bb-4b94-a389-015882459252", "comment": "Malware payload", "value": "e30f3ec62fc8dd7b8c617baa0bc5cdbb7d29268f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776673860, "uuid": "981356f6-8ce1-4c26-ad6b-9d4a87e28861", "comment": "Malware payload", "value": "3ff8f9a010f5509fb2c5a8d7993339820160de86b339de80ecc5be2966a08c04173ecd47eeb3d4591f9667fc650bc6df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673860, "uuid": "56fb71e2-c55a-4a16-9cba-5182fd3d74d3", "value": "T1AA74199B689550F4C1FFE134862AA212BDB13495073827E72FA146F10F26FF95A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673860, "uuid": "e5981410-611a-41d5-9e1a-d90dbe37ed99", "value": "6144:c94NsgaeLCfHqHc6c5EBr777mMsIRbS54:ciZLBtBn77RDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776673860, "uuid": "3782ad38-1199-4731-8e21-dee9623df764", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776673860, "uuid": "347826f6-c7bb-47d3-b549-95033d3e75ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776673860, "uuid": "f1e6ab5e-845f-4d5b-b35e-92610154b132", "value": "eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a25032-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725218, "uuid": "a79f6b15-0d88-4309-9b35-9fb3455c9cfa", "comment": "Malware payload", "value": "a9b2f7e8aa77b2e00266e58762327fb5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725218, "uuid": "8432eae2-06a8-48f3-828a-633389a26413", "comment": "Malware payload", "value": "eb06c308ce8ec17c5d257d5b31fd54ea38ce91fc7a5b2b27e5d5c68acc2f6087", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725218, "uuid": "791725a3-957c-4dbd-83b8-8012458c72e4", "comment": "Malware payload", "value": "c82835e18a85ab2b43eab0a87893fb784309ba78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725218, "uuid": "bb95cd1b-936e-4a0e-a014-7e8c3bf68854", "comment": "Malware payload", "value": "e47b16f43d154349ffd0b8dfd926e24f613eba63e4d25b70a429a7add56cb4e5b51ad7921ee22c430e794f64a8e09769", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725218, "uuid": "6d1811d5-5fc8-4448-b87a-7b9eba835ca3", "value": "T1B9B35B57A2E600BBE27B8638C4534A45E776B8514761AFFF43A0425A1F637D08E3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725218, "uuid": "e7527364-2d16-4fe7-8cc1-453833ffc5a0", "value": "17d9f6dc5709bc89a29a2a965c42f00b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725218, "uuid": "38b34feb-2cb7-477f-92e3-e171493e6ba4", "value": "3072:Nk13Gp2s7ACfpGu/QbNwdf9djvmSO/7njPL3cIbHD2GgNJlLJKNrycuFb39MaT:NkEpNACxdMNwdf7ZxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725218, "uuid": "e2fd017d-c34b-4a13-a43c-c43d83881559", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725218, "uuid": "dff8a76b-1879-4aea-b60c-8b6c6fd09ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725218, "uuid": "e940c663-65ca-4fae-941e-ff4b79a85877", "value": "eb06c308ce8ec17c5d257d5b31fd54ea38ce91fc7a5b2b27e5d5c68acc2f6087_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976f467c-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776697624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697624, "uuid": "f193780f-91c4-4374-9c5e-0056a201b349", "comment": "Malware payload (SnakeKeylogger)", "value": "ca45d588d6a7a039ed5e5d42a47b2e36", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697624, "uuid": "87211d3f-37c0-42ba-bab4-70af54075b91", "comment": "Malware payload (SnakeKeylogger)", "value": "ec628a344ca23797543cc30fb41ad4e016e3c7c2c9803d802e961adadf407d5e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697624, "uuid": "759f8aa5-f0d6-45aa-88c4-44d939ce31a1", "comment": "Malware payload (SnakeKeylogger)", "value": "980435d5810f8264359ac72070870d3749a8e2c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697624, "uuid": "b602b4dc-9421-4225-82a3-e540c5a1da0e", "comment": "Malware payload (SnakeKeylogger)", "value": "1da50082ed95a19c7fe823b5a8673ffea7151ef28d8c11a9d78bafff386302621ef80f6336c0c1bb563a5a3de0799bd5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697624, "uuid": "5c384fe5-9a61-4f45-91e7-e6bae936528e", "value": "T18E050249A9C47FB0DB58151B707E154AB3E4CD8A901999CCFFA3BC5DBEB7B00912A09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697624, "uuid": "7392e0d4-fa2d-4f78-90b7-ce49d6773655", "value": "12288:04rNu6K1IBOvRlhgNyNnUtBQ8SHMWRe1KJI7uexh3glu+kMIUVQflkU7+4S0:04rJJNyGWNRMSllkhYO77B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697624, "uuid": "f43be583-2140-481e-a6eb-426acfe247b3", "value": 845209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697624, "uuid": "1035fd90-4d64-4db8-ae38-46882cff112a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697624, "uuid": "7dc59932-39d8-4dd6-aca0-b7d716dac303", "value": "RFQ_Order092374589458.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417f8d83-3c9b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776677294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677294, "uuid": "9fa6ed63-f992-4b40-88f0-ba247d78e86c", "comment": "Malware payload (XWorm)", "value": "4ccb8c9a32a226bc87c66749aece68ef", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677294, "uuid": "8ce6c92d-2a24-4332-a692-dfd5bc02194d", "comment": "Malware payload (XWorm)", "value": "ec679ca968f9dd657508d96247d0fe49500126ddbe77c1d934c812da5e063902", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677294, "uuid": "f82c68b5-0927-4f76-a276-201befba9d80", "comment": "Malware payload (XWorm)", "value": "b2cf43e7346d67604b48864ed75fb663187e2080", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776677294, "uuid": "0940530f-d9d7-467f-b9b2-c502563bf9a4", "comment": "Malware payload (XWorm)", "value": "9a157b9a99effda08809c9337c3138d78c6806d4af2db057e9684a4dba1b0bf72a80e5b9032109ace448c53db4b8c981", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677294, "uuid": "5c855f32-5018-4c11-8ef2-28e36022f9e7", "value": "T10433B0131ED6858528F6759A8E0AB51FFB4CD1F91798E2DD138EC1AD101C93FC68BB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677294, "uuid": "6df83717-9b12-4579-b478-4abe96a1c8e5", "value": "768:n0KXvX5zFDmvQEleyNTgV7a0XKFTsxy3rkcixUdByovnet0l0Fiv:n0W5zpmmyN2hMTsk3QkByovnet0lkiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776677294, "uuid": "f0d93cb6-3e2a-49cf-ad01-fa5b6394ac0e", "value": 53240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776677294, "uuid": "efa00fdc-78d7-4466-9768-25405bca773b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776677294, "uuid": "f3634f8f-0736-4775-95f2-37df0381d81b", "value": "DOTHKP987654567.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71524a53-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776666636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666636, "uuid": "50a3597b-f479-4623-abd4-fc1d2ffb1736", "comment": "Malware payload (Vidar)", "value": "3c4b1e092f3ebe855768d68bdc88ca12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666636, "uuid": "7082ac84-f69a-4cd4-a93a-e1262602f76b", "comment": "Malware payload (Vidar)", "value": "ec83ac05cbefbe4a63a3647dc14652346e44f0d3ca193d1c9da70aecf6373033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666636, "uuid": "0934ba80-3c10-4c79-850c-1efcd14a819a", "comment": "Malware payload (Vidar)", "value": "c5bfc78467760df1f833b1e8421e518fcb89876a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666636, "uuid": "820a73b6-6a67-4e2f-9a90-c867c51bcf5a", "comment": "Malware payload (Vidar)", "value": "cbe669ba592e22890335ce7a33dcbd27ce6dd4a417043bce277a14cfa89534f5762a8ce84307fbfa95a994dfe22938a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666636, "uuid": "a6466bf2-bbc6-4325-9cea-7444c79d3af0", "value": "T102B58C0BBCD518E6C46A97328DB726927B31BC090B3263D71E50B6782FB27E19D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666636, "uuid": "5c040a78-70aa-409a-a30d-f9ee73f7dfce", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666636, "uuid": "675bdf9e-c74a-4998-9fc2-7a73626bb8ad", "value": "24576:7+NQYHYfDVWzD3SpHLkFi5CI+5KUaoEXiLYskmETvM9qOtPD4do:7+eiYfDVWzIki5CIcra5XWYQETk9qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666636, "uuid": "005fc262-f51d-466c-a617-141aeddfe5c4", "value": 2361008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666636, "uuid": "a6d2823f-b178-4619-9efc-9b5b98f6db7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666636, "uuid": "2d3bf984-0caa-42a0-aa09-a3af0a2f35dc", "value": "ec83ac05cbefbe4a63a3647dc14652346e44f0d3ca193d1c9da70aecf6373033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66187062-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776725888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725888, "uuid": "9f9811cc-01c1-483c-b8dd-efd02faffceb", "comment": "Malware payload (AsyncRAT)", "value": "69743ef69f9c8c12ee429b5fe4e1915c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725888, "uuid": "a04fcf0b-4930-44c3-8b2f-d86a0bf6a398", "comment": "Malware payload (AsyncRAT)", "value": "ec9e76913821e91992d130b5fc970167c23a02cb581659aa661c59671292d905", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725888, "uuid": "12a9fcbb-1033-404e-bb53-aa62b11bf895", "comment": "Malware payload (AsyncRAT)", "value": "6fbe6168d4f2d96dfdcd5cb310a10d38fe7115db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725888, "uuid": "457c88e8-cfe0-49c4-8f5a-26f6cadf7b9f", "comment": "Malware payload (AsyncRAT)", "value": "99ca77e96aa6bfa88402e0ff5c632a3d59d91e90a6e9c098a507182b2cd2fb337d158d246ef9fc3f5e1083731c01771b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725888, "uuid": "584db08a-a3d8-4dba-ad16-064757916c9d", "value": "T160A34A5BB2B600BBE1BA8638C4574A05D7B2B8511761AFEF43A0425A1F273E18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725888, "uuid": "6447873a-a855-4c0c-90d4-7d515f7d0d22", "value": "d383ef2bcf5724582bd7d16d7cef32e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725888, "uuid": "92f15844-91f7-41ac-9e49-4b38ea65be49", "value": "3072:Y1KxFQOjauRGL0iQbqQuCHfhuT/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCA:2EQ2aEgMqQuC/d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725888, "uuid": "289a2e96-45b9-4533-9c5c-a7214db107dd", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725888, "uuid": "76fa6be3-8d12-4b56-b648-1d25dd4d1129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725888, "uuid": "17e13731-721f-49fa-8622-5d56770e8d40", "value": "ec9e76913821e91992d130b5fc970167c23a02cb581659aa661c59671292d905_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de06d6d-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725391, "uuid": "af8f6980-a664-4897-9ef7-e73b11c652f5", "comment": "Malware payload", "value": "15626b53dd0cf6fc90280ca98dc4307a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725391, "uuid": "462260a9-2994-4133-b15f-02a47835e4e8", "comment": "Malware payload", "value": "eca7ddf57f53473a87f0c119bcbb7fd097029b07b0b477568628aaf0e2e873b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725391, "uuid": "1949c4e6-d847-4888-9499-40345cd719f9", "comment": "Malware payload", "value": "ad6bf4c5da7f40a09f41c7a712d4e2b542693d6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725391, "uuid": "9a5ea53f-cea5-45fe-856e-1364a5a05c36", "comment": "Malware payload", "value": "c2d81ca248bd1d44c87322b1a5024bbea2e19d7434da950a1f4c537ce93d9ba0c534468eda6ae10ab2b6bb5b7f075dec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725391, "uuid": "d7618a9a-ec7d-49d0-a90c-5d436caa09b6", "value": "T16F72E90DF60314EDC10AD5B845EF1B32B4F5F852C5A7AB2E13B0E6B63E906A5721ED14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725391, "uuid": "8400b53d-9d17-4238-b72f-da4f26457099", "value": "e5586c2e7d29a6a74ce35ddec6708f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725391, "uuid": "7ff8ba51-62f0-408c-9365-0f63be34700e", "value": "384:xgWe9xqxIqK9PZGM0JgUwH98vYuryR9uLPHH:xu9KIZ9PsMg9whnDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725391, "uuid": "5e968697-e91d-4f3d-b272-66351680f6d1", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725391, "uuid": "91ffba58-c905-4608-ba7b-8647a09b6146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725391, "uuid": "56d9e61d-0958-4aa5-98b7-9f7f197f2050", "value": "eca7ddf57f53473a87f0c119bcbb7fd097029b07b0b477568628aaf0e2e873b2_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48bc2c5-3c99-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676655, "uuid": "a873ce65-bd25-4000-a7a3-a9be04437fb4", "comment": "Malware payload (ConnectWise)", "value": "a30eee12c6f94dfa087640e602be4258", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676655, "uuid": "d9700788-fb29-41fa-9ce4-ed70f55b2876", "comment": "Malware payload (ConnectWise)", "value": "edd9bd489a8e5e70e3f7303ae370aa7f681237a4a8e493c135029a91bbb2b9e8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676655, "uuid": "3b7c7ddf-1668-43fc-8913-7a4cb38c0e43", "comment": "Malware payload (ConnectWise)", "value": "bf272b93833b52c253b0227648e13c21a1ddeada", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676655, "uuid": "c06224b5-8691-4d16-a6df-060584f44934", "comment": "Malware payload (ConnectWise)", "value": "9c962b7334272804752b36b5b6b2dba6a40fee8a20f317bfe328de63daf2485beed9428f0271cd3b4f48b3c89ae2be34", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676655, "uuid": "2f194735-326f-4af8-a4ac-a858b5c4d6d7", "value": "T15C46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676655, "uuid": "17c0a7b9-304b-4c3b-9375-4e49fbc5389e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676655, "uuid": "7ccf8be8-a5b4-4c43-a2f5-6d6d9f07ae98", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676655, "uuid": "1c63ba64-4a52-4d46-82b4-6b6945fb350a", "value": 5622624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676655, "uuid": "a1dc8490-c84a-43c9-9960-96da4bb9fcb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676655, "uuid": "309164a2-1342-4c70-863b-0d1675ef7324", "value": "edd9bd489a8e5e70e3f7303ae370aa7f681237a4a8e493c135029a91bbb2b9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727d1f28-3c97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776675658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675658, "uuid": "5520fa1d-4012-4649-ac5b-52aa9ab71298", "comment": "Malware payload", "value": "1a7018ef9bed63cc6dc56c01a625dee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675658, "uuid": "37aeaf30-bae0-4daf-90a3-c086ac180b39", "comment": "Malware payload", "value": "ee37a173a4aff4ede39783700a899d8b37154e1ae7bf2a170276149374851082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675658, "uuid": "bad2602a-7f9e-497a-9a9b-2967e4d320ec", "comment": "Malware payload", "value": "74bbe85b8cbc440c0f57622ccfd12607d3aa0da8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776675658, "uuid": "5a1d2979-5fc6-426f-b07f-bcc82224fe77", "comment": "Malware payload", "value": "64fb91f62762497cee3e6b0feb753116c646dd0d5b95f32da11823946ebd5c34cd4c30a5dafa9cab0e3cf79eb6e909fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675658, "uuid": "be12b52b-df1e-4a09-ba59-a2293c73f7ed", "value": "T19617AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675658, "uuid": "c56ef155-137f-4f0d-b64d-1e831a61a265", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQH:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776675658, "uuid": "f145dcd6-4566-4e0b-af04-9b099f575d16", "value": 18481152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776675658, "uuid": "2856963f-e842-4c02-85ab-db1d5e03f3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776675658, "uuid": "0109144e-dc29-4c64-829f-7cd2d16a9205", "value": "ee37a173a4aff4ede39783700a899d8b37154e1ae7bf2a170276149374851082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40a7e02-3cdf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776706718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706718, "uuid": "cd5521a7-5330-4f81-a741-b3d1af8bbaf4", "comment": "Malware payload", "value": "0db3e657877f422d06f0d6a7037210ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706718, "uuid": "6f7414a0-0df4-413d-8137-75b67ae35949", "comment": "Malware payload", "value": "ee7ffc94767815cf5722c47a90f822805653be972d41de6f7d6c35cd53706077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706718, "uuid": "82bc7ed7-91ed-4c4c-9f1a-1cbccdf7da1a", "comment": "Malware payload", "value": "5d6930d85fa4d160a1f78961ab1b9e23eea9e2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776706718, "uuid": "cf996a67-0371-4afa-a429-df0418924039", "comment": "Malware payload", "value": "e3418a501ded77841d58acf97ad2c910665b0bb44da8415afbc63ab135f8f0490a4195e6f2dfd06b40005baadb581987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706718, "uuid": "c2ba2270-07bd-4771-ae21-f27f529e0563", "value": "T175266B31368AC52BD43606B01A2CEAAA961DAE360F7144D772DC7D6B67784C31732F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706718, "uuid": "13ff1238-75d6-49bb-bf81-bcf19159c6ae", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706718, "uuid": "2edb9c05-34da-4ec3-a4d4-cb1086b87ae7", "value": "98304:0QN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJErHHe6JJWWWF3J7kKxYzY:0QN5tgqSsl/oL+Tqv146w9DbPrPrWWW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776706718, "uuid": "63c0e5f1-a2c1-4470-901c-330fcc2bf65d", "value": 4685618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776706718, "uuid": "e12bf237-277c-4c4c-b676-04cd16dd98c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776706718, "uuid": "874c391c-4a8a-4601-b307-10917567c1a8", "value": "Stormbridge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aced6f-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725837, "uuid": "426395fa-ef2b-41c4-831d-aa2305877e4c", "comment": "Malware payload", "value": "5f2e99c2311084b7beb7df3c777e5916", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725837, "uuid": "cefcfc42-556f-478a-acfd-69726ff4fd55", "comment": "Malware payload", "value": "eedf929ce50aff947f4531b632cb27b025e4340553cdbec0834a9b5193ee4c70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725837, "uuid": "20c4e1c1-d433-451f-9d12-77940067ec0c", "comment": "Malware payload", "value": "0848123f3202573ee65759e1f986700413637636", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725837, "uuid": "24c5439c-9fd0-437e-b694-e5b09f1f6c50", "comment": "Malware payload", "value": "b8c38150d2007fa663c0af63e5b68b8dcaad787d4d5557f658c0bda6bc284aa0eed94fbb81004cc34376a9e29d0adc48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725837, "uuid": "5cc431df-dfe1-4441-a30f-c5662fe59ece", "value": "T18BA35A5BB3BA40BBE1B6823888970A45D776B8454761AFEF43A4425A1F233D18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725837, "uuid": "a1627e12-bd09-4e93-ab7d-878e04807418", "value": "71c0834da0ff088f275cd7e83aac5156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725837, "uuid": "d631fa71-1fd3-475b-8fd7-67ff9357a521", "value": "3072:UXU5V3RNUOiGyAQbnA8i9tUoyfm2GgzskZpgyzfWHDrB7ijPGyuIWCmvVyHXvGOB:4e3bUT+MnA8i7uDvqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725837, "uuid": "1ea03b9b-9930-4197-ad44-b9ffd5973baa", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725837, "uuid": "2c8b9a53-938f-443f-91bf-330fe8eaf6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725837, "uuid": "1f4da5ad-1bd9-4e43-8983-4ec259f52953", "value": "eedf929ce50aff947f4531b632cb27b025e4340553cdbec0834a9b5193ee4c70_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed3d278-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725527, "uuid": "3fee6acf-99f8-4668-bf39-bf38aa102043", "comment": "Malware payload", "value": "a2de40723f263b6057298f600dbc5b82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725527, "uuid": "9e2a1d71-05ec-4306-97c4-5c8d5686f731", "comment": "Malware payload", "value": "ef67ab40f5dd8405ff8b6440f42efba6e1a33e92e62b13d73a4cb2fcab35578b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725527, "uuid": "9bc2f6df-6ecd-4d94-b706-ccc92141bea5", "comment": "Malware payload", "value": "42b87e91631f94ec6567e5379139f2262592a0e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725527, "uuid": "a01495a5-f739-4f55-a88f-ca8fd87ad29c", "comment": "Malware payload", "value": "d5955a4268ff645e291df1adcb9dec53b32301515d19f95ca92b8bbe17dc7e9a289bde987b6474c49a25ffc7324ecc24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725527, "uuid": "ebfe8abe-3316-4b3c-9155-41b627c4ab2f", "value": "T1E5A33A57B2E900BBE1B7867888674E45D776F81507609FEF03A0425E2F237E18D3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725527, "uuid": "f9793013-ba2b-451e-af96-f74f0169a727", "value": "1b1ecd8aac346742266e180bcd50be0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725527, "uuid": "5dd5701a-176a-4d34-bc35-b2c12750d838", "value": "3072:6JXMrseK1TY9GjUQb8Ag5TLWMNU0W6dMw:6isz1TmXM8Ag5neyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725527, "uuid": "075fc0bb-7f11-4117-aa14-965de278a54b", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725527, "uuid": "5f45f79a-2782-4ca0-9f5d-1d62bf65646e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725527, "uuid": "fdc39b71-f11a-4020-b5b6-8734d1d3ddfc", "value": "ef67ab40f5dd8405ff8b6440f42efba6e1a33e92e62b13d73a4cb2fcab35578b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbfef02-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776726032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726032, "uuid": "4c247b00-a682-400a-9aa1-019878359215", "comment": "Malware payload (AsyncRAT)", "value": "a3cf6aa01fad5a1c8214e8ae752a2da7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726032, "uuid": "a9ad21a5-b0f4-42f3-bca9-23b667ce9d53", "comment": "Malware payload (AsyncRAT)", "value": "f10acdceee4f0e472ac60b1b0e68cace74cce08056e48b1534d6f2af218f0b32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726032, "uuid": "500ff925-e1e1-401f-9cb8-ab4680fd6d24", "comment": "Malware payload (AsyncRAT)", "value": "050d8c064e12f9e0a5bb31766d3c5c3a8641ac0d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726032, "uuid": "073de695-a377-4ae8-8e9b-f44fc3b12960", "comment": "Malware payload (AsyncRAT)", "value": "4f912b5051a303ddcda7d996e045a603aa5c3af184a0e74c9541e6cbae5a3fb25734d144673e36e801b9c3a8bcdb8321", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726032, "uuid": "ba99c5c0-c89d-4ede-9223-5bf8b6532a82", "value": "T187E24C4877E08312C5FEAFF02DF3710A5274E11BD823EB5E0CD8899A2B67AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726032, "uuid": "08191fc4-6917-41e6-9f38-3b3f1e832072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726032, "uuid": "69eee039-a730-4e08-8439-e1ce22565e1a", "value": "768:w16zY0FPC4vGFbO75KFVFo9j590OjhIbZ:M6zYH4+bO75KnFo9jQOjWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726032, "uuid": "df17c87f-e7cb-447b-9e55-e742aa7667e3", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726032, "uuid": "22b24e11-d890-43e0-a3a1-d8d3bd78769d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726032, "uuid": "93374ffd-4d36-46cd-9788-37664127db8c", "value": "f10acdceee4f0e472ac60b1b0e68cace74cce08056e48b1534d6f2af218f0b32_08c0bcba-0d21-4b0a-986b-9780bddc6083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db02b437-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725225, "uuid": "4dbf9ea4-749c-4a32-bb21-51b0a05f104b", "comment": "Malware payload", "value": "ffe262e3eeac17272eb8368ccae1d884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725225, "uuid": "5499487a-3e80-48f0-9141-9f92b1afc633", "comment": "Malware payload", "value": "f13bb41aa2fd26c05672318c8817f6e8d09990c0114eafa3f82f944ca21141c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725225, "uuid": "d0abc1d0-aa4b-496f-b37f-103f511ed397", "comment": "Malware payload", "value": "2b671d722068aed04750d4452acbeafb1b1dc0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725225, "uuid": "e4c3c0a7-4d13-4625-864d-7d92c22056ab", "comment": "Malware payload", "value": "45841870ac8aa466e40eac7819861c3434ec683fab307950011335f648475e5914f43808b4adc583530429ca22aeaedb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725225, "uuid": "dae16a30-5530-4548-a034-f213f1ad8eca", "value": "T146E30902B3DB20ECE677D5349ABBA2337673FC254630BD6E555489382E21E50B938F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725225, "uuid": "b7c43140-f0a0-44f2-9477-b65f6d1891ae", "value": "5feee5986a8dbac6dd71a1ec8b35fc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725225, "uuid": "a64ed561-6e94-458c-98b1-85c295e8889e", "value": "1536:PRnujUKchWhz6KGX5u0awE35Cumudl+Nzgsy/22tCbqUv4h0qk7wNCCynR0:pnlKCWBivuhdM6sZbP4h0qk7wICyR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725225, "uuid": "7ae4008b-b4ca-4be9-b814-02531e3102e1", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725225, "uuid": "6caab0a1-5b1a-4926-b408-551972efe1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725225, "uuid": "c48c2fb3-fdf6-4246-b3a5-0c45b17758f6", "value": "f13bb41aa2fd26c05672318c8817f6e8d09990c0114eafa3f82f944ca21141c5_9be0133d-5a62-431d-aba6-865068674017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d10e168-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725873, "uuid": "af39d1bb-a594-47f7-b226-37f6f4a1c655", "comment": "Malware payload", "value": "450de644465dd172b6e2adc07636bfa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725873, "uuid": "0f91fde1-9e55-4bf9-adbd-edfe140b3c02", "comment": "Malware payload", "value": "f175082a5ae7fe14c0d930efd205e168cdc284ae100f86b4da63b87c242036d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725873, "uuid": "6d99d729-7ced-4255-929d-1b7c499634b9", "comment": "Malware payload", "value": "454b6f64144df1a5a57b76a4d4f734db2d14744b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725873, "uuid": "e41b1e4d-167f-4a4e-af17-89f87a1656ec", "comment": "Malware payload", "value": "1d2dae649c19274b5de3fbf8ec4a50794ee48d500673417dcd027ea4745b9c9125b8c347d19d1fa1ccab722bb0396ab5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725873, "uuid": "ea7a8a0f-b399-4e3a-ba4d-28f1544df1eb", "value": "T1A8B34A5B72F900BBE1778239C4674A09EB72B8554761AFEF0394425A2F633D08D3DB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725873, "uuid": "2b2ef919-67fc-4744-b7f7-da95887c1997", "value": "9e55e729fb60b8131c3d92b149585901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725873, "uuid": "5a8aae3f-baa9-4d91-99a1-e705e531e450", "value": "3072:/P/GUyB0xvTspGp0vjyZHYd+r6qqTfoJF/k:eUlxvTOGMyBh6of/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725873, "uuid": "c2e3d02f-39a9-469d-b31e-655289477358", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725873, "uuid": "54f4c902-1aeb-4895-b4a3-89ffc76e1819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725873, "uuid": "9afe0165-694b-439c-889c-ae8af99564cc", "value": "f175082a5ae7fe14c0d930efd205e168cdc284ae100f86b4da63b87c242036d5_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b171e6b1-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726015, "uuid": "a072cfc8-8431-4d64-a521-aadadd724d10", "comment": "Malware payload", "value": "316423059549edf3a82b722c0d322fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726015, "uuid": "1c19749c-bc7b-49c2-9dee-2c7fea639d9a", "comment": "Malware payload", "value": "f1db698c68543c49d9a19e5725e72a96535a06e787915076d55dfe960a770f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726015, "uuid": "66d498d7-9f90-4f0f-a198-7d6ecf9c9c46", "comment": "Malware payload", "value": "ebffefc5d68fa7b2cf1ff76dca2933b1b47fd0ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726015, "uuid": "2c929b4d-6b66-4840-b2fd-ec77702a2094", "comment": "Malware payload", "value": "a87083c96b7be50541f33275324202320bebe9d997c879ce988f3d8277dfc5e3d23602311687d27291bf16c081043b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726015, "uuid": "f6b383eb-fb05-4f51-8064-789c066a9458", "value": "T1FA366B0EBA6D00E9C1BFD178968B950BEAB17852037597DB66E08E550F53AF05E3FB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726015, "uuid": "4e413614-4770-4488-8f3a-f1e9e0344c05", "value": "99c1db897203bfc337c7dfbed3e81519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726015, "uuid": "b5f803f7-87be-4760-9dfc-dfc352a9174f", "value": "98304:yOL+jxb7547PfJPowFhAcLQvdfYpx5D3O:yOijxP5yAcEvdAP3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726015, "uuid": "94a5d16a-ec36-4e62-b567-e34d1168f260", "value": 5074848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726015, "uuid": "38710eef-f798-4c17-b7ed-c5d77b9364df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726015, "uuid": "65e95bbc-71ae-4e40-9655-0e90f2b4297e", "value": "f1db698c68543c49d9a19e5725e72a96535a06e787915076d55dfe960a770f8a_CCleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ed099e-3cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776714421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776714421, "uuid": "af406671-2ee7-45e1-9b7e-59c37eae0124", "comment": "Malware payload (LummaStealer)", "value": "c0f0479fdb13a27eb7f36cb075d88c19", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776714421, "uuid": "ebdf7226-755e-4457-964b-1255e1c83f49", "comment": "Malware payload (LummaStealer)", "value": "f1fac8de90dccc715146a5021ddd814f3eec13514e1cc6a634a03448110b1c0e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776714421, "uuid": "3167bd15-e654-49d0-bd32-bcd9f6eb5c79", "comment": "Malware payload (LummaStealer)", "value": "739cc774b428102d42b06180cfb44733713f7af9", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776714421, "uuid": "7cf695d7-6870-4cb8-8a40-f3e3e0c2bd84", "comment": "Malware payload (LummaStealer)", "value": "abeae0146c10c4eb102fe45b080820f1ee3b41a393ad8c0b0f370a6f943f25c01f3d326a2a3c926cdbda7dd937fc5e2a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776714421, "uuid": "4c138be3-6367-4434-88cd-c6ddee4b4acd", "value": "T15F855B01FED754F6E806173255FB66AF2734A8080F36AA87EA447A7DBDB62D10C32345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776714421, "uuid": "aa244528-200a-43f1-8cab-9bc5f64c4d38", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776714421, "uuid": "f7024579-8481-4031-aaf8-8c8468780169", "value": "24576:ezAzCb/2hwQvLifhqokJ1Sh6Ui5wRjEIR+UWpd22nrori23lYZ4FZkQdXpBcHZpI:ege9Ij1DKhlYZ4Ms5BgYnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776714421, "uuid": "6237f638-466c-42a2-b642-bcae0c4768e3", "value": 1735296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776714421, "uuid": "e156798e-8138-460d-9e3e-64de7fbef19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776714421, "uuid": "ce8444b4-ebe7-473e-860a-490fbd8b988b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cbb1c9-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726072, "uuid": "d8f6dbaa-1f08-49e2-bcec-53a5694870c1", "comment": "Malware payload", "value": "b842844f644dc02617a0e44c51bfb367", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726072, "uuid": "0b202b7a-a477-423a-9455-50f66c0b545c", "comment": "Malware payload", "value": "f2424e535170ac66b9e0d1650dc6a21f847dfb8e8ed0f04d514f63efd6fe3952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726072, "uuid": "46b3cf3f-2d28-44ed-b6e3-eaf82beff312", "comment": "Malware payload", "value": "cdccc6239ce4a03bd007a769eaca7dc9be3473e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726072, "uuid": "908d27c8-4859-4154-ab11-63dd2d28c484", "comment": "Malware payload", "value": "9bc782b0019330269d629b4a82f0b4608e2c414bcca18b95458ae5519568ec68bbc398c428a4fc7b862747769f9f33ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726072, "uuid": "0f9b3b33-ab94-491c-bfef-3bdd945a4314", "value": "T17AA35B47B2BA00BBE1B78638C8530A49D772B8454761AFEF43A4425A1F277E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726072, "uuid": "2a725802-d35e-4376-9c7e-860ed76ece4b", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726072, "uuid": "ca093ca8-6128-4c40-8a7f-bcac40a905fc", "value": "3072:g6AriAfIJGupGCBQbfQMPOGQ//GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMH:+fSGwDMfQMP5hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726072, "uuid": "73d476a7-4ded-472f-ba77-1fc0eaf11807", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726072, "uuid": "ec94a28b-75db-4383-ab13-99b9004442f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726072, "uuid": "860e49bf-065a-4e0b-9edb-aeb864dac185", "value": "f2424e535170ac66b9e0d1650dc6a21f847dfb8e8ed0f04d514f63efd6fe3952_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d601b056-3c9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776679261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679261, "uuid": "e7e16ace-1ff5-4d16-ae5a-6b85ade23070", "comment": "Malware payload", "value": "0888dcc4bcb7799a587b39821716c049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679261, "uuid": "c0941b81-785f-47d2-975c-97823cc572e9", "comment": "Malware payload", "value": "f2ee717e515f2033bd511ad741f76f2d829bcaad0aeb7b9d0f9091acf43f2297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679261, "uuid": "1060303c-846b-498d-8b97-12950f96d570", "comment": "Malware payload", "value": "557ab5b2a7c39f654cb4e2d467d6e25bc7f18f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776679261, "uuid": "f2d47bd0-23b6-4644-b504-c94af98b45a8", "comment": "Malware payload", "value": "cd451b9586d65c828570289df69697af243904703e7ad770e14a8eb70e43ead3ff27227d1dae662ebc58eccd19b40256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679261, "uuid": "e795cf0e-c7f5-4c78-a699-f8d1ad0a9559", "value": "T13317BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679261, "uuid": "7f483b37-577d-4a79-892e-55ac6ec80219", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776679261, "uuid": "5481a2b3-ec83-499a-ae0f-d5558269daf2", "value": 20054016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776679261, "uuid": "22aaeaec-e8c8-4931-8ce3-daddac0470c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776679261, "uuid": "0bf6c302-2f88-4c1c-958b-e0533533ae22", "value": "f2ee717e515f2033bd511ad741f76f2d829bcaad0aeb7b9d0f9091acf43f2297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22114b1b-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725345, "uuid": "beaf87a2-0e0e-4b51-9392-3171345e364f", "comment": "Malware payload", "value": "02790f2215163d67740913c73356c244", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725345, "uuid": "267a9ca0-14f4-48c6-be9a-af65ccd4b42f", "comment": "Malware payload", "value": "f3002ef1164022f0ef93e50d2528da5e9670852df6ed00121c61764d465953c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725345, "uuid": "0dd0f82e-ce57-4cf7-b815-94dec7753730", "comment": "Malware payload", "value": "5cafa0a308a2ee428087f07841710cac42bcd741", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725345, "uuid": "a61d1480-2a5f-4838-80a5-760e42e3601b", "comment": "Malware payload", "value": "3003583446e0cb4661046121f2930446c30693c171ae7db54519f483b39f341acfc380b806804cd1aa191b66c276f318", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725345, "uuid": "b5f74651-b4ca-419e-a293-74bb9ac1c36e", "value": "T18382F80EFB1BA8FDC409E37898EF5732B172753606366B2E1314DAF64F10558666F920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725345, "uuid": "5e745b47-4515-431d-bdf5-c09bf0b829d2", "value": "7e6047e86dfc28c96b06e3621db487ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725345, "uuid": "a19344f0-6d69-46c5-8634-180ded16b09d", "value": "384:2SqD9rVW6tQyJxH7Iw7H/YL3mckVPxIiTrBX3qWLkN:29D9rMhWJIOHsmckVPxIiTp3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725345, "uuid": "789ce739-ec2d-44e8-a3d7-f8ebb2fdcb01", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725345, "uuid": "08e32e95-5370-4347-8125-717af9c81c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725345, "uuid": "a625a7f4-d9e1-4daa-8388-e19bf726f617", "value": "f3002ef1164022f0ef93e50d2528da5e9670852df6ed00121c61764d465953c2_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f2daa-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776688339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688339, "uuid": "1582c1e4-92c3-4102-801c-b9cb9829af67", "comment": "Malware payload (ScarfaceStealer)", "value": "ca740254b984a978fe62a36658788d47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688339, "uuid": "db1a0051-8f27-4343-bdbc-03f9bfa2bcb7", "comment": "Malware payload (ScarfaceStealer)", "value": "f37250d8e371c7e5ed61d095203e38cc539121137517632fec3ff6158032a97b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688339, "uuid": "609bdf40-bf65-4ca0-b41d-34bdd56ae604", "comment": "Malware payload (ScarfaceStealer)", "value": "9122ae258b4d74930cafeacb9d75fa5689a2515e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688339, "uuid": "293d8e32-98fe-4ed1-bf38-2ca723f363d2", "comment": "Malware payload (ScarfaceStealer)", "value": "0601be64fadca94f90b73929144d159b8a23b8f223a95473513500909cf3e621d38066d3d2504c5aced61fc28e9c977f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688339, "uuid": "3240cf63-081b-43f8-ad15-8fc1bbade789", "value": "T107169E1BBCB91D69C09AB13088736605F669F804572327C71A60F6382F3B7F15AF9B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688339, "uuid": "88503b39-4192-4241-8b61-c8a6fcc40aa4", "value": "ec8dbefb8cf27c78a0b52c056e191d21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688339, "uuid": "2e29f8f8-2235-44b9-b544-cbd5e45280c8", "value": "49152:AGe7bcdVi7hOaq8imp3E7G3DAqn1tJ5W0UkLdAYBMpjGQcQebkO+:AG7+4ij/WDk5tOVQkO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688339, "uuid": "e448de61-76b0-4ef5-9e47-be211c5b7bba", "value": 4339248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688339, "uuid": "3eea24f7-4d71-40a0-9f66-d1002a377e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688339, "uuid": "612655ef-44f4-41a9-8cdd-7c88eb38ae8d", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0861545b-3c78-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776662165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662165, "uuid": "d291bbfd-6628-40b5-ba61-05f093820d73", "comment": "Malware payload (NanoCore)", "value": "7fc9f487f29393b901d9b23e20ab2852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662165, "uuid": "4fd5aa5e-797c-4762-b7cf-de9bbbc0ba64", "comment": "Malware payload (NanoCore)", "value": "f37e60e60a3e504f555444ced745e7224cc83625a29582d29217b8a4ab7341a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662165, "uuid": "9621c5cf-a5a9-43e4-a191-30e43bb60ea8", "comment": "Malware payload (NanoCore)", "value": "adc848e57990db272fe4e6fb90013fa716e3e4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662165, "uuid": "112a9d50-f1e0-4c6b-81c6-9d24c9e4491e", "comment": "Malware payload (NanoCore)", "value": "d32b203e0d134bf5424c359b928d839adfcaf13c7d5e6c9d909dbb1549e04465c06299b894c9d8c684d57bb4ac05ce3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662165, "uuid": "7f0c23e3-52ff-438f-a7da-d3f6c319bbac", "value": "T1E714CF1677A94A3FD2DE82B961221143937CC2E399C3F7EE28D464B74B267E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662165, "uuid": "78e21b8d-982f-4f8c-bf9f-ba7206b6e340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662165, "uuid": "a2aabbd1-f8c8-4f8f-a029-4d7d50a3926c", "value": "6144:MLV6Bta6dtJmakIM57MBrwBJnaMC8xFev7y4QT1t8:MLV6Btpmk+MFIPHPe2Dt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662165, "uuid": "4de268a8-4673-4257-b535-e3c87ca9decf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662165, "uuid": "e4d5cc78-1aec-419f-8bd8-ea36fea1f61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662165, "uuid": "06825780-fd4f-4380-b430-50c539dc41cc", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c34cc5-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725921, "uuid": "0e081f87-09a9-4a62-bd01-0ae6f3da99a7", "comment": "Malware payload", "value": "30b0f68d2202a488d14f4409d4169a1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725921, "uuid": "fcacd2dd-3b44-47d4-be85-9022dc576cbe", "comment": "Malware payload", "value": "f3a127a18dfdf5a60c2a25910a0cc40d012216e7f8326c95389d3f2ffb926eb5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725921, "uuid": "179d8278-32f7-4f7e-8fd6-4f27fd0d91b7", "comment": "Malware payload", "value": "ed2cd736908c330e15f387e399172124ba9b7cd5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725921, "uuid": "dee2fd97-a0c9-4070-b23c-8844b55b5201", "comment": "Malware payload", "value": "24d9f04cb46727f7b07d6367177cbec01b43a6a3798e0dcd9a59e8df52457eac07c8677c415afd2ac4739c5ed207e50b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725921, "uuid": "944461ea-0184-433b-a741-faafd1eca182", "value": "T1C5A3594772EA00BBE1B68638C4A34A19D772B8560761AFEF43A4425E1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725921, "uuid": "78081189-383a-4278-ae9b-a635f93f94cf", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725921, "uuid": "1a03b849-65fc-41cd-a271-4db46b033c3c", "value": "3072:a5DfN3dIZgxpAqZQ1A5Ohu3rB7ijPGyuIWC+vm//O/2iePL3zfbHsYrXTGWwd51s:a5NNIOzRYA5OsyOd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725921, "uuid": "bfdabab8-fca7-4966-8be4-344db2381241", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725921, "uuid": "9d585308-270c-4194-9225-27dd38db5252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725921, "uuid": "c872e407-9a19-4d2d-aa72-cbfcac1fa373", "value": "f3a127a18dfdf5a60c2a25910a0cc40d012216e7f8326c95389d3f2ffb926eb5_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a57be83-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725761, "uuid": "e9797337-3798-4756-9228-783d4b6bbb88", "comment": "Malware payload", "value": "c5a58a8d58c93434eefb83aeebc73059", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725761, "uuid": "050e5297-3762-48f1-a642-46a6c2bcc487", "comment": "Malware payload", "value": "f3c8ac0d85dbb2f01ada2071d947de5a11ace8c1b2969004f53ec782a61f3e2a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725761, "uuid": "49ae4275-02c3-4bc2-a2e5-b9458154a8d2", "comment": "Malware payload", "value": "f67366b54a5fa3cbcffb8e3229a99697e6943c64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725761, "uuid": "5026119c-81b8-40ca-a40d-e6625af10274", "comment": "Malware payload", "value": "da0ca72a9e6c7dd1f9d0c1842c7773e044f31ca714c880657ebb8fa46a4dde03473d0841966660119c71fb3db9998a4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725761, "uuid": "dfb43a65-94d4-4f50-8e47-1c1461c9624f", "value": "T16FB36B0B62E540BBE0B7D238C5A34A46E7B2B81107619FEF43A4465A5F237D18D3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725761, "uuid": "cc1d7a5f-e35b-410d-9c50-1ff0b2df09a9", "value": "43501fd48065720e9fd2d24a68ead8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725761, "uuid": "31ec273d-4681-400f-9371-f6fbdcbb771c", "value": "3072:Qdw50aYcaKf0duwCqeYKhXFBEVJsxvDbEKT:b5FY60M3YaYoYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725761, "uuid": "a96fc27d-29c9-4512-9e9c-ab87b1455a15", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725761, "uuid": "98cf301c-cfac-4d52-be7a-57166a3a3bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725761, "uuid": "3546a527-f643-4ab7-9ebb-0f67a7ccf729", "value": "f3c8ac0d85dbb2f01ada2071d947de5a11ace8c1b2969004f53ec782a61f3e2a_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404c2797-3c94-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674285, "uuid": "b3041665-2d84-4c0a-b93e-cf8337ef60d0", "comment": "Malware payload (ConnectWise)", "value": "13a0bfe617441f24b366be6afd46b707", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674285, "uuid": "581536e5-9dd3-4fd0-8ce9-c2960e507715", "comment": "Malware payload (ConnectWise)", "value": "f3d718be15e87e903228f0b1ac8afacdffe8e48065bf127118179f708bb2b979", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674285, "uuid": "6f0fb1ef-1266-4a45-a464-035451ddf4d2", "comment": "Malware payload (ConnectWise)", "value": "32521c15ac2bc55b539c7c5117ffefca664a21b3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674285, "uuid": "03594505-4123-42ff-963c-856c4c9e68b9", "comment": "Malware payload (ConnectWise)", "value": "53913d87867241f24498fba4afe6248813afb7d089563646887205d7536ac48091e65e2c08891e41b475a17439ec2d37", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qtq2haw-anondns-net", "colour": "#35E71B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674285, "uuid": "a8babbac-fa33-48fb-99f9-ed68259aace4", "value": "T187E5EF01B3E4413AD5FF0635DDBA66229B75BC190364C7AF578879692E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674285, "uuid": "39883323-6709-4a24-bae3-47afaa4f9ae1", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674285, "uuid": "2cae6a5d-f3c8-4718-9f1c-ad18a2d04294", "value": "49152:OjET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1gX:sb16Co69eWb0pnGpYmnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674285, "uuid": "7effeb31-348a-45aa-9e81-eeddaac77e8d", "value": 3192088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674285, "uuid": "67cb8d4e-775b-4601-b1f1-59157cfe3ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674285, "uuid": "fa7aa60d-1f33-4604-8a90-d330854e5b77", "value": "f3d718be15e87e903228f0b1ac8afacdffe8e48065bf127118179f708bb2b979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32690941-3cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689294, "uuid": "a55ac378-5d74-43b4-ab97-e0dca29e78df", "comment": "Malware payload", "value": "6237c215c64ad31ffb324454a1dc89fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689294, "uuid": "149d143c-c606-4941-b8f0-531c42f6dc75", "comment": "Malware payload", "value": "f417bf9d444d94b495c7105a49e1ff20a2d48217ae59063c565414a4bcf7c59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689294, "uuid": "897f6f51-1911-4d3d-b4d1-86eca98c389d", "comment": "Malware payload", "value": "420d97acbcd25913015ddc47bfe4fb568795e047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689294, "uuid": "44500d25-ef8f-4a76-8fe7-588b0fe02a03", "comment": "Malware payload", "value": "7b1cd102c82d53757a0bbc64423a625dc6191f9cdff52a134a9214ffa4048a3ec20aa85ceff8fa818713996adff3abda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftStory-G-Zielinski-K-Jez-s-c", "colour": "#165878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689294, "uuid": "da9f717a-5754-46f9-8e40-2ae325ae7dbe", "value": "T1E6E59E217A06C076D68211B258B97FEB896CAE149BB014C7A7C41F7E49313E37E3365B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689294, "uuid": "d989abbc-7d43-4f8f-937b-742afadf93bb", "value": "f14cbb31fefd5155d16c2636a56b92c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689294, "uuid": "053dd899-d202-468a-9287-42afe4024938", "value": "49152:qlkpQDPvbpeWuOnUC1/kHNwnTfHWv3YZEL9Ki9eAjQj/KFGk8:epeSr3H6YQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689294, "uuid": "3a955084-02bd-49dc-be7c-cf42c1281054", "value": 3185496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689294, "uuid": "9ee41c77-790b-4dde-968e-15f00605e5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689294, "uuid": "9bcefc12-645d-4c73-8224-f22ec4e883ee", "value": "f417bf9d444d94b495c7105a49e1ff20a2d48217ae59063c565414a4bcf7c59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baec095-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725388, "uuid": "7338badf-53a7-4b9f-86e2-515e5c1e2c18", "comment": "Malware payload", "value": "d6d48653fb4a2929cc99f48c62bb7814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725388, "uuid": "23d8b03b-efd4-4c1c-8183-1b53b494f7c9", "comment": "Malware payload", "value": "f4395adc2281a0c61316cc2d061a3c8e10ccea229017142bf65468fd2f723f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725388, "uuid": "2bf7aa85-65cc-489d-97a8-2f23824a5c50", "comment": "Malware payload", "value": "872b46180ef455f633de83ed51efd4499bbef0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725388, "uuid": "e67e416b-48d4-4eb2-95df-344f91405f71", "comment": "Malware payload", "value": "b7a2e91aca847213f0b72c0e769a492239780573de596b50426213940716fec3dd3410c24b9f8833cf0adf363a7e2ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725388, "uuid": "d8a8a3c8-047f-4ccd-9e02-235e92306543", "value": "T1F4943B243AEA5029F3B3AFFA8EE475D79D2FBF6327072419106133564A33941DEA1439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725388, "uuid": "c0586e54-d82a-493b-90a3-3f257b4cda5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725388, "uuid": "6018c846-b665-4daa-8197-f242807a2fd5", "value": "6144:pHra3QnEgKkR4qVuqsra3QnEgKkR4qVuqGDR:pLiQnEgKkRzIRiQnEgKkRzIZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725388, "uuid": "ae82518f-20d9-4174-a9fe-67d66d1b3b43", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725388, "uuid": "7ca93d65-ef02-4f90-a8e5-623ebc5ff293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725388, "uuid": "4102ba85-1c29-43f7-84b7-d18de1d10cf6", "value": "f4395adc2281a0c61316cc2d061a3c8e10ccea229017142bf65468fd2f723f9d_9e42ed3d-5e25-45ce-a64f-96d636fc0250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdefba6f-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674093, "uuid": "82fe7163-cdcf-4f2b-a509-61a6cffe3b36", "comment": "Malware payload (ConnectWise)", "value": "a9bfee1aa5068c03ce1b4580698f000a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674093, "uuid": "6e398235-57d4-4327-b5c8-a3ad833c98d3", "comment": "Malware payload (ConnectWise)", "value": "f49c5ca09e04cfb0e5e8532946d183e9cce6595ce364a59b0c9423a828be8415", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674093, "uuid": "79fdc707-21ea-4776-94f8-9d76f6b1abde", "comment": "Malware payload (ConnectWise)", "value": "afcccd45bc700a75e46297bfdae0c47048dc14fc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674093, "uuid": "2c2d2251-a5e8-4a4d-b9d3-bbd719479f69", "comment": "Malware payload (ConnectWise)", "value": "31aceecbabffbfd38c539b2ebe1c3c481e619f1c1dfaec3a59d085ef247fcf16853abc9bbdc884d85a371019574078ca", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674093, "uuid": "5e187a45-e72c-4119-8749-f54115692794", "value": "T13346E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674093, "uuid": "32188e27-82b3-409a-b61b-84993cf0ef79", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674093, "uuid": "345fcab6-0d4a-454a-9531-6eedb212f346", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlugLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674093, "uuid": "4b21513e-1895-4047-b2a3-6bec37fb48c1", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674093, "uuid": "58da7424-99b9-4070-97a6-587a1c2a686b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674093, "uuid": "d3c74a16-1cd5-43e0-ade0-cdff54576b55", "value": "f49c5ca09e04cfb0e5e8532946d183e9cce6595ce364a59b0c9423a828be8415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b085bb-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776697653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697653, "uuid": "b37e0706-90b4-4f47-bded-adacd658f3d3", "comment": "Malware payload (Formbook)", "value": "5cd77bbc3072f5872cfe91d5e5a4f1c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697653, "uuid": "f846a6ee-6e68-4354-ab0f-f71676b1f9b8", "comment": "Malware payload (Formbook)", "value": "f4f3e7322911d1395745ee7ee09eaa2b72f74cc0a9be7ec88bc266f3f8af0587", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697653, "uuid": "68004f82-829c-45b6-84a9-491f4f16a6e6", "comment": "Malware payload (Formbook)", "value": "972bd36767fe01b95aa47ebf3e69a00d70bca078", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697653, "uuid": "745907e3-d946-479c-a649-2ceca3c24d83", "comment": "Malware payload (Formbook)", "value": "53c3b4a3d5d0bcd51593a17baeb4b390abae9bde7c066bf1a915a63c3d346b8b1e720f71bfd8186b25870e124eb16c7d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697653, "uuid": "9a2d6bea-be38-4086-a261-ecd3ff7f5643", "value": "T16A9502118AC46FB9CFAC5A1880FD150E93F00E9E401AB98DEB73BD46EFE7944121B5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697653, "uuid": "45206a74-b690-461f-9cae-e50a66121960", "value": "24576:JtscpM6Rbid6D2MWRqp+VODhsB5sdFWr2WhIJZcuoiDRXH3s04qy6YMawtLPwIQz:JtMriZhsBh1IRXs0lJz3tnykY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697653, "uuid": "4e4526e5-dd73-4b7d-9c5c-cfd767bfc2a7", "value": 1921077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697653, "uuid": "ec5a20df-bb74-4dc5-aab6-730c6c856be7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697653, "uuid": "c812cbc7-6c43-4085-a760-d7b9d41b70b4", "value": "204S095.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80110883-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725502, "uuid": "ce90b9a2-8568-44bd-ade9-bd2d48c8cc17", "comment": "Malware payload", "value": "30ad3c31af271dbbab1cf55a41493be2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725502, "uuid": "c929a640-0378-425c-8f6e-89f09f75ab1e", "comment": "Malware payload", "value": "f5357cced9ec3fffe0f8e65f73fe2d6100a4746807934512c9ef66ed7a691878", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725502, "uuid": "a079a6b5-0c8f-402e-bb37-74b617caeec0", "comment": "Malware payload", "value": "bf8c45e5cbd581daa998d81b3a048b7b33a15f21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725502, "uuid": "5855d962-61d3-48e0-8940-a3af004763d5", "comment": "Malware payload", "value": "0a8f8f0691d83e90e3e973df83fe61288f58e8b150cdac0be77883167cb5ae2042d69cc87515a8dd9e93eaac92841e71", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725502, "uuid": "4b0094c4-230b-44c3-ae17-b086835149ff", "value": "T19EA34A1B62FA00BBE2BA9678C4630A49D772B85507619FEF43A4461A1F233D18D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725502, "uuid": "da8fdced-cfba-414a-874e-c9a2c5e40aa5", "value": "f64f902085ea41361804160932d95620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725502, "uuid": "1d52bb17-5b86-47bc-9938-3db30c71077f", "value": "3072:cm4RP6gyAqpQQAZ+YA7vrXT/7nM4L3zm2Q9ZVbZacTohsrH58ckVPxIiTmjcxm/:b4t6hh9AZ+RKlPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725502, "uuid": "72e1572b-8d46-43dc-b98a-5b3d809b2b23", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725502, "uuid": "089f44d2-2ba4-48af-af81-2cba9e52e8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725502, "uuid": "693a150b-9249-4b3d-8373-49d460462e8e", "value": "f5357cced9ec3fffe0f8e65f73fe2d6100a4746807934512c9ef66ed7a691878_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc99977-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776724879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724879, "uuid": "8cbef992-084f-48c6-938f-d7f8b1fffe77", "comment": "Malware payload", "value": "6c4db977b74639c18c13181a45a85c28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724879, "uuid": "5dac6946-05e8-46d0-83c9-0eeb5efc776f", "comment": "Malware payload", "value": "f5bca83fea9b4e43f8ceb3ebc453b2cf0f3be8d5cecbc5a7681c75ef567a5c53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724879, "uuid": "421db979-5f44-43c6-b6de-047da0ea1956", "comment": "Malware payload", "value": "ef7aad71da3d2f6bdcf8b05179757cd54e1dba5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776724879, "uuid": "b54214be-d5d1-43de-85ae-72b9e528f3b4", "comment": "Malware payload", "value": "e8eda94069480d6b066bc5efb63898747c2615a2d05a82efd265007242d1aaac55080f1fce5f08bbd856fcb2d3a06240", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724879, "uuid": "34954738-5adb-4cf3-a43b-72155c50ba0d", "value": "T101B35A47A2E500BBE177D23989670A46DBB2B81157609FEF03A4464A5F237E28D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724879, "uuid": "d830b0be-9a5f-4e5c-a9eb-bdf57a4c6c63", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724879, "uuid": "8b3311d1-fa77-408c-a67f-f305ee2f3725", "value": "1536:lSS28AvV9hYi2pQ8paAk8FdkTH4S1s8BKJ6TocMvUxETsWhXdM9dlr0PLg5jBK:svz68dA1Fd4Yu46T/MMxmNkV0PLg5jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776724879, "uuid": "b3e217bc-d3f9-4fe6-a8cc-4ab40fa9beeb", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776724879, "uuid": "e79fb716-7d6a-4be8-9877-93cf75e86485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776724879, "uuid": "ba52464f-f622-4dca-bb29-a44e25989c1e", "value": "f5bca83fea9b4e43f8ceb3ebc453b2cf0f3be8d5cecbc5a7681c75ef567a5c53_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a391075e-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725562, "uuid": "b1d91910-d239-45fe-8730-64f2b15f36c7", "comment": "Malware payload", "value": "48f91e7a9fbfaf08a40bb055265a85f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725562, "uuid": "1a69421d-ea44-46c2-88b7-396a2bbc5cec", "comment": "Malware payload", "value": "f5d45679bbd26e9ee333bc09b72a8ab049fbc914d1618ebc14c458682ea6235b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725562, "uuid": "42bb4ef4-3549-40ee-9108-3b6f543f6955", "comment": "Malware payload", "value": "587aeae111409bfb6badd826032a188dbed83838", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725562, "uuid": "0355dbb8-9e64-49a1-b669-02f634bb15ac", "comment": "Malware payload", "value": "26b15f7560825e294e14df99e1bc7b2ff32f139c2c01a62297866991cae7873992c70c5925cf421ce3f92242a222c549", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725562, "uuid": "e5235491-ceab-4db0-9fd6-0df9456b4ffe", "value": "T153B34A4BA2E500BBE177D23989A70A46D7B2B81157609FEF03A4464A5F237D28D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725562, "uuid": "bea884ee-ec47-4b15-8d4b-253f25b5707d", "value": "8d6b501f7040e2ab6228fe012144a9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725562, "uuid": "455246ba-d53e-444c-8e67-623f91d00ae4", "value": "3072:rovz68dA1Fd4Yu46T/M6xmNkVAPLm5/YB:ezVwy46rC/658", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725562, "uuid": "ee43b654-0f0a-46ec-87e6-81243433d9c2", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725562, "uuid": "22551330-67ad-4448-8ceb-7b56d870f2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725562, "uuid": "6e93fe00-cf12-464c-a5ce-04b3cae1291d", "value": "f5d45679bbd26e9ee333bc09b72a8ab049fbc914d1618ebc14c458682ea6235b_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba5bead-3c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776676774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676774, "uuid": "9c0eb6d9-d4f2-4fe2-9f24-a549aeb884a6", "comment": "Malware payload (ConnectWise)", "value": "70aa0b6136e87799831b10bbb08dbfb0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676774, "uuid": "166242bc-4547-459e-9d3b-50a891c7bf92", "comment": "Malware payload (ConnectWise)", "value": "f5d6d0be5a17c165cbce7f684d2791dba2cc8428bd6443a2b87dd348d7135bae", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676774, "uuid": "df4a3b39-0d30-4641-8a2e-7a6a091b4c93", "comment": "Malware payload (ConnectWise)", "value": "c40351a5b0942c9e4607a7c2364f3f569534f56c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776676774, "uuid": "b7ea5c0d-b173-442c-8c67-1bfb2264a464", "comment": "Malware payload (ConnectWise)", "value": "747dd8fe5f642de7be42e58f094f4d6d629d1e8c5528640882f1d1f4c4c7f30b6956307df5f4243b5d4922223006f92f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dwssa-top", "colour": "#5C3DBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676774, "uuid": "84cc074e-2c7c-44ce-a3b0-8f2785474361", "value": "T147646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676774, "uuid": "f57178b5-44ba-421c-8405-eb5294a847b9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676774, "uuid": "4664d5df-0d53-444d-8f21-42ad3e6a25d9", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9q6:51iw7gryNkSV1hy1Z1u2JLI9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776676774, "uuid": "b5593697-a04a-4dae-8a2f-3adaf49a16c1", "value": 312712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776676774, "uuid": "b8d091a3-2716-4db0-ae2a-5c2f7fcac8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776676774, "uuid": "be4cff43-9b92-45cb-981f-d8fdcaaad2b7", "value": "f5d6d0be5a17c165cbce7f684d2791dba2cc8428bd6443a2b87dd348d7135bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eaaf59-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725317, "uuid": "31c8ccd9-8b18-4834-b6bc-1aea1bb6f8e3", "comment": "Malware payload", "value": "ac54e0d456c3f263af898175e2037935", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725317, "uuid": "085196fe-12aa-4d55-908e-5727cc58e39e", "comment": "Malware payload", "value": "f5ebebae395a538ee55b850c09eaf4d984b16c3a12b0a305091022daf5ae30e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725317, "uuid": "c353875a-4a66-4083-9704-adee05319e64", "comment": "Malware payload", "value": "94371f52a0e351313924d9cd35bb2a8a880f9fc8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725317, "uuid": "20c00165-c949-42c9-9815-76da6081c1ef", "comment": "Malware payload", "value": "c4b78d1a45fd40c43cad5611084585d096db931fe0d8f1cd5e06b507c9ec0f441abf9ee6624f5e1cef736fb492e8ead9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725317, "uuid": "f6b8bf13-a069-417a-8dea-fd709eb47ca0", "value": "T11CB35A4BB3A500BBE1778678C5630A46D7B2B8911760AFEF03A0465A1F277D18D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725317, "uuid": "ac174da9-f09d-4e9a-b052-8ac1b0b7dffa", "value": "8c4e7d0d2138011c6300908dce31a658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725317, "uuid": "ccc8fc01-5586-4242-8b3f-308cfc78224e", "value": "3072:I/azEnyFSpckqn/JqxJxSjjwbckVPxIiTRQfol:IuEyY2n0Eg6fol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725317, "uuid": "9611c9e2-d7f1-4f43-b6b5-06a7d465c170", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725317, "uuid": "ce968ac8-2264-4b1e-9df2-e2f01a3b9851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725317, "uuid": "a9fc0efc-9bce-45ff-a465-90fc257ca40d", "value": "f5ebebae395a538ee55b850c09eaf4d984b16c3a12b0a305091022daf5ae30e1_VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d831bf35-3ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776708470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708470, "uuid": "c478e623-2e51-43f5-a10e-8a9ff28598b7", "comment": "Malware payload (Mirai)", "value": "e6d780d6bb34a0b466af525ba37e2d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708470, "uuid": "ee646481-e7ed-4bab-9c75-c961346767a8", "comment": "Malware payload (Mirai)", "value": "f632cf84990fd04ced75f0bf2c520247ce6e1cd84be15aa350dcb2f574443f13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708470, "uuid": "b3ec8825-359e-4a91-b443-4a78bce4e3c0", "comment": "Malware payload (Mirai)", "value": "647d832618f21abdbff04fde097b379c3768aeb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708470, "uuid": "d58a6a4a-b62e-41e1-923d-4ef8f87fed39", "comment": "Malware payload (Mirai)", "value": "4fe1dfcda1bf816b8b153f6cc1bd6831fe1f87601dee4830756cc17caa7d1aaf77d8ae55586cb1c85215ecacea770290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708470, "uuid": "8b2ebf94-0136-4729-ac57-7c19d0c7bf9d", "value": "T14A92C0B580D02896C364CD32ED398BCBD62BDBB9D0F6213B2D11C5D4D94B49295B6682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708470, "uuid": "054e2ba9-027d-4f9d-8799-009b1717294a", "value": "384:HtIVqFfk65a2E2ICIzM/tkw4EZWBAhM0D1o8ZS2VnfW3dfPGhymdGUop5hKj:GYFfk65a2E2ICIo1OYWBCM6S2JS5PGsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776708470, "uuid": "be44e679-34f9-4986-b8d8-9813c1a5de48", "value": 20652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776708470, "uuid": "367827b2-e406-47ba-8cd4-2c5d1d253514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708470, "uuid": "fae52057-6d3e-4039-b605-5931a476d00a", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4ced60-3cca-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776697530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697530, "uuid": "a3ec1ee9-f123-4a91-a57c-c5bf06698621", "comment": "Malware payload (ValleyRAT)", "value": "724caac6aa06eae43a77b0196517649e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697530, "uuid": "87a5325d-5e2a-49aa-9766-6a56049c083e", "comment": "Malware payload (ValleyRAT)", "value": "f67de46dba3372646039167ec5fd8e66ab0b923997824a56b86c39a5af87f525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697530, "uuid": "017809ae-e86f-49bf-a1d1-3db509ff8807", "comment": "Malware payload (ValleyRAT)", "value": "0c13b467b8d7af52e73f9df8db37eddb880c50ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776697530, "uuid": "45f6da45-3662-4556-a9f9-ff8fc63f3149", "comment": "Malware payload (ValleyRAT)", "value": "84bda8196b22ef13937458895899beb0213ad857799ca1df0e68b4141bad338721fdea66074890e053799df1d271e4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697530, "uuid": "45b60e01-132a-46db-b769-0539a2de3d4f", "value": "T14E347B317A84C533D59211348AFADBBB896DB83103A652CFA7D44F3D5E603E2E67431A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697530, "uuid": "c4fec5ed-35bd-433a-b924-f177b09b4220", "value": "f00eed2fb27d554bc204eb9de3e24171", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697530, "uuid": "31c3cbd3-6108-4f49-a780-992fda92bf8a", "value": "6144:MUab78xXJ1bIDTaM20vrB6ShrMoSJ5k4ilJW3:jA78xX/IDTi0d6ShQoSJa4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776697530, "uuid": "9f4d461f-f4b4-4c6f-aba8-cfbcf8a6fe90", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776697530, "uuid": "493f7b74-b09c-4dc8-8814-5ad32633b51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776697530, "uuid": "bd1dbb6b-4948-4734-87cc-f52fd3de78e7", "value": "724CAAC6AA06EAE43A77B0196517649E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1816d914-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725757, "uuid": "84e03cec-01b5-4d12-81bd-b0bb889a3026", "comment": "Malware payload", "value": "629a9de29fcd99366a66c651a535a5a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725757, "uuid": "49da74d2-d7c2-405e-8c5d-6d5b956cb7e1", "comment": "Malware payload", "value": "f682aadda9deb654885ae17909380a25f7cb1a43ac0934ac425ee8de4924c7f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725757, "uuid": "ad4bf290-cf4b-4a1f-9a6f-d5b3b138ce09", "comment": "Malware payload", "value": "e59c13fdd74e1ad950c98f905795ecdefffb8221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725757, "uuid": "5dc59fc9-236f-490d-a869-82a3b20f1c2e", "comment": "Malware payload", "value": "45ea2466fd81243ca32c6a91b63a55946717b2ea6633c95411c028a88d3fc82e5648184b17a57b00dd21adce515c2797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725757, "uuid": "50122e58-4d0a-4e4c-a97f-b1ce8e7fe881", "value": "T1F774495EA3A914F6D4679178C943C235C272BC35572256DB22E0CE7F3E23AE97638B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725757, "uuid": "695e9df4-8bb6-4ba1-9d20-df58ccb68862", "value": "b0f049c014592b156eb1fa857e99ceb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725757, "uuid": "a2accc68-80cf-4444-b483-299d90d54759", "value": "6144:gzHjbbTYQb6n/aR6uRJNJ3LENV+uopr14T4m:gzHjXMQ2nicuRLJ3LEvfopGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725757, "uuid": "254fe189-2907-4ab3-9452-e3595a8c1a41", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725757, "uuid": "c3a386aa-7146-4b50-beca-226f2c807c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725757, "uuid": "a813871b-738d-4b15-ba5c-0d0f935296c6", "value": "f682aadda9deb654885ae17909380a25f7cb1a43ac0934ac425ee8de4924c7f3_c39b98ce-1ede-42fc-9c4d-b10b0a270ebf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed6ebe5-3ce1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776707461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707461, "uuid": "27a392ef-6418-40f2-8f6a-63c72b9a0601", "comment": "Malware payload (Mirai)", "value": "7e72b99e809b8b088a5236fe7eaedbbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707461, "uuid": "15454e32-1e11-47f4-bd7e-db294340081d", "comment": "Malware payload (Mirai)", "value": "f7cbb31271d2db30402f4497875da1b67242a0658a187bda11d0ef650d6cdca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707461, "uuid": "53231ad4-c261-4a33-876a-aaf74ce9d200", "comment": "Malware payload (Mirai)", "value": "880fee5814c8e1a7a7508ffa75ec212169b65a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776707461, "uuid": "8422930e-2848-4c04-826a-58f8e5647e0a", "comment": "Malware payload (Mirai)", "value": "4593453870a3977dda97d28c4412a8389adb0bd269af458c8a6cf39d854055fca60b5f6ccd51401349c5137321749686", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707461, "uuid": "2aa29097-0331-47c5-8207-09a7e2ff9078", "value": "T10D03F1CCD121AD51C2BE88FEC17A0B399D9471C1315AABD95323189C63B521B7BDA870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707461, "uuid": "128231c3-9509-4f48-91d5-721b4cbc3265", "value": "768:cFH9WA2z4wYpojnDQTTHhcEmtFgXPvacYbiFXkpdjg3sITrKH2W0:GEYpknkraEjXAFTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776707461, "uuid": "a478e100-12fb-469b-a115-2f74e25ec5ef", "value": 38840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776707461, "uuid": "dfe27920-e84b-4ade-ad02-dd39e520e87a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776707461, "uuid": "8fa42e86-6d6f-4a90-9e11-f146e6b63485", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48de82b-3ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776708518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708518, "uuid": "f471aa81-d3f5-44ca-b613-f43fa259972a", "comment": "Malware payload (Mirai)", "value": "a8e31732bf032269b9dbd6940e1940c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708518, "uuid": "a3da6bf9-b572-4e2b-a988-25d2dd520352", "comment": "Malware payload (Mirai)", "value": "f85818f79cb18bf7fb907d21575c2973f699c77d7937db9d975734bf7427bddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708518, "uuid": "c9a7bb75-e45d-4798-928b-0181b3ec61e9", "comment": "Malware payload (Mirai)", "value": "c91fa3c9258ac980c72a9693c873b57b2247d6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776708518, "uuid": "87c503f1-c165-4747-9eee-e5ccfb407a1a", "comment": "Malware payload (Mirai)", "value": "769d1fe125128109e60999905e22efb1eee8d44a2b15b06f80ba237aaaf3fc0433334f846be2bef845d3ab3017337d03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708518, "uuid": "c874b10d-6871-4512-a05f-419de86b50a2", "value": "T142132896FCC25A2FC1C013BAA66F5A4E3760E3E4D2CB76179E485B6137C610F1D5AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708518, "uuid": "126a0196-b02c-4b31-af23-e64ac2e6eba8", "value": "768:bi2HuIXbS/lpE8BrxXLp1ZHZQBfsyU0p9fZoeBNuw+oO8:brrS/lVhLpX5MUvW9fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776708518, "uuid": "d8b8663f-ba0c-4b0c-b7f8-0959a794cf35", "value": 43000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776708518, "uuid": "179adf92-3924-4b8d-8a2a-479faf280a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776708518, "uuid": "59e59c5a-d5a3-4b38-ba7e-aeee5ab01af2", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f492d00c-3cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776688332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688332, "uuid": "a240db49-16b9-48ee-9d1b-d62a902f0afe", "comment": "Malware payload (ACRStealer)", "value": "9543b74664737d16e5b8123f18da57eb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688332, "uuid": "74d69417-695c-4b44-b058-0a379a4180be", "comment": "Malware payload (ACRStealer)", "value": "f87468b5e99b559edfe6a3a0c904b9599044c6db09cc7e5690e1120a95df54b2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688332, "uuid": "d4e5bd3b-0436-4831-b935-e9b1d36100b5", "comment": "Malware payload (ACRStealer)", "value": "0ad24bf35aa9cfe6d18e3461897ec30d70150496", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776688332, "uuid": "98d155b7-3ea7-4115-85d7-9e53c0a9dc04", "comment": "Malware payload (ACRStealer)", "value": "0eddd38ca36a461ff252fc971355d850d289980d12bfacfc94c55111813c8cc82f6ea2bdc854500b63053d8077670d8f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688332, "uuid": "bc49f065-c19e-49f1-b89b-8866d3a34fab", "value": "T1CF168E2BBCB95C69D08AB13484736605F6A5B8081B2327C71EB0B7242F773F15AF9B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688332, "uuid": "3668707d-09d9-4849-925f-472ff7b1db03", "value": "004d2565b8f1dc91a38c51b313ce5d5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688332, "uuid": "fa2199fa-06bd-4cbe-84ac-fe615661fb3c", "value": "49152:DBOWOqOqvMfWFMB9OznFch1c06ny61fef2gp2yPZ0t3LlcwxjqQc2eJ:DBJbDFMO0r61Wegp2kZaLlpMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776688332, "uuid": "fe391187-a58e-4533-92c1-4b316a40b356", "value": 4322144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776688332, "uuid": "5b3bfdd0-0a05-4240-8c04-31c70d229eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776688332, "uuid": "d0e8a552-db96-410f-ab61-07c9922e389c", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b990ad78-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776726028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726028, "uuid": "b8aca530-6ed7-4716-baff-6742aeddca7d", "comment": "Malware payload", "value": "13105cd999ff4cf7e7cb0ebc5d294297", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726028, "uuid": "4312b16d-68b5-4478-bbb0-afbf48d37ff7", "comment": "Malware payload", "value": "f8c92ec4d4ecedc0c234c793b03adf371801c283602a637586e78fa3bb661a1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726028, "uuid": "617a68fe-e163-4fa6-8663-18ae525b8907", "comment": "Malware payload", "value": "9f0d7ea74cb9f9b865f389a1e0cc243aac82fe09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776726028, "uuid": "37dd1d97-050f-44c7-9ffa-2b9298c25eea", "comment": "Malware payload", "value": "139ff6b6f0b30d5041350166f98efb2c10c20c98a12a0b42456e7149ea7f4976e39795174d89850d28f3bab14bc814a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726028, "uuid": "9a8df0ad-66d5-475a-b82e-895eb8c73020", "value": "T103A3395B62EA40BBE1BB8638C4534A09DB72B8514721AFEF43A4425A1F233D19D3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726028, "uuid": "e5a8080e-0066-477c-bd91-4ecf15a2c6d3", "value": "f86306582ae7ef5040867987a46e12e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726028, "uuid": "53a73653-c757-4f03-99e4-f0087cd4be72", "value": "3072:NyMA45KbE+c6GsOEQbQwWKqe9L2Q9ZVbZaZaLEt3LPRkw9vu:N84gbE+5hMQwWKBEZ9vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776726028, "uuid": "42fe6adc-4ad4-46ac-823b-b8858e813d04", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776726028, "uuid": "611a9393-0ec2-490f-a1cf-7284d0dc8921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776726028, "uuid": "af9657a7-c48f-4551-96ee-bb5bcf6ba20b", "value": "f8c92ec4d4ecedc0c234c793b03adf371801c283602a637586e78fa3bb661a1f_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd1e7c-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725163, "uuid": "553f943b-41b1-4363-8764-e7264938f731", "comment": "Malware payload (RemcosRAT)", "value": "434a86657c42c324e59e025bce1a11f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725163, "uuid": "457d44d4-abea-4ea1-b59b-685047764ba2", "comment": "Malware payload (RemcosRAT)", "value": "f943e9d208d6ee61e7329e7673537df12cbd74a06c277424b23c4c5d87ab9641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725163, "uuid": "b33065eb-9b1b-481d-9669-70bcc36c1f06", "comment": "Malware payload (RemcosRAT)", "value": "04f65399b376530061058afa4363a3a3a7d102ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725163, "uuid": "b889fdb5-5fd0-4705-ac53-342156cc0705", "comment": "Malware payload (RemcosRAT)", "value": "4f89e2918e6aa9e1a4f9f789286e51f2ad3729365fe26bfe9cfa1dbecd0d40e97927186d476f8abf8a55b13925956d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725163, "uuid": "95059c46-bd3f-4351-b0b6-7e6728fa866e", "value": "T193B4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725163, "uuid": "c9f2786e-2d14-41f5-ac3f-a32beb4e9c16", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725163, "uuid": "3ee6b194-5fd1-4d73-acb0-d5a4ed68bf78", "value": "6144:NXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBceIS:pENlHV9FGeDWv3jADnyYiCNrsPZ03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725163, "uuid": "c620825d-ff18-42b6-b8e4-18df3b1325f4", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725163, "uuid": "751f5f50-b7d5-4ba2-998b-4d1cec355dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725163, "uuid": "5690fb9c-6c30-45eb-8778-a5e8270f7b78", "value": "f943e9d208d6ee61e7329e7673537df12cbd74a06c277424b23c4c5d87ab9641_343b5bc8-de2f-4246-b026-6b7713c41703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fe5f04-3c82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776666800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666800, "uuid": "10736d68-ab8a-4afb-8abf-f5ea80f7d72a", "comment": "Malware payload", "value": "17b78f352d2f33d3459fb4250b6ba180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666800, "uuid": "6cbe58b5-b370-4290-a30b-9c67e5d909b4", "comment": "Malware payload", "value": "f96b96483661f829245f603a1feb53cebd277225dcaac7ecf622ced869499756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666800, "uuid": "9ef95058-f346-4327-ac3a-ee48ccaf23f8", "comment": "Malware payload", "value": "b02b813128e3837d561611e68e15e92ab3fb8959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776666800, "uuid": "94243e0a-32e2-47c9-b2e8-8ccfeca9dc69", "comment": "Malware payload", "value": "b11d2d4c3f8c2eb313004a4a57bc1c37e0389f0ca502747fa7dacafc44e8ed91db5be402bddabdf5dee32cd76aed7a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666800, "uuid": "26ab4279-7f23-443f-8cb8-78c13f61b733", "value": "T15EA623F278E5F591F4878E3682CA674C53E3B684E52B1A4C7B8616810F30F538BA5937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666800, "uuid": "75d729ac-f3b0-49bb-920e-f9b3000a36e8", "value": "0aaf4e7251fa18c8dd095ff221693929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666800, "uuid": "b5e46b55-43a6-426c-a2b1-6cb7092a5798", "value": "196608:Ixi2hjOHjMi8ewRlTT7kUfZvDh4iaXDKlkK+mvvL5/ZUMbQrQrUWGJT9k:2VSjMi8ewRRToUZh4TXDokqvFxU9r3J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776666800, "uuid": "87a36133-1628-4303-a070-95ddfc76e1f5", "value": 10367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776666800, "uuid": "bacc3dcd-886b-40c7-87ee-cf4992f10e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776666800, "uuid": "2ffa618f-af90-4b2f-9762-1ebc00d7dcc6", "value": "17b78f352d2f33d3459fb4250b6ba180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23696cb7-3cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776687551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687551, "uuid": "3a550dd7-87cc-48ea-bf64-40f773734700", "comment": "Malware payload (Mirai)", "value": "098fbab296567eb7e6e48c23ba45abb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687551, "uuid": "0d64aaee-d52f-4549-8e2b-1542b65bc442", "comment": "Malware payload (Mirai)", "value": "f9fde9bd7b2e115900b34d15ed4f352c0ee62d5f5816079d0b86e939ea33d135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687551, "uuid": "eb0bbb86-d508-4b33-a157-a1c1739194c9", "comment": "Malware payload (Mirai)", "value": "d424315713c15de6fb60eea27cd220c15335c9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687551, "uuid": "3d828948-55b0-4973-8278-e9900b37f8a0", "comment": "Malware payload (Mirai)", "value": "68ecdc29e68d016834ca7418e794d933143818f6a967d949b05c2348d5304c1cda8cede5f24ab754f3b5991aaf7d922d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687551, "uuid": "56a76aa5-df1b-48d0-9995-d6eead245433", "value": "T124336B31F93A2E17C0D4A47E12F74724B2F1675E25A8CA2E7D720E4EFF14A40A54B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687551, "uuid": "35730a3c-25a0-4009-aee0-4daa6267c627", "value": "768:t2oVxxtq9KqLPbMl/ekt1DYZYl6yaf4TojaibO+ypGvzYi:t26xxtSFPbMl/lt9Yqlps/yKki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687551, "uuid": "85ce92e7-94d0-4134-be3e-a0121e4ca88f", "value": 52292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687551, "uuid": "bf39e832-1ae5-4477-87b3-8ead61ef4665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687551, "uuid": "1222ae29-200d-4297-98cd-a72375b363d7", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a209ae-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727095, "uuid": "a10b8b8b-8589-43f8-8c2f-ada65968fcc9", "comment": "Malware payload (Mirai)", "value": "d8eef9849f637fa75f9ff7e94a32f4db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727095, "uuid": "15e5aa5d-9be4-4357-8862-b57133135e08", "comment": "Malware payload (Mirai)", "value": "fb1c7cbac8fd5b36dc9692bb0993891567953b039e248ec514d42401b785668b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727095, "uuid": "b6b2599b-d2ae-4376-8c0a-eb520e0e851c", "comment": "Malware payload (Mirai)", "value": "f10ed93a98c032e463283e0a825023d405c06be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727095, "uuid": "a37535ae-a7de-4785-bc83-755606fd2084", "comment": "Malware payload (Mirai)", "value": "a1fa51173259f6f5ad3386fdfbd439b2db284e3ab21564bd420abe65f78b9cbc737813c0a51c593a45ca96abba336617", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727095, "uuid": "56194ae7-d79e-4ad7-a591-ff4ede664349", "value": "T1E5F2E160F5943889DFDA5C392CD5D2C8B7E19FB933486FE26AC11F01290EC26A957DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727095, "uuid": "26dee2fe-6dd9-4835-b89c-5e14b91910f4", "value": "768:X7160aX0xrq5uHZEUZxhIvTyWKeB/SR+X4uVcqgw09e:X7160akRou5EoxqyChy+X4u+qgw09e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727095, "uuid": "afe2a6f6-f83d-4309-8939-0184a78162e5", "value": 35108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727095, "uuid": "de101705-3913-44a0-b64e-5cc0046e8983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727095, "uuid": "fd17a48a-10be-44ad-9b2f-28284daca7a9", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175fb71b-3cde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776705999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705999, "uuid": "eb65f166-7499-499c-9ef9-90d925ed8e88", "comment": "Malware payload (Mirai)", "value": "d03c3f895c1af352c230019ec75687cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705999, "uuid": "cb14d925-2bfc-40d2-94e5-4f39be643f25", "comment": "Malware payload (Mirai)", "value": "fbe3054fe3103430d68590f708e89987da9ec0a0cf10e972e3ee079717990dae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705999, "uuid": "e9b70925-7a36-4ae6-8d58-0cae95d0367b", "comment": "Malware payload (Mirai)", "value": "fe58c8a1c8bd3f67534303b51ee748c6a05a9b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776705999, "uuid": "887a8497-efe8-458b-bcdd-0a38856b74e1", "comment": "Malware payload (Mirai)", "value": "5abd17dfbd6473e2bc08a0e0ba684b8a3ee9fa0cb0704e432272a1eec4093a6d8f3e5cab2232b09af14a0c78a04f5e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705999, "uuid": "14c4192e-dbc2-4dbe-9e22-fcf24c5fedb6", "value": "T12C734A56FC815B23C6C1127BF76E028D3B2653E8E2EA72039E259F2133C791B0D2B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705999, "uuid": "609b43e9-60c9-4eec-a9ea-d0c76c00bf02", "value": "1536:+/NGC8w9+qrkUui/vdd0+fKo6h6zk+XgLvpC:+/NGC8bq7L0+iV0OpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776705999, "uuid": "b70e4bea-0490-49c8-83dd-a01ee9ee694a", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776705999, "uuid": "76d04a50-d54a-44ad-bdbe-7f020d340f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776705999, "uuid": "3715b258-0cb1-4c3b-b8cf-934680493042", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5910f2-3d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725229, "uuid": "b72848b9-51ad-4c9f-8dea-50093061092d", "comment": "Malware payload", "value": "936bacca001c4b40e5e10d1e19b324d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725229, "uuid": "ebb13a78-9a1e-4647-9d81-787d392b2bef", "comment": "Malware payload", "value": "fc03984bc9a74cf7b1f3f6e6b6403b2942fa66b5aa5fae146f8fbd0fe1048b60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725229, "uuid": "21d9f8b9-ab3c-49fa-9f62-8d9c7a512fa4", "comment": "Malware payload", "value": "b42078fd29d96c0ceb8e2f03bbd536b103855298", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725229, "uuid": "b15c0289-c451-4087-8c4d-46076ad8df3b", "comment": "Malware payload", "value": "814d08c2643069c504d04523f24b0db42fddf531e0203e995bb6a15b615530e15336f6cca2777ce81d586540bf2b1fce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725229, "uuid": "9daffd52-6cb2-43f8-9bd5-3005b3d30d4a", "value": "T17BB35B5BA2A510FBE5778678C4670E46E3B2B85217609FFF03A4421A1F237D18D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725229, "uuid": "f30aded8-5f1c-424f-8f62-b91438028632", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725229, "uuid": "acd8aebb-f479-4311-840e-d81eb98f07b8", "value": "1536:9LbvtrLOUnelseYw4MhLVxj5pVTH4SFcSdhn+hlLSvtEJsWTrd79dl2jcCV25pN:9nl/Rngoyhj5plYAhn41QtqBzkjL2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725229, "uuid": "bde76b9e-a63b-479d-96ff-e046c10741e0", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725229, "uuid": "49a5b4c4-f049-4267-abf5-49e0615d45d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725229, "uuid": "ba49d083-543d-4570-9e96-eed1aa32413a", "value": "fc03984bc9a74cf7b1f3f6e6b6403b2942fa66b5aa5fae146f8fbd0fe1048b60_IPHLPAPI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cd6176-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725866, "uuid": "8d0f1472-fdbc-426a-8f37-bc99538986c6", "comment": "Malware payload", "value": "9cd67a13c350820d05b38be042d34e50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725866, "uuid": "e5463d68-b5d4-42e1-a2f7-4f51413c26b0", "comment": "Malware payload", "value": "fc5379b558a1fffa024063a183959199845b50031c80aa48792064d7b20934a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725866, "uuid": "ac75dee8-6037-42d8-a306-1364e6dd7767", "comment": "Malware payload", "value": "d9791447bcbf41a2ea3ae79c778233024ab0ff3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725866, "uuid": "32f1970c-fd0e-4e07-b160-b5258a26c2d8", "comment": "Malware payload", "value": "f56902f24dfc422936dcdd6048c939507206419c2485f618a7024c637292ea68aae74fa8dd1fcd93db9cd03b337f6c45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725866, "uuid": "89ddc802-8147-4ab6-82a2-b5ae930fc6f3", "value": "T1E9A3494B63E640BBE2B78679C8530A49D7B2B8454720AFEF43A4465A1F233D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725866, "uuid": "0349ff69-f6b9-4028-8134-86f8c95114ed", "value": "f48fee4e1343da73af56273872d2bc4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725866, "uuid": "7665da96-9490-4dd4-b7e4-6f1f11d36bec", "value": "3072:iEe/mXk5DIMGyCQbUAdtE/TvrXT/7nM4L3zm2Q9ZVbZacTChsrf2k:ioXiDb0MUAdtu0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725866, "uuid": "7fbcbced-69cc-492c-a727-12e4d5d40241", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725866, "uuid": "f67e6814-44d1-41b0-a020-d1a257463eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725866, "uuid": "4935638b-cdd1-4b38-806d-6a949a6c4f11", "value": "fc5379b558a1fffa024063a183959199845b50031c80aa48792064d7b20934a0_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df771c9-3cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776704910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704910, "uuid": "7bd3693a-dec8-48d6-8e8d-a44a86a2fb5d", "comment": "Malware payload (Mirai)", "value": "d878bcc30639f2cf0d6121d3bbe0c60a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704910, "uuid": "4273ad99-dd81-4eda-8623-fbcfcc1927f1", "comment": "Malware payload (Mirai)", "value": "fc9d9c8bc31be3c627a1f76016820cd6a029c7c1671fa97786bc73c0ac2a5643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704910, "uuid": "da8c9fe1-3e64-4ea8-ae9c-f0e02be3e225", "comment": "Malware payload (Mirai)", "value": "5f82ac57b05d720a549da870510fff98b5a0eaa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776704910, "uuid": "fe1d64d0-b9d3-46fd-a966-d79c8a6d5fbf", "comment": "Malware payload (Mirai)", "value": "588feac12e6af99322051804fba19742975f57b9b1eb2af25d2370a5179decd01408f1326f4bf2ca7bd92e5302180b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704910, "uuid": "9e32ac7d-2317-4130-b0e6-c55ee004118c", "value": "T13E735C41B3480D43C1971DB03A3F3BD69BAFE9D122E4F6856A5F97865172A33144EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704910, "uuid": "d9da190d-8f81-40a7-978d-3b1f763b81ae", "value": "1536:gE+D4wtQpNZSh3NFd8YnulS7IJV+OtPdas0LOw:F+D4wtuNgrw07IT+skOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776704910, "uuid": "337ed0ff-beac-4044-84a1-38b29ca756c1", "value": 75432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776704910, "uuid": "0d81a48e-db5b-4908-98f1-efa59e3ecc94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776704910, "uuid": "163044d5-d2fd-4426-8e1c-a286fee2a18a", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2896eb7-3cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776696408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696408, "uuid": "15de0c3b-a646-4018-ad73-f0d1cfe65489", "comment": "Malware payload (Formbook)", "value": "e349386dce274c4c98b4c0648de23577", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696408, "uuid": "df6a8f10-9763-4b38-975b-8346911fa853", "comment": "Malware payload (Formbook)", "value": "fcd575031f3cc1024b2b4ba9f6688ed9e09a0e04d9298e12c28f3c8bf5c6cc58", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696408, "uuid": "ccb9f32c-8e82-4730-84d3-1e1ea061068c", "comment": "Malware payload (Formbook)", "value": "b91e0555aa13a580a893cd1b752e809c587aecc0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776696408, "uuid": "521bde6d-1a08-4e4f-9aee-69256175e697", "comment": "Malware payload (Formbook)", "value": "4038a8bbffc76d9794fe685677ecf3379accae3c37d07b9965a548d26dfbabb6c838db8e5af99352c357124d21c0fb02", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696408, "uuid": "d6898954-4cf3-478e-9410-42d2a8eeb2d1", "value": "T165C2823EC9845FF40B9E61E2298F3D51965907127A353A0EB9CED89C3B39250CFE01E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696408, "uuid": "e61bfb17-ed2f-4b9b-bd53-367f0058d5c7", "value": "384:KbrDmoZTZpUU6mcX616zhpSsqA9g0rkf3lDdzetlOOswKJXl2QksS1HHbWEU7gH/:KbrKO/UUeqKzSvOxCD9etlQXNA1HKELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776696408, "uuid": "90823e8f-b272-4b4a-a793-24f2a0f0c624", "value": 26846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776696408, "uuid": "5ec9f632-6f49-46c8-ae2f-553c17fa4a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776696408, "uuid": "0bf4a349-4803-4733-b189-537a8f437800", "value": "fiyat tek -EK B.26 Huawei siparis Formu_2025V4 - Kopya (000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ac89e6-3d0c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776725914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725914, "uuid": "7654e7e0-6896-410c-8e51-0ddf2ae2e171", "comment": "Malware payload (RemcosRAT)", "value": "d9161daf17990e3a9575b887ef787194", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725914, "uuid": "40a1d515-7d34-44a4-8bbd-915b293d4bbf", "comment": "Malware payload (RemcosRAT)", "value": "fcd6427862bc5672cd51c26562025d6d846b4f635a0b39c004e9c68a0c266c88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725914, "uuid": "bb2f33be-adba-4e71-aa7e-9e450ddc3b45", "comment": "Malware payload (RemcosRAT)", "value": "1ce3ad96f6dcb85094bb93261138ac24407d06bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725914, "uuid": "c6cae5d7-10a7-4297-b1e3-e60662ffc632", "comment": "Malware payload (RemcosRAT)", "value": "4fef8a4742ee3fd0d281c2cdaa5704d0d3c7d98fbd2107e3069e25e253b3884b5cc90b4efa7d1443c9a1bfe81d6d8091", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725914, "uuid": "e820c578-609c-4a9a-a92c-18cd9dc786b2", "value": "T1BCB35B4BA2A500FBE5778678C4570E46E7B2B85207609FEF03A4465A1F237D18D3EFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725914, "uuid": "2928d707-ba3b-45ea-bf47-e5fe2a0916c9", "value": "b02e9d31137bcac15ee5b8110aa29b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725914, "uuid": "de2d1c5f-e759-4555-a61d-668e6e2b2c8e", "value": "1536:9kIQtkhbUf5ZYT4FqW8/SpzTHASRmwuShGTCiHWNUtEJsWTrd79dlbWiHgxXz:9qtqUfAsWSpHg0uSmCOWetqBz9WOgxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725914, "uuid": "ed21a3c4-5aeb-4c68-b58c-b82ad885b5f1", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725914, "uuid": "b016c342-25d7-431a-8e16-6573dd4ea699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725914, "uuid": "f93369eb-260d-402a-a32c-4b6eeaaedec8", "value": "fcd6427862bc5672cd51c26562025d6d846b4f635a0b39c004e9c68a0c266c88_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c47ea-3d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776727100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727100, "uuid": "7c8941eb-048b-4454-a5c2-7ce2f55b5cd3", "comment": "Malware payload (Mirai)", "value": "49fcc13b789a63a54e603e53537d4d7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727100, "uuid": "f9fd0efb-7571-46ff-979e-019cc70535ba", "comment": "Malware payload (Mirai)", "value": "fd6d598e0274753e51dbf8c0f78482d9787e4466afdd866ac2b357b93495bbd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727100, "uuid": "0515fd0d-e8d8-4d4b-a10b-0bae98bf30c5", "comment": "Malware payload (Mirai)", "value": "66b6976f108cc5eeacc3eb3800c70f413ca6f181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776727100, "uuid": "5296faa7-d318-4c63-be4a-9b7bddb43876", "comment": "Malware payload (Mirai)", "value": "9f5f3d0e82160e24d7a40a7c1c232659c70241151426f3c71fba9dd39cc69c63f44fb168d73a46d67f20b5239efc6e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727100, "uuid": "83d4c96f-9d2f-447e-aab3-e1a057d3f41b", "value": "T1985301E1A440D1E3C35902BB25A4E807FB651BBC79DA306B366D874C9193D487CD7AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727100, "uuid": "1680546b-7036-4d59-8e8f-1547e8b9ac0b", "value": "1536:zVQSmwtMJXmejtc0EloLTM5Tfv83KJ2crl2EWI:zVywt8XZuloLgTX83KHl2EWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776727100, "uuid": "f33f8120-355a-4b79-98d2-0e7f6bb9f207", "value": 61844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776727100, "uuid": "cdbbd88d-13dd-4b9f-a93d-fbdb8f34a8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776727100, "uuid": "b03f0139-ce17-47e0-aade-56dcb2255d73", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d1e61c-3cb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776690045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690045, "uuid": "ff156818-af0b-4b03-b7be-dd22dbf630f3", "comment": "Malware payload", "value": "4e732b7218f5bf0984647e420a96e782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690045, "uuid": "c6435afe-156f-41ef-8b21-6ebae22642a4", "comment": "Malware payload", "value": "fd759e637d53562c98e78158f0e2637d7393c61cfc4cd548489344e663220119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690045, "uuid": "232346a8-c292-42b9-9dc7-19c98d666f94", "comment": "Malware payload", "value": "4d4bec5444b5b8ecab95fc796fa751323de5965e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690045, "uuid": "a6420771-2046-4926-93bb-ec57889c4881", "comment": "Malware payload", "value": "022fc358423c2b3c6dae9a8a1475fdb0a0c702abc754b71f271ddced164a0a2dba26b0264165b7ab46e1b891f8324bc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690045, "uuid": "a2d37a70-987c-42c2-a41a-9a2b48655a58", "value": "T1BD665B73905514D4D2AED974C6152213BEA8388B673873DBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690045, "uuid": "259cb250-585c-49dc-b2ea-7c5da224211e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690045, "uuid": "65d0b4a5-a826-44a9-918c-6251ada312e6", "value": 6488064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690045, "uuid": "d487d4b3-4545-446f-82e0-e910a439db9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690045, "uuid": "a1ae059a-226b-46b0-8242-8dac45d21b01", "value": "fd759e637d53562c98e78158f0e2637d7393c61cfc4cd548489344e663220119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77417b3-3cb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776690054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690054, "uuid": "74cb326a-ab9c-474a-a19e-e338da5b484e", "comment": "Malware payload", "value": "1b452e32afd2da7c14cdb95621f66d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690054, "uuid": "911a1488-f55b-47c1-a0d1-87f853b5d3b4", "comment": "Malware payload", "value": "fe1af4ea78458b3c1c3dbba118d6ac58f14fbbc2fdf53abecc502345879f8d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690054, "uuid": "7d840274-2a2e-4827-ae19-26715f464be7", "comment": "Malware payload", "value": "14b4158d034968ee2ee9286859476d7d5449622e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776690054, "uuid": "d9f32dcf-8ba7-4730-8c3b-1df72f89b17b", "comment": "Malware payload", "value": "b7dcb7afafd26914f33fb6d00cf1def53a7f1e46b77cfface7afebfc209f148b0c51a459763513318746972b06b68af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690054, "uuid": "a8f57b13-7e8e-45ce-8448-1aa349f4e038", "value": "T1D4C5E857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690054, "uuid": "b017f02e-a5d8-4e62-ba48-4bbe103e4a06", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2V:cqYUQuVDt0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776690054, "uuid": "beb4d5f3-2ed7-41fa-9b8b-a957c8c30e59", "value": 2686976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776690054, "uuid": "d5425d5b-b062-41cc-9ef5-54e86be611d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776690054, "uuid": "100446c3-a120-436a-854c-31b5fa45489a", "value": "fe1af4ea78458b3c1c3dbba118d6ac58f14fbbc2fdf53abecc502345879f8d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22ec71e-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725613, "uuid": "69e033a4-dcfc-41ae-9b30-9a39377579a4", "comment": "Malware payload", "value": "66e4e34f739d35b308217921fd4a6649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725613, "uuid": "161c4a38-ae1c-419e-be99-5eb6bb2474d0", "comment": "Malware payload", "value": "fe3ddef235a62941b2358d67089023e2650efa0e04bdf927f4ae2a07cb43d392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725613, "uuid": "5167dc46-2287-4769-a734-f9d5e73ea1ba", "comment": "Malware payload", "value": "482533baa7929bd157c1b1f36e405f98272366dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725613, "uuid": "e45363eb-7b5b-4d2a-9739-b6a175a168a1", "comment": "Malware payload", "value": "99fa71472c86ea13ecb651eac2ee8150237bd6ceaf9af692e1fdda2d731c41666504d9b4324ce592ef5d51ca7f449578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725613, "uuid": "4b1a6cbd-d692-43c4-a026-30cf394a5d71", "value": "T163E37D5773A530F9E0B79239C9610A56EB7278320B609BDF03A447762F272D19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725613, "uuid": "71b24edc-1fc0-44e8-a9a6-aa2a3df48a06", "value": "ba78428f422ba3fb41676219466ad7aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725613, "uuid": "cdcc9659-eacf-4133-85dd-6062a5fdb01a", "value": "3072:I6Jmr+iAoqMBKAWyCnQdH6dG+SHVX/oXI81G4QlD:IBr4ohYG6d1S1jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725613, "uuid": "972d6024-a69a-4954-bff4-31a23e478d6f", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725613, "uuid": "7eb14717-c0c7-4625-9ce7-56a0c99a47c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725613, "uuid": "354ce9ae-4551-4760-97c3-ac01576b848b", "value": "fe3ddef235a62941b2358d67089023e2650efa0e04bdf927f4ae2a07cb43d392_730a4e88-b4f2-4cea-be1b-cea7d3f7d863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c9c7f9-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725485, "uuid": "d7630f59-473e-4370-a311-b7d15ae3c6e9", "comment": "Malware payload", "value": "d76884b8720a37ed6aba536354265742", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725485, "uuid": "055fccc0-bdf1-4ca3-aa67-34116e2a0da2", "comment": "Malware payload", "value": "fe8fa9a23b9fe097ac7974020e5fd9a363ef990f90da32957e006c1ec67c5dbb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725485, "uuid": "897d4e28-644e-4409-821a-e5aa86decaa4", "comment": "Malware payload", "value": "2fd97b597e90f96e5e5a4fdfbdb84a68a5a5ce4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725485, "uuid": "56953bc7-1087-4c05-a8b1-f051c00a8a7b", "comment": "Malware payload", "value": "c2261e4bdf53cde9e68a3796beee0bebb8d32640591d24ee5ebc1128c4f7bb26517c1f66e40c09ff067b183255922e56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725485, "uuid": "d2f07ea7-2fe1-4cf4-aad3-ad4e14af9af7", "value": "T128B34A57B2BA10BBE1768738C4674A45D7B2B8414761AFEF43A0429A1F273E08D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725485, "uuid": "e646f8a6-7581-4b67-a4fa-af4130bc6349", "value": "9a399883818041cb9c48b9ce035b576f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725485, "uuid": "1c3b0803-4f75-4efe-91c0-9dd8771bc751", "value": "3072:ahpZR96uepIniy8oKtRVQezDZ4Cc1x5qV5H2nq:a1RMvZy1KYdiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725485, "uuid": "73e6ec3e-71a5-4b89-b454-bde4c9ba2e51", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725485, "uuid": "7a169ab1-9302-4583-b31b-853813aae19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725485, "uuid": "397be926-f424-4772-96de-531927e0413d", "value": "fe8fa9a23b9fe097ac7974020e5fd9a363ef990f90da32957e006c1ec67c5dbb_IPHLPAPI.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad30031-3cb2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776687161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687161, "uuid": "7620d071-3fd0-4c2d-b5d0-72babe594850", "comment": "Malware payload (RustyStealer)", "value": "c8866c94d0a0c2799bc775884043fe59", "object_relation": "md5", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687161, "uuid": "5ca36d06-5e47-498d-8627-41b9c4328b6a", "comment": "Malware payload (RustyStealer)", "value": "febb9b26c945366c37072e73f2703fb19a95aa3d7f101c4d187f46466c221227", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687161, "uuid": "98b22710-bccb-462f-a881-3074bdb8048c", "comment": "Malware payload (RustyStealer)", "value": "7d82b6624d4a97d744c8ecf337be621cf0a7d626", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776687161, "uuid": "86ffc33a-6201-4ede-887e-520d0dfc7ba4", "comment": "Malware payload (RustyStealer)", "value": "22377e8477cea47b2f0b8e7646881d020cba56cb9836af5fe1678ede1577c0612efb54e423c14eb0372d22868e45afd9", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-132", "colour": "#6EBF39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687161, "uuid": "c3c6c61f-11c6-4cfd-85f0-bb9557fbc77f", "value": "T12CE46C17B69485E8D05AC078835A9632FA77BC8E02207A7F0BE45B303F69F646F1D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687161, "uuid": "35f3d0bc-ea87-4069-aabe-8fa488b82999", "value": "85b50c3e79f30b489d8876ef7ed93512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687161, "uuid": "5f9692fb-3dcb-4dc4-b152-df4ec76b22e4", "value": "12288:iMNahsv6kfinM9m+uNPFUM9DXSjwI8pYHmOWUXh9wZk:nNWyfinrjNPnDm8pmXzwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776687161, "uuid": "ba798659-1d21-4e99-a797-670f6d0433b3", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776687161, "uuid": "02218992-ccd7-4545-8389-c2ae8aae4270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776687161, "uuid": "7a3ab32a-31a7-4a18-ac00-f56d90e54684", "value": "febb9b26c945366c37072e73f2703fb19a95aa3d7f101c4d187f46466c221227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a57409-3c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776674108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674108, "uuid": "568c1938-cc4a-4e44-8713-62dad4c130c1", "comment": "Malware payload (ConnectWise)", "value": "b906fec13f80445aee86d6ce1e35019a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674108, "uuid": "c02a6f1a-d8b7-4c81-aa76-a7a0b0d6abcb", "comment": "Malware payload (ConnectWise)", "value": "fede5a7846859bd1e62a6b7dbeea16d1c0edc6864e8780a3c13e200110268d8f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674108, "uuid": "9a3f294c-f1e9-4c0e-ae17-c2891b25b10e", "comment": "Malware payload (ConnectWise)", "value": "b75fd2452ce78b95ab016c97865dc6c99d227102", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776674108, "uuid": "cb42d53b-b5ee-456c-a30b-797d86217a41", "comment": "Malware payload (ConnectWise)", "value": "787d4309dde4163f5283dfe5c68b130d15f720bcf4a78f1b04c702b09b73279151796e3099368d405280bdc5e3b45fee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ggdt35-anondns-net", "colour": "#686192", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674108, "uuid": "36003df4-6307-4bce-bb56-a4d550b09277", "value": "T11246E101B3D695BAD0BF1638D87A46656674BC048316CBBF5394BD3D6E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674108, "uuid": "9dcc0833-e9f4-43a1-b784-74f69f1cff49", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674108, "uuid": "fc083ead-8794-4aae-a3a4-2bb1defa037f", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl4gLLLLK:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776674108, "uuid": "0afc00f2-dfae-4bb1-b68b-e03e1aceee6f", "value": 5788432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776674108, "uuid": "05cd34e1-050f-4a4c-9a19-eb903e67b7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776674108, "uuid": "978f22ac-9760-4ca4-a720-e7e2bd84757f", "value": "fede5a7846859bd1e62a6b7dbeea16d1c0edc6864e8780a3c13e200110268d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b72a7a-3c78-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776662186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662186, "uuid": "e543b43e-b52b-4e35-970d-6a883abe0ff1", "comment": "Malware payload (ValleyRAT)", "value": "456a21920dc79bb6bf6364f24c2e6c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662186, "uuid": "da44be17-21ef-4379-aff5-738c71e58821", "comment": "Malware payload (ValleyRAT)", "value": "fef8ab38ca1a3bd67fd930140241d6a30f0245bbba6184a3448736ddc39c7aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662186, "uuid": "318299f4-7589-488b-b264-47ce63356a33", "comment": "Malware payload (ValleyRAT)", "value": "a65ba3fcc38449e183e4422ccac874429a0fb238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776662186, "uuid": "e1ee7701-f4ac-47e1-904f-518c03580d43", "comment": "Malware payload (ValleyRAT)", "value": "ea8011a7288f4273c3216b4f5cdc4be77c11779d21aae6066a3ea6ff6bac0089eeb85581c4aadc224a8875cf8069c066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662186, "uuid": "4f96db5a-219d-4c85-9554-17e1913974b8", "value": "T12E346B21FA89C532D593213485BBDFA64DBD7931076491CFABD50A2D6E20FF2A73430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662186, "uuid": "02560063-ceae-4672-ac91-4e7c7df90919", "value": "f00eed2fb27d554bc204eb9de3e24171", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662186, "uuid": "95650f7b-2332-4814-b1c2-a33899bed6b4", "value": "6144:Kg5Tyi6B3v33YfR2fV+bvS6tBXuWqJOhp7muR1X++mw:LOTB3f3YfwV+G6tBXdqJO/7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776662186, "uuid": "6e535aae-0a72-4696-9629-e33aa50b53e7", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776662186, "uuid": "b0ceedc4-f9ab-4a60-add3-55d592a3dc66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776662186, "uuid": "6907fd78-a262-49da-9c09-fcbea08b52dc", "value": "456A21920DC79BB6BF6364F24C2E6C3A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f97283-3d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776725433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725433, "uuid": "9de4ba87-34e9-4c23-b361-6782fece8ea9", "comment": "Malware payload", "value": "48512fd657d80c8df8eacdae1a6e7f50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725433, "uuid": "873e03e7-14bf-4f27-9ff0-ba95385d74cc", "comment": "Malware payload", "value": "ff2a0e8e8d8a536bd506d9b79b9db5f2435dc20060f724e040838c1a71b39600", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725433, "uuid": "db754e2a-3f46-49a8-8c41-2d80ea2175bd", "comment": "Malware payload", "value": "647b7ef6c705eb043752308dfb94b581446a119c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776725433, "uuid": "8c33c0bd-2063-4ea6-8c58-0bbee672e091", "comment": "Malware payload", "value": "416e81833154a8f13d322bc1cc9e133d31d0af082f280d2c676c830f3c19fa481693037aa3e24767cf218b127f356e3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FudCrypt", "colour": "#AAC609", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725433, "uuid": "974c08ca-3df0-4395-aeab-266d17fe6450", "value": "T1C4A35B47B2B600BBE1B78638C8530A49D772B8454761AFEF43A4429A1F277E18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725433, "uuid": "7edb2f31-dd0c-4073-9342-26293db468e6", "value": "2ec2a909fee7056486c2bfb935658462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725433, "uuid": "e8348ff3-bec2-4137-acff-719cce622fec", "value": "3072:sTSriAfIJGupGCBQbfQMPOGQs/GWmATME5JAST/2njLhbCDvmSOo2iePG3ufWCMf:5fSGwDMfQMP5A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776725433, "uuid": "c9ecdad2-fccd-4bf8-979e-8599c06b778c", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776725433, "uuid": "6454957a-8407-454f-9379-f7bb23d05638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776725433, "uuid": "abbac219-1d3c-4a03-8bc4-46c12d3f0647", "value": "ff2a0e8e8d8a536bd506d9b79b9db5f2435dc20060f724e040838c1a71b39600_nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7af9cdc-3cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776689142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689142, "uuid": "f2d7db11-4932-45de-8a51-2698927a08ce", "comment": "Malware payload", "value": "13e80dd56cd54072110e452d65bc3aa9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689142, "uuid": "1a3b5216-4534-4bb1-b61f-145d324437b4", "comment": "Malware payload", "value": "ffcfcd69f0685f530367342d2787e14d0f93e14da496a1f5149becc507427cff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689142, "uuid": "09381737-0982-4872-a195-b53fe42bdf32", "comment": "Malware payload", "value": "971ec6d898a68c53c60c62dae267199fedae4ff1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776689142, "uuid": "a0fbf82c-af14-4140-8277-ac42815b0dd1", "comment": "Malware payload", "value": "d90bb79d029650d4ac76a92f1b4124abfa4758125e96d8fe86b08c6bae9ed854002538aa2edd4989997ea90352ce76f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689142, "uuid": "6867eccd-2a83-42ea-a224-55e06f37b443", "value": "T10632D7C2DDE028F34D8D33F94D98A22F89970D56D98AD603D95E3A81AF59CFD091D328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689142, "uuid": "0f03cc53-7e6c-4a49-b318-d1a2895377fd", "value": "192:+BE4pz0GBE4pz0CBE4pz06mBE4pz0CBE4pz0iBE4pz0uBE4pz02BE4pz0YmBE4pd:++4pzX+4pzf+4pzhm+4pz3+4pzF+4pzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776689142, "uuid": "af348a7c-5de5-43af-8f9f-3126a5b3be7f", "value": 11850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776689142, "uuid": "8a55d8e9-b6b6-4b79-883d-f133247ee176", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776689142, "uuid": "c029233c-55d7-4d93-b922-e0a723acf51f", "value": "StratShare7812.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }