{ "Event": { "published": true, "date": "2026-07-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-14", "timestamp": 1784073781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "09c355af-7bcc-42c5-a075-6e4853924912", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa7f9cd-7f17-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783987451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987451, "uuid": "0d5d4911-d654-4dc0-8655-ff322900cd7a", "comment": "Malware payload", "value": "7fdbb3f4a82f122c88991605f58c66a7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987451, "uuid": "d81f07f4-4027-46ad-a23c-65cbc34c7760", "comment": "Malware payload", "value": "00d4ea0d9de91024a65081ff5c5270c4c23d90acaa80d08040c79974f8539317", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987451, "uuid": "5fdccc61-d335-4631-b57f-7e7a32aa0c06", "comment": "Malware payload", "value": "afdc3d01fa992ee2a86d6c72718b9ec54dcbdffd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987451, "uuid": "8f4b4df4-dc1c-41db-9ced-6718b680ccc5", "comment": "Malware payload", "value": "935e0b72afa1348159fdd0977201908e62c82f735cb13932d4882423d27caff6472e855413f7971dbe99d158e828e2e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987451, "uuid": "4d8a6332-c3a1-47a3-a2c4-72cb6b84ddb0", "value": "T10CC27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987451, "uuid": "1636dcfb-c657-4f1b-8155-6aedf2c24226", "value": "768:0E8vCB+25j6es8R+9FYpMSUpi+20qUpi+20YQX:0E8l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783987451, "uuid": "97fd4dca-cecc-4ad9-af73-4e4612a2c597", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783987451, "uuid": "25184b2c-68ed-43d9-9c7f-3e4e6465a777", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987451, "uuid": "f702600c-3a87-4598-b2db-454a27cb3f47", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46719428-7f86-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784035010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035010, "uuid": "d3749403-d411-4f8f-ac95-587ccdff6a90", "comment": "Malware payload (Mirai)", "value": "6d6ce5d582ee4846d624390c00bb7352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035010, "uuid": "e5f7b340-9dd9-44cc-9618-7850f5f6f19c", "comment": "Malware payload (Mirai)", "value": "00fe8b5f1686eb713878177f730fe85c79b110fa3dd67ed26d190860a5fae0b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035010, "uuid": "70fc62cc-2ce7-439b-8a86-919925a7eb61", "comment": "Malware payload (Mirai)", "value": "d85bbca584fd3f7c98604ef443fec45b29d329be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035010, "uuid": "16895a7a-5c49-46e9-a17c-b93170167404", "comment": "Malware payload (Mirai)", "value": "481ab0163793d87660027ff9f40b3ae4d05a815a75e42a7f08498dbce1a693a7fef30567383416cd581c7ec3e0726d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035010, "uuid": "4c18cda4-e13a-4565-8d58-6d4d0360a63c", "value": "T138B46C02FB044A63C9920DF0DA760B76E36DC4911CFAE12D5D0B6F761772976A29B3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035010, "uuid": "ae8d804c-ffd6-4a8a-9095-5bebf4fd8b0c", "value": "6144:TMOcSYZi52k35DvX6Nere9REqOFxrsus+ak6z8lzKOvIpEdpMnshp7aWT8LPJK4f:TXYZiPpiEqmDri8QYh7Ij3MnvIqGG4n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035010, "uuid": "a4c9c721-2d23-4120-ba30-d42d6748d26c", "value": 526068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035010, "uuid": "76c7ec41-8b6c-41c4-8b32-adf319ad1756", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035010, "uuid": "503c7131-2ca6-4668-b33d-d510f883cab5", "value": "abzutimdw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5def27a-7f90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784039466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039466, "uuid": "248351af-2d22-425b-8aa2-e5cb646dbc3b", "comment": "Malware payload (XWorm)", "value": "4faa4dc2ba332b3ea09ce2e4480e9663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039466, "uuid": "0fbcb5b6-0ad7-4d60-a964-616d70ee286a", "comment": "Malware payload (XWorm)", "value": "0251d469d95ad1bde34b0ab228dfff4ee2bdff73f0612e6bc481667c757596cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039466, "uuid": "c1f1913d-b2e6-43f0-bf49-2e91d77d20c5", "comment": "Malware payload (XWorm)", "value": "bc7d674aa2dbd5aab2e00b85f536681b766441a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039466, "uuid": "7744a793-2cb1-4c07-8cbf-0ca705f4746d", "comment": "Malware payload (XWorm)", "value": "9fef59a357e1139fe573913ad76805f7ece0c7355dffd408f72f983c9574d137250ab9d9e0c78754043e4defb2f704c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039466, "uuid": "9234a17b-897c-4e65-a436-e5d8f6d7a67b", "value": "T19F87337606A86E98D4A4C55B4FEE6D796CA4B132ACCD73E1C45012820BC0FFE994EC77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039466, "uuid": "0f179a13-eab6-4a64-bd1d-933a44391472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039466, "uuid": "1e565906-285a-4038-af02-f086f8ccbed9", "value": "786432:EdRcC8d6uobIRlCguGSk0M+YE3wdHMaZn3msIF93V3dHnO7vqg:9C8d6bs7CgSkTTE3wdHMalYg+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039466, "uuid": "9fb19074-4c06-4c2f-9cd8-da98100b1213", "value": 36414464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039466, "uuid": "47ee96d6-f814-44ef-92a4-24bc0fdb341a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039466, "uuid": "a75ed50a-7d90-4fb9-9cfe-feaee44e5f88", "value": "taunahi_cracked 1.2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef083e-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023747, "uuid": "1312f824-1ed6-4bb9-b4ed-38fbc9ec8820", "comment": "Malware payload (AgentTesla)", "value": "64f7dbca7dde70b3ed700117b6882790", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023747, "uuid": "be4edd2f-06bb-41ee-82f0-fcb01f850b74", "comment": "Malware payload (AgentTesla)", "value": "02d99e737239cc7f05a3988add89ee3672080ca1ddb5e43b4ecf4e8891535ccd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023747, "uuid": "7176c342-d6f1-4c40-bcc5-7391359d633a", "comment": "Malware payload (AgentTesla)", "value": "d0b3f672d0ee5acaa4c2a950d98fd4b4f8c5942e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023747, "uuid": "2462cfac-c656-41a3-841b-c42a1384232e", "comment": "Malware payload (AgentTesla)", "value": "769d1b306c32a99d9d7a7493d90ddc1733971d7107f2f1aca62f3ba238e72529d2951c09763857b799dcfe1255460e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023747, "uuid": "902594c8-3286-43f9-8bb5-9a85b51060ca", "value": "T13DE5185196F862133371EBD9962DDE38D40E808339998F94B5CFFA283C1DE89B254793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023747, "uuid": "4c18218f-8af3-415c-ab38-aa4357f46eae", "value": "98304:ygDt+NVLaJQ8+ZZEdEVV7jqX3gEm9nFxqIg8YCM8nkbgQpnqL0S7C0LXuraoSVu/:aaJQ8UYE76X3gEm9nFxqIg8YCM8nkbgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023747, "uuid": "234e4ab4-38ac-47a2-842f-8e54d3b69845", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023747, "uuid": "4adc74f6-fd4c-48c6-aa60-3f319cd857e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023747, "uuid": "1b3c40fa-13aa-455d-8d79-7f75d0fd2a17", "value": "Consumable 12825.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538c5f57-7f4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784010551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784010551, "uuid": "c9875d6a-20e2-4460-8be2-3022da06acaa", "comment": "Malware payload", "value": "0bb53a39b95679dd6845f75ee9a831c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784010551, "uuid": "31a2fc55-b060-4558-ad45-dd330566c8f1", "comment": "Malware payload", "value": "039949b8b22323d91f1d590de4d4c2c2d16ee90991e2f7403f2920500e3bdc62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784010551, "uuid": "e0ac8923-fdbc-436b-82a7-b33372c95a25", "comment": "Malware payload", "value": "73fde3ac4947936a2a45e4fcec9f6414d3c99ec4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784010551, "uuid": "1d400414-ba02-487c-a9a5-d2af082cbcdd", "comment": "Malware payload", "value": "211fa8752cf77b7f026ed302fca75f48a430c56ee0dbb550de4afc2674474c1e9755e234bd2926d7913f0d29410c33ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784010551, "uuid": "2fcb922e-62ab-4508-a1cf-ae721b4de013", "value": "T190236C6516857C14AA98C4375D7F2F0CB9AD43E6314492EE7ECE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784010551, "uuid": "38816ea3-8a48-4c07-94fa-db9a058f1aa1", "value": "768:C99NyXsZztC/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:CHusZ1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784010551, "uuid": "a9ccf120-e891-400c-b7b9-923c65e1c5d5", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784010551, "uuid": "88a55395-6940-443d-8af4-b0631e8fbd67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784010551, "uuid": "a1610ed8-5487-4836-9643-013f2fe907d9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a3c7c1-7f74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784027276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027276, "uuid": "e341ee44-9d0c-417f-87a4-6229857f0779", "comment": "Malware payload (PhantomStealer)", "value": "b7e5d882f64df87f2d70b9df4df1033f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027276, "uuid": "700d9214-9c32-47ea-88a2-91300e13eb29", "comment": "Malware payload (PhantomStealer)", "value": "03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027276, "uuid": "f02d1a26-de5a-4def-a4a7-f1531804c40a", "comment": "Malware payload (PhantomStealer)", "value": "428710fe6cd300d607805b25cea48516275eed76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027276, "uuid": "26897df0-c6fd-4099-95bf-e825f84a0b00", "comment": "Malware payload (PhantomStealer)", "value": "f0a06d73b8ea186da8d241446c0ea366bb4af06411208c826260d6b805bff70fee70943933e330e8525f576998712a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027276, "uuid": "891c2b5f-f36b-4f88-b4eb-d4ffc47f313c", "value": "T18203C48EDE45967FE55636B150AF9B5002606DFE2A03C73AB8987803FD233D4916363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027276, "uuid": "57cc9a64-5ced-4cb6-9ced-b24ec905a0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027276, "uuid": "61bca9ad-51eb-4d98-92b1-c9bd240a7990", "value": "768:4z57Ngy0RKQnbFY3if1hrTA8DQpOOOOOOOROOOp7OsCCC0OOCnUMGCV8oZ7OOOtP:vnb4itdTAn5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784027276, "uuid": "87b7926a-5ddc-4557-855b-1211b671a5dc", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784027276, "uuid": "9425b658-5f61-4149-bd56-6a214cbe0d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027276, "uuid": "7de21ead-3fe3-4196-a6e2-0c9f0fdc1294", "value": "HJ GROUPS - PURCHASE ORDER #170331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d151b947-7f86-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784035243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035243, "uuid": "a2ba64d9-9974-4d26-a397-e4695705a187", "comment": "Malware payload (Mirai)", "value": "d76be805357f6000955d60da49f48992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035243, "uuid": "909d4dd7-9f20-487e-b8e1-f53057a85f9b", "comment": "Malware payload (Mirai)", "value": "0400167450453076595fc1066685a1eca7aa0b974aa655772b793d0a14771f83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035243, "uuid": "ce03b72d-4a76-43b8-990e-c6d0ed83d557", "comment": "Malware payload (Mirai)", "value": "28eb6dfb24a553eae358e14f9dce4806c0d03723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035243, "uuid": "93ba3a56-388e-4b2e-8b0e-4c05ca4f283a", "comment": "Malware payload (Mirai)", "value": "af2a470b2a48d46801ee650e84f14946041219b1a87b0738486ac41b2e9fb72efb0b89e7f9e3973faaae91910dec17f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035243, "uuid": "cbe0cc5a-a7d7-4db4-b5be-c753e8cba856", "value": "T134A34BC9EA03D4F1F8526E71087BA7368B76D4394136FA81FB612BB16C177109907AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035243, "uuid": "12b33237-d478-4ce5-a6ae-c6ca986fc113", "value": "1536:1zC0TSD9550ybyhCQdjQ01ZzuxjyofSX1WBqTVaC29zGjVh0lMQRrnul9l9yW:BCHj6LhCQdjQ6ZYSXg2VGz0v0Xulv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035243, "uuid": "4ffd9211-fd3f-48e0-81ac-293d00f301e0", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035243, "uuid": "3619ea82-eb9e-4b16-aa78-f44e0d8f4366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035243, "uuid": "d09c04f5-8e20-4915-a23b-7d631fdca0ec", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359df5dc-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "1d241a38-3997-4b38-9f2b-a33cd95de64c", "comment": "Malware payload (Mirai)", "value": "c0355a8e569ea2deb9ade614d716b140", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "4c1637f0-04db-4eaf-a6ab-3d762cce488f", "comment": "Malware payload (Mirai)", "value": "04596813fc4e3f98008d2b5d76a217d8929fa06730043c20111d2c68f35743b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "fd3ab3f1-1f27-4958-96b7-005af12e1a4c", "comment": "Malware payload (Mirai)", "value": "f237a14da54e727e4b8dfa11ed6014d96378d740", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "9d891f6d-f0ad-4634-9bce-8a410e7fdd64", "comment": "Malware payload (Mirai)", "value": "796acc2bc5d95da2f9b9f5472585877a41e9eac95c277e31dd217c9b4a3839711af14210c892a85d6531b73debf39695", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "4ac8ed7b-67de-4b12-8168-404483f9ef1d", "value": "T1A1E30907FF941EE7D4D7CC30896EC74A047FD8976688767BB63CC998394A64A0D93888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "8fb5e797-f09f-411b-a303-85b50c0c3956", "value": "1536:WngNuTZpHphByOOKBn2q0kg8Lfs8T9DYlRSUu23p2M3gd9Db:WgNulp0BKZ2Rkg8LEGElRx13Q9Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011360, "uuid": "c2909b26-f020-44ec-8817-b1d6e3bf7a98", "value": 147864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011360, "uuid": "834a9c77-5abc-4383-af85-20eaa56e5c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "3c3e3c11-1311-4a71-8012-532a2c59884d", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fd4a0f-7f5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784016405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016405, "uuid": "f60eeea2-04ec-44f4-acf4-87784ba8ceec", "comment": "Malware payload", "value": "821dd10cc0e6b6dc38de3aec435b97c6", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016405, "uuid": "2ce355c7-ebb8-46b6-be59-7a43ffb21ff8", "comment": "Malware payload", "value": "04dcae7c2f31870f4a59ed6faec513a5e252491d911ae9e62b9c3026ccf598cd", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016405, "uuid": "ddd6ac0a-ff20-45d9-ab72-59046f9b4553", "comment": "Malware payload", "value": "fc8040154e86f03178b8b6a2efe46957c60f67fc", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016405, "uuid": "1b8e4ae7-c565-4477-94f6-fe534ebad3d0", "comment": "Malware payload", "value": "f97681fa2774ee34e02cc574b0284d57ba8ab7c78594fe73ddd2218a8650715f50cba75236575a7cddbfae2f038b79ed", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016405, "uuid": "38de9019-cf3d-4a14-a76d-2177c46045cf", "value": "T1C0769F0FECB508DBD15BA275C5237211BD61BD404A21A79318E4F3386E72B947B7AF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016405, "uuid": "7329260f-e25b-4be8-b88c-f2ab45f75e22", "value": "aea6f72a3162293791948c539729e88c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016405, "uuid": "4b286187-ca4f-4a05-8e11-9ce543f2e737", "value": "49152:2FP9+lFYqZnEHaoZogxYYW1LilsvQk/ZOgCGX5j6cHWzPFWkv65btJ:c1bHaIXsjX5ecHWzrItJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784016405, "uuid": "15b5254a-9a51-4683-a0b0-18b8e186ce42", "value": 7763880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784016405, "uuid": "a5e30b04-7d43-4f12-96be-eaddb9dbe25c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016405, "uuid": "e0420778-6861-4d7a-9ea7-cee90fb0ce31", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafaa74a-7f77-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784028764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028764, "uuid": "1968d01d-44e3-406e-ad5b-f75df09ea986", "comment": "Malware payload (Mirai)", "value": "0b86de4362c739912b5fa2b0e570dea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028764, "uuid": "f30dd451-304f-4db8-aae5-de25dbd04617", "comment": "Malware payload (Mirai)", "value": "059b78013b92390545585e2719e30793bd02442946cd663a5352aaa2d6ea7bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028764, "uuid": "26ace0f1-ed1f-4f01-ab0f-0d94f463a275", "comment": "Malware payload (Mirai)", "value": "f2eb2bdf521058bc8e530e8c9fb68eb6e2d5d3f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028764, "uuid": "a1d1bde5-5faf-4704-bc54-07b9cf0c36b4", "comment": "Malware payload (Mirai)", "value": "a557697fa5fe5c11e615da7ec4eda4c77916283eb33cf47024f32a628456e516ac831223008e2b11715d22cb02c38e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028764, "uuid": "ecfd6284-29c6-4b9c-84ba-9660359fad53", "value": "T1D0332A96FD019A12C6C1557BFF0F438DB7264398E2EE7303AA256F21379782B0E2B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028764, "uuid": "9186b885-e9ec-4f8c-9682-07bf77c7b6b7", "value": "768:l1jjwTyYW7UwYtQGgmtZ2eMIwkwJletOXvoxEH2smqM1Hb1nPPnnmTcgR/I2p:Z3aDuPIwBetOXvzWs5MxxnmQgR/fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784028764, "uuid": "085ff693-d9eb-478b-beb7-567a60de7ff7", "value": 50308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784028764, "uuid": "6a654de6-40f9-4549-9ee1-b6840fa435b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028764, "uuid": "39ecc2ca-f0e8-4f98-a873-89da3b5fa368", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9101a517-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "fe0402fd-cb1b-4acd-82ba-bde399311f34", "comment": "Malware payload (Mirai)", "value": "04d85dea2b91fa194d454911f2bb2e58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "bbebefe3-222a-4fa6-b02e-02ecd6f6028d", "comment": "Malware payload (Mirai)", "value": "066f3299101449310ff83155e1622edbade8feab7e9ce09a95e7990b78e7cfe1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "94b4fd58-2184-4e6c-a02e-82af92756ed4", "comment": "Malware payload (Mirai)", "value": "121448eff8ed1b8a95a517d6bf5dca025fa626f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "be2fe7a4-0c8c-4805-be0a-afa6d3d4b964", "comment": "Malware payload (Mirai)", "value": "e81a0b295b09e33bc3c6cf94517e02a5fa2f3c2899b30a0d8f77422cea9e20df928af331c5f0e607d2dbd2b05ba34180", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "43d793bb-c8bf-431f-baf9-a30ba9120dfe", "value": "T13641DC8E1F325EF8F555D83C87370B352BAA564883C14249E1ACDA506EC030D899E7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "d224ce71-c425-421c-97df-9ec546e5a3fd", "value": "24:3OShMgJc8AmsCxj8Amyz/z2Hx7llPQYWB4u33gliI8pajDdz3N9l5zBkEp7iMpAu:+SegJNOw2HnGhgjD/9LuEpHnHvIdOR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011943, "uuid": "4b13aed4-3dcf-40cf-b06e-f2a1f4962ba2", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011943, "uuid": "003a00e9-e548-4875-b315-1fb5406041f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "3e97471d-81e0-4fa4-9b7b-f005e9db355d", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a017700-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022078, "uuid": "75dc3dd0-4de3-41b9-bb50-bdc81c22befc", "comment": "Malware payload (AgentTesla)", "value": "f49e696bffa95238d80fb60a07fcbb59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022078, "uuid": "adc3146d-28d8-41b4-bd3f-d86dfe7b0b4d", "comment": "Malware payload (AgentTesla)", "value": "06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022078, "uuid": "73710bdd-9bd5-4fe7-a931-da9892208153", "comment": "Malware payload (AgentTesla)", "value": "9aa6bc76a4a8d2dbf07ff22e07c25957602a6e6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022078, "uuid": "1a7de8e0-7b2c-41c6-905c-5125cf4d5f83", "comment": "Malware payload (AgentTesla)", "value": "b07095aad7a14703889ba74299bd56622c9e545995d285d48455574eebde98e637e46f00a5d524682f8db6a9406f77a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022078, "uuid": "e85e780c-3fdd-444e-a9ec-2bec0282d582", "value": "T12CF55C509428A8B4BD3EC33CE0377FA0465E350B2119EE2E36795658A6D3F472A9D4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022078, "uuid": "fbb158ad-e024-485f-b1b2-c54558d38ef7", "value": "98304:MBD1mGuJvQdq57MhAdRhWgxgjhMm9mtIJH1mO+PbcOuu9I:MBD1jXUeFgQOuui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022078, "uuid": "e84c562f-bfb1-405e-b9c1-f1df4eb06077", "value": 3321762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022078, "uuid": "b9cae887-abcd-40fd-bc8a-0a88d9c58aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022078, "uuid": "b1d6b154-812d-4fdf-b59f-7b55b38a46e7", "value": "06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48945221-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009244, "uuid": "9b470e20-afc1-4e68-ad17-d5d16751cf3a", "comment": "Malware payload", "value": "f77a47d0ef746e0b652b83bcec755218", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009244, "uuid": "754ea00b-f262-4bcf-9c62-9fc72e0e4cd4", "comment": "Malware payload", "value": "070b1d5133a99c4ef41c7418e1034c39386006f58317ccf647f7384b88b1a64c", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009244, "uuid": "46d0bdf4-0f00-48bf-9a77-f71c0921104e", "comment": "Malware payload", "value": "b7a30bd8d9e751b3867ef19a400b5b121acd1c5e", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009244, "uuid": "d9dde44f-a2ff-4756-8558-1183dedf85c5", "comment": "Malware payload", "value": "1333993a9ede2570872e9f2f55119934a3dab7df564c63771f28f6110a937cf148bfaec512635114031cb1c7e68a0fa5", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009244, "uuid": "d9b4b474-b106-47f3-9b1f-face7e40bca3", "value": "T1BBE3193E37959E02D26C1EBAD0D3C1145371DD0667B7DB6A3D8539A80A02B817E0EBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009244, "uuid": "a962b9f4-bccc-4b3a-966b-b9a3b411eb1a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009244, "uuid": "184c76d3-72fc-4dfb-905e-84216ccdac3f", "value": "3072:Q4aU06nl/jkNaD9JMtaCIVqV+TtMbI9fB1G1CkF18W:XmavMtfIVqitMbIvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009244, "uuid": "d2dac606-490b-4d0c-8869-155e3a8d035d", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009244, "uuid": "44d2f4e6-9887-4662-87d5-9209927fda29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009244, "uuid": "535e2d5d-77e9-41ae-9bb4-155bdba2d4aa", "value": "070b1d5133a99c4ef41c7418e1034c39386006f58317ccf647f7384b88b1a64c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1887e60-7fa3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784047646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047646, "uuid": "ac785e32-85d2-4434-a5e4-66f3c77b7235", "comment": "Malware payload (Mirai)", "value": "a3242810577f07def7dedb10ea0090be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047646, "uuid": "2d219fc5-501e-499c-a4eb-9d5980e23a0b", "comment": "Malware payload (Mirai)", "value": "086446ea42d2dddc6548112b88aa59fcea0eab0849340ee101902e4fbf55f718", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047646, "uuid": "b9d3cc78-6880-4d2c-9b85-b9c3a0f2ec65", "comment": "Malware payload (Mirai)", "value": "502c40aaec4fa1fbaf40af694a002235f2c7dbe0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047646, "uuid": "9d4f074b-8d68-4675-8245-ef207ff59587", "comment": "Malware payload (Mirai)", "value": "28ce026c248b67274c31da124f90f60603c45a1148d293bc2776a3f7c96c3e7506fce6b4e52cb8d2ae2e798225a04979", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047646, "uuid": "a42c3072-0b31-406a-8e05-08b7da553c66", "value": "T18F156C1BB2B3B4FCC167C43047ABD962A931B46511226E7F65C4DA303E27D701B2EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047646, "uuid": "695618fd-8af4-432a-8451-b965c5cdbc0b", "value": "24576:zcfuwy4kDRHqItrK3URnW4hv+Vx00JJJJJJJJJlJJHJJJJJJJFJJJARJ:zcfuwy4k4ItrkURW4h2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784047646, "uuid": "1dbd1c78-b650-4b11-86ec-89acb4ca4af0", "value": 908520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784047646, "uuid": "71b5ddcc-7d48-4fca-a602-00f885e44259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047646, "uuid": "c7332f6e-70b1-43f4-b672-feb10ea0b84b", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e509e810-7f41-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1784005641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784005641, "uuid": "42f71220-abd0-4376-9cc8-14a5f09554d2", "comment": "Malware payload (ACRStealer)", "value": "302a7f1a249f60b8024bb3a9cd03f659", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784005641, "uuid": "5ec1f53a-c026-4770-bab6-1791b2ef6d88", "comment": "Malware payload (ACRStealer)", "value": "093fc9123303ffdcd62b53d3e091bc2b0e7f2a205227825294b4f247c33f8de5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784005641, "uuid": "ec083537-d047-4043-a4ef-d4e5d184c34d", "comment": "Malware payload (ACRStealer)", "value": "2a708490610ef47392fbc48fa223e340b045a6de", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784005641, "uuid": "81979cb4-1c7b-4864-9107-690a450ce6f1", "comment": "Malware payload (ACRStealer)", "value": "5d00d240429ba4aaf966aa0934255716ad9fe3984f24cfa07dd54413edf84f71f1fd6567d77f2d4fbcadb661e44007a6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784005641, "uuid": "d323df66-f347-46e6-9c1b-c8101bc2a499", "value": "T16F1630572DF9F11EEC886C7D953A7F468479A521750CA11B8EE1FCEA0C0E5F8086A70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784005641, "uuid": "de08b92e-6924-4ef9-b7de-629cd0a798d6", "value": "846c60b7415e38d769a8b7a0468ed919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784005641, "uuid": "96110338-39d7-408d-b33c-4270d3451dac", "value": "24576:uY3DJIvaIYHufWhuNSAKE8fIcbW8yavq3:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784005641, "uuid": "55da033b-49f8-4cda-a703-fb0906352dac", "value": 4376576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784005641, "uuid": "d7594da2-fa09-4042-bb03-26cdfcdc1755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784005641, "uuid": "56b8df7c-7b30-41b7-9198-022fbde37dd3", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a681d3dc-7fae-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784052351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052351, "uuid": "dea6b4c7-2ddd-49aa-95b2-2ddc91ca54d0", "comment": "Malware payload", "value": "ea291379e3ebab0fafa234bb0a05374e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052351, "uuid": "f2cb9cd5-6717-4cc6-afdf-bf36d28ce85d", "comment": "Malware payload", "value": "0a5118fea6cffe6fd7d694ca014fd728763922ecd675c949e5c9218dc1540386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052351, "uuid": "da88a27b-c709-41be-a43f-71ec8d79fb06", "comment": "Malware payload", "value": "a9f2a96fe2c7ac4f4f20b411bcfe78f7d77cb4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052351, "uuid": "50d605e2-c4ab-4b46-aa67-c7feae7cb53d", "comment": "Malware payload", "value": "72ce85029ffe7350f173b34be49dcc3ec07eb463b4b549204aeb61dc9d197d779f3c4559a5335bad2b1dd05a0a44e6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052351, "uuid": "38a8d55c-9e16-4711-8be0-fc2ccfdf54ac", "value": "T18FE53B40831894B1A96EDB2DE437AE784A4DF00321CDDF1D38BD0664BB56E47A74DAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052351, "uuid": "76c825de-e2be-4768-9322-60c0bc21fd13", "value": "98304:RD6M5YE1vgJN3t7uavTqu6DyGtkUq3kJ1dIIwpn/GDRUs4Ky:R2G1oJHHL2vt6qjIzF/GDR3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784052351, "uuid": "9d67b2ce-a8f8-44aa-b30b-9666947f5c20", "value": 3231761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784052351, "uuid": "d4882c6a-2ccd-4a5b-bc20-377fcaee8843", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052351, "uuid": "11dcbb7a-e923-4ded-aea0-766ffa8ac509", "value": "PURCHASE RDER_NOPWQ2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32228341-7fcb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784064612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064612, "uuid": "587fef44-c5f4-4982-a836-c848b561b5f9", "comment": "Malware payload", "value": "e63dd4b969b76bb499cbdfd300de19e6", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064612, "uuid": "38707cfb-6ae3-4880-9412-2f53b17bf701", "comment": "Malware payload", "value": "0a638387a0937be2017e2fe3aca11ad3483c182a96d337de7b83bf927f75c148", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064612, "uuid": "987604b4-203a-4970-9ee1-4d420185330e", "comment": "Malware payload", "value": "61a6ef7b18ba39e90bd481967acf824f277e0809", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064612, "uuid": "e3591919-a106-4b18-8ad4-8d66ff9c7f94", "comment": "Malware payload", "value": "e4e5b14368fd0a986b0ead42dca6b53f137b5bb758008bb2bc2b0e2cfe2b8e20cd80ddbc130381d73c4a2ff5a1ca77d6", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064612, "uuid": "bf0974a9-58cf-4781-815a-686909f4ed87", "value": "T16B213BD846608BED5AC38649BB7042CCD59E42C3FC43AF49E49505AB31BC2A8776FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064612, "uuid": "9a32b6cb-2e32-41ab-9af4-4efb218215e5", "value": "24:H2/lUb8L1I/aupW40LYZpgRG89Ay+22MnKvgsro90C6:W/ncaupW40LYZpgRG89Ay+2znYkSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784064612, "uuid": "48c360fe-9a59-4183-b79f-945a06f20253", "value": 1159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784064612, "uuid": "b1ed2188-9813-4583-be5b-0a8938df4705", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064612, "uuid": "4136b048-d379-43e4-a6f6-1aacab7ccd23", "value": "0a638387a0937be2017e2fe3aca11ad3483c182a96d337de7b83bf927f75c148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2403b1a-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023702, "uuid": "32b069cc-fe40-4ce2-ae71-a7a431d6b73b", "comment": "Malware payload (AgentTesla)", "value": "9e81e898c3f44567a348481adebc6044", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023702, "uuid": "2825dd03-1321-4765-98f8-aa194390320b", "comment": "Malware payload (AgentTesla)", "value": "0a8c62f9f4bb3fbc99e098bc5fb87317c6642fb74f74da861ecc88bf65193700", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023702, "uuid": "58a15e98-2f58-4b85-b330-2d96b155a308", "comment": "Malware payload (AgentTesla)", "value": "fec9713463266967a72c983b4c30f4bd906caf74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023702, "uuid": "ad868791-83e2-4561-a421-f7bf2b1ad5cc", "comment": "Malware payload (AgentTesla)", "value": "322621abc025d6e3efafb3748fd9e0990fd630b285758a9f9c2a0a941400ba679132532be82d8d24b67d01f1140058b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023702, "uuid": "7bfd5e2b-d770-4408-bada-1e17ea01bb01", "value": "T1B606E596AAF0A1273720DBEE553BEF70D40EA4531858CF40791EE6187D0DD8B62683E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023702, "uuid": "ff74df9a-b244-4011-9cf1-71f6283f5749", "value": "98304:ipnlfcViFDPYO+LHrJ4jBfrE4UQT9p+vcC9WIbse30O+lcpd5eMU+er1iL0M/xSV:FVgPh+brJ4jBfrE4UQT9QvcC9Jbse30/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023702, "uuid": "a158e65d-dd89-4015-be1d-010263b692b5", "value": 3781576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023702, "uuid": "89ca4d59-74b4-4ab2-9888-5eb4803f4ade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023702, "uuid": "baaa9d25-e8ac-4b1e-a314-56179a6b2010", "value": "jpnhudqi.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fb6b2d-7f97-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Moobot)", "timestamp": 1784042205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784042205, "uuid": "388335f5-ac3e-4cfb-91f8-ec830cb9950c", "comment": "Malware payload (Moobot)", "value": "d805aea85ed86592c251b339ac2b6eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784042205, "uuid": "7e1d3859-27f2-467c-bf32-109f140a983d", "comment": "Malware payload (Moobot)", "value": "0ada56132a0c43df0bdc24095060a846ff8a26ef146bd8a044d84155fe9c532f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784042205, "uuid": "0a5f8206-61cf-4399-8d6e-4e2d8a8a5b71", "comment": "Malware payload (Moobot)", "value": "1b99ba1da2a67f10d3a5fd19fe324c1fd34ea8c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784042205, "uuid": "388b0893-0042-4fef-8dc3-d207b6386e76", "comment": "Malware payload (Moobot)", "value": "310c4dd42eb6b669e20058f5fc10288a595f5433ecce65da88f34215e4147d5328e50a102c337ac4f371449d9275465a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784042205, "uuid": "314f5f9f-6820-44c2-af77-1920e46a184a", "value": "T149832A46FD829E11C9C4077BFE1E118D33136798D3DE72229D24AF21B7CA66B0A7B461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784042205, "uuid": "135eb598-f391-4a53-975b-386f157889b2", "value": "1536:4Nnm8nrzWDTiArrDnqdqcCV+oM9cGUaK2PfyM5ijCIzDOjzz5RYLTHwbZnZ:x8n3WDTiArrGdqciMEa6CIzDOjzzTmwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784042205, "uuid": "90f58faf-7af7-40c6-9932-f11fa9dbebc6", "value": 81036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784042205, "uuid": "e0c23a6f-4f42-4292-8c74-9d760255daad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784042205, "uuid": "56a45b8f-2d31-4735-b65b-4db3c2c66dff", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1296ee9-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784012480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012480, "uuid": "dd9a19ff-a088-4f5a-90bd-3b6a1dd249f7", "comment": "Malware payload (AgentTesla)", "value": "1468a59541240d7505b6e4a9a78bbd21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012480, "uuid": "26fb414f-6e7f-4f7d-b62b-096d5e802760", "comment": "Malware payload (AgentTesla)", "value": "0af6c7464d79f2c1ff202792d0c17a2c5af4920525eb4316034d6598da566084", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012480, "uuid": "fddee8f7-5406-4a11-be5b-e29b5e7077dd", "comment": "Malware payload (AgentTesla)", "value": "8a118bd5556248342d726b36dbb106930054b7dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012480, "uuid": "7deffe59-a3f9-46df-b05f-8a2a9815056d", "comment": "Malware payload (AgentTesla)", "value": "fcaeac309c9cbf42d90d5a85ff32cf14cce8cfc31eb51266f935ac2c6d65a75ff0fff62ce784e83a13f9c8d914f6f36b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012480, "uuid": "24919c80-b259-4bef-9e4f-50c32dbe2c39", "value": "T1DB612AB4D46A7401E961DBB98BFAD6B0B81A62443371F1876985E39A81731C0D772E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012480, "uuid": "b73c5fe2-33c3-4022-a2d2-cb3f7d56cf6e", "value": "96:n+FZy84WZXxL8+BIZXf8bCxn6tLrS0p7W6LPkBf:nIy8VBg+BIZXf8Kn6s0RfPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012480, "uuid": "74a96914-0414-4d62-b0fc-07fcff0487e3", "value": 3339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012480, "uuid": "bf56acb5-eb06-431d-a427-d72456091680", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012480, "uuid": "dbafdbed-d2d1-476d-b70d-d84017c5540c", "value": "Elenco prodotti, codici HS e EUR1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30335ee8-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "ec78ef77-c3b1-4fb6-9ddf-e96efd42a437", "comment": "Malware payload (ConnectWise)", "value": "f12bb455c44905d39301d85baae785ef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "63a093cd-b465-438e-8a3f-9a38707e7136", "comment": "Malware payload (ConnectWise)", "value": "0b3a0e6bf514f9baecd9f26cdbeb74afc455666d0d41db4b8673f7a98cd855cf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "ccf28da9-47a3-4877-9cfc-b4d0c07d6bdd", "comment": "Malware payload (ConnectWise)", "value": "dcab0b70a530de49ade1fa12c5f91e22bb69bb3b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "1c948d9c-c7ad-4964-b91f-33c4935418e3", "comment": "Malware payload (ConnectWise)", "value": "85429be92c694c790066a12c32245cc630aba7e6cdadd929ff0b6fcdbdfef66f4768a99dfee4d5f5dbf9309738c321e6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "e9f19117-ee0b-4e76-b001-b2706c08b09f", "value": "T1AE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "36bda7f9-bf0a-4bd5-a48b-45d7b2e2d6c5", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "2c132878-5074-4bc6-966f-95ddb75c0378", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046570, "uuid": "56eb20de-12d3-42a2-8dd1-02d53331c1a1", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046570, "uuid": "2a140f12-f2f6-4b0f-a111-2860c334e32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "60bf39ad-c655-4624-aa5e-25865038b6e1", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7878c26-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784015443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015443, "uuid": "d8330cc4-b7a7-46d7-b0af-a70ec45de50d", "comment": "Malware payload (Formbook)", "value": "ddc8b61db5c6f4d7ab83170cc74f4d03", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015443, "uuid": "990aa1b7-5cad-451d-9a06-3f409ea04600", "comment": "Malware payload (Formbook)", "value": "0bb875dcb216560f3a1d0b8034d290c10e7c15a25a7d5a805152cd3784b9e7b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015443, "uuid": "4fb1c682-2d23-4ffc-bf6b-7a0f5089893f", "comment": "Malware payload (Formbook)", "value": "b4ac046cec50082f68dec7b5a3e5af51710331a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015443, "uuid": "0e31455d-e689-4ad7-92f7-e021cb024015", "comment": "Malware payload (Formbook)", "value": "2f90a1b2a3c12965898c8b0252e28ca8d12bcbc0532c66533f516c59d9080b85b366a8f86b3b402dd623e75426c75f74", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015443, "uuid": "67b5819a-c496-4e4c-9b6f-eadd7643ab44", "value": "T1A804127D692517E3D1FD543DEB8D0A32341810961265368F1680736382BFA63A39EBEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015443, "uuid": "09a21f60-583e-4dc5-8f76-a377db323047", "value": "3072:Msjl1Ruh7z9CCfzVHJtFtaduBlvLfYmd8ur1Vp09c6R54bkZu67nO4h83Lw4PHcg:tjzsH9vfzVbxb98U1R65Qp7V7blUDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015443, "uuid": "e84cbb73-db2a-48af-ac11-f92ecd5c73e5", "value": 176403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015443, "uuid": "074f7530-b267-44cd-97e4-bcfb30409265", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015443, "uuid": "8da99420-b421-4bda-be99-26fd9830ab62", "value": "NEW ORDER SPECS JU142026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2e88c4-7f9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784043691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043691, "uuid": "facb7581-8216-4a26-a823-d86c2c66b84f", "comment": "Malware payload (LxBaseRAT)", "value": "7691e1cd95a852916c652efc0f002f71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043691, "uuid": "0ece5091-3f7b-486f-aa1f-4943bcda5abf", "comment": "Malware payload (LxBaseRAT)", "value": "0bef1f58295a8d704c4f0ab7d3f8a3c6b9af49ed2cb28066327754080e202b26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043691, "uuid": "0d88eea3-e208-4796-85c0-88a6bafb5ff1", "comment": "Malware payload (LxBaseRAT)", "value": "c29318b16a85f33bef3d50c6a0a0dab39279ba64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043691, "uuid": "c5c8b8a1-2527-4bb3-83f2-4f264c4371bd", "comment": "Malware payload (LxBaseRAT)", "value": "9e32c49cb3da1a82448ef2fe8524cd728f0cad2002918c34d9475ef526762467a1dac1cfc694448cc0e3cd6fbbae10bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043691, "uuid": "5fd9ff0f-5039-46c6-ba0c-6cc9d6b36362", "value": "T19C457C50089F6035B7EC9D03CBCBFFFD83FA83A462992ED5086813915B6D944F256C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043691, "uuid": "b7c0bbad-517a-4d85-aeed-0f96922cab27", "value": "24576:7zAetY3HkGdqqZ8J+/Rye1TJIVgbM6HiYFXPAcUUWdb9t2cKz7bqyV8o8:7ntY3BHZ4+5ye1TO+bMJUocUUWdptby0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784043691, "uuid": "78db7d4b-f1e8-4466-8f88-3f304bd8fe42", "value": 1275320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784043691, "uuid": "fd3bf8cb-3354-4369-949d-dde4a83cdae7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043691, "uuid": "a9b5bcfc-acd9-49e0-a05d-8232899f3eb0", "value": "Quotation Request \u2013 Purchase Order.Malaysia-Airports..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b0ed3c-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012326, "uuid": "c2e04bc1-3a92-49f2-9096-69edacb70ff3", "comment": "Malware payload (Mirai)", "value": "e444ba233ad6403932868427fc3011de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012326, "uuid": "74feb60e-7e83-4c8b-bafa-1e87fda5b12e", "comment": "Malware payload (Mirai)", "value": "0c3fd81c8852f5aff78b7c83a02dc434aa69b49d68cf86c85f93d34623f5a2c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012326, "uuid": "f078bc7e-31b4-4777-978c-1de696a8456a", "comment": "Malware payload (Mirai)", "value": "9f8b6fe505ec055f162ade9a5b76bd0eef12049a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012326, "uuid": "e0b68940-fa85-4c16-a878-1259ca98063d", "comment": "Malware payload (Mirai)", "value": "a0d9a14057cbb445c998eadf6bf7db106ae2540eaf5e6eaf81c52da21906e859383d529facaf78a76b8e10b9e868629e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012326, "uuid": "53a1e2a3-ddea-48d2-afb0-2398498ddba3", "value": "T10CB3950DAFB06EBBECABCC3749E92B41288C991721693F75B534D528B50E24F25D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012326, "uuid": "4cfa8af2-56f3-4a95-adee-d11c53412730", "value": "1536:l8JCbvJ0QKzqQLFpGMmGu7TJcAAKEUjgYHmA+uIZY9kfSV/xSOZ:2JavoLLFpGPeS+uI0ZxSOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012326, "uuid": "ab8f9f55-b7d8-42ea-aa24-60baa58b7d5c", "value": 117804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012326, "uuid": "a6af75d4-c6dc-4e2f-8878-83b384129dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012326, "uuid": "8c137218-e4c6-4948-afe3-4726dd8f6f5e", "value": "zombie.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38e6b04-7fdc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784072157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072157, "uuid": "9fe32560-9c51-4bf3-a7e9-23d9b27f6bf8", "comment": "Malware payload", "value": "0db115d00cf971f4126aea2d07d8d042", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072157, "uuid": "eb4f13cd-15ff-46aa-8fb0-c65bc768a885", "comment": "Malware payload", "value": "0cba96220bd33958a47a7f09d656594ce73c83b79801a873a3ba397ba747c925", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072157, "uuid": "d1736d26-eb5b-4908-a2bf-5fbc144f86e7", "comment": "Malware payload", "value": "156e8aed3e76be1d9d9bb9475f1de648dd9f4d49", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072157, "uuid": "68f41e45-f45b-492d-97f4-3e4ed8d22dac", "comment": "Malware payload", "value": "8f8bf103759f8a984f24a9417d3ccee946f374bbe0beca0d78fd2e59ed39e361ddbdadf6252a29694bf269cbf5b37f62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072157, "uuid": "4876860f-3d53-4dcf-af7d-de9519ed3c4f", "value": "T10D137D695A953C249E8989371D7E2F0CB9AA83E5300851DDBFCB3CF68C45ADCE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072157, "uuid": "a97d5486-f8f5-4feb-b63a-1a555a991ec8", "value": "768:w+VEJVIhtMt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:wcEJ2Mucy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784072157, "uuid": "1676a709-fe4d-4970-931a-655fdfc3cb25", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784072157, "uuid": "8824a278-836d-45d2-9095-165b9e1f083f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072157, "uuid": "01727001-69e0-482c-8186-fa5dc40bedcb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1babf6b-7f7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784030922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030922, "uuid": "421f335f-b969-435b-9d5c-5917fd5b7b56", "comment": "Malware payload", "value": "655bad287b660ea6436db409879bfbb4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030922, "uuid": "b3907c3f-30c1-4124-914d-5348f9e1b1a0", "comment": "Malware payload", "value": "0cf8a80d8fce578f57d4e2db4f1c9f4fadf9a9a6e548515a370f0cf589cbb3cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030922, "uuid": "1747ba3e-75ba-4cdd-9e18-460f54d27aca", "comment": "Malware payload", "value": "505f84b965e93b55c7b94786a42c21e1d4c8c2fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030922, "uuid": "00fb32ad-702c-47f5-aaac-2278af7661bb", "comment": "Malware payload", "value": "e7e20f5ec742552f0d6e06759cc0db0f1bde56d42d013766b4cece10cadd114538d6c33888e3f7542c943b8c2ca7df13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030922, "uuid": "829bc7ba-46de-4462-a549-235885ed8f53", "value": "T107D203F1F8EC9831369D453A7B9DA805A9DF7C2F4DA77D2014235A38421CB0EA119B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030922, "uuid": "152d1750-8618-4aa8-825c-1d6b5ffb7cab", "value": "384:jV9YiRIipud3s1OiViuu7isjsKG6q/A4UADAZdhQuW57:EiRIipQsOiViulUMdUAkz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030922, "uuid": "1cf2809e-e77d-4cf4-a204-3e68a4b328fc", "value": 29532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030922, "uuid": "019a3f43-c8fd-4910-b18e-ccb99976c513", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030922, "uuid": "b01c3494-3f49-4bac-97fb-c2be6e677d9e", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9856536d-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011955, "uuid": "a6f1214a-d090-4b6b-a5ef-4f01cb938033", "comment": "Malware payload (Mirai)", "value": "3d72e10f3b87bd1a11f324f5b464fc36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011955, "uuid": "11807306-1b05-4afb-b0b8-687234ae8cd0", "comment": "Malware payload (Mirai)", "value": "0d65afb919f1dde789e90e39e15f25f1c5d763af79abb28a421e44425114b89a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011955, "uuid": "28179fb9-9eef-4da7-8d73-0af29654c6eb", "comment": "Malware payload (Mirai)", "value": "c64546bb0d7a14a23dc3885392ee0f5dc82170a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011955, "uuid": "da1f9887-a62f-470b-b237-13e0300bb777", "comment": "Malware payload (Mirai)", "value": "986a85e8fbe237e24854591601119916c14b2f02311a6442efcfa1535db8e38424910fd9bcf8b5e35afdf0534137a010", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011955, "uuid": "6a71bd82-2a34-48e3-86d6-cab787f1da89", "value": "T137B36B73C8266F58D669D1B4B0718FB86B63A91182871FBE19A7C2B54443DCCF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011955, "uuid": "82330f9e-4d34-4d92-805b-1af98f5a4654", "value": "1536:BEbch/VHuyEZ8GWBj0JlC4SkK1zpdigSza92+MWJiEUrTpny:BEbwtHuHWFGlJSL1vS2vMWgEUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011955, "uuid": "e5a430a1-fdc8-4dfe-9f27-39c563a434c6", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011955, "uuid": "bbf89f4b-4853-4de5-9df4-f17867a303f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011955, "uuid": "2675eb1a-bafa-4e06-8a9f-037361eafda7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132b1aee-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022040, "uuid": "1d67e9fd-4e54-494d-8cde-9b4b90c99234", "comment": "Malware payload (AgentTesla)", "value": "89a42088178e5c5778bcef4b02930b14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022040, "uuid": "0ff08932-f3bb-479d-a300-4b296e3808b9", "comment": "Malware payload (AgentTesla)", "value": "0de09d55351a5e10c4f51dd12b0edb385eb56da86d54d80276915116a0c847ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022040, "uuid": "bb09f41c-c08e-468c-9767-f909d844a75b", "comment": "Malware payload (AgentTesla)", "value": "2b150301ee3c2b37c551fefb4bf2a291db3660ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022040, "uuid": "9fc3a0c8-ed56-4bbb-bd52-3e5f7c10d493", "comment": "Malware payload (AgentTesla)", "value": "ea45f510fc67a26b745e1029e7d55a00d4218ae53ee47b2a30bc13120cc64f613f935682e6400e7b8c2d5da3caeb5c8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022040, "uuid": "1ebed085-fd8a-4da2-96b6-a211c4a4954a", "value": "T1563400027F88EB15E1A97E3782EF2C2453B2B4C71633C60BAF49AF5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022040, "uuid": "90ee0db4-97a1-4fbb-b885-20cabf0a3d43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022040, "uuid": "4a781bc6-b1e9-4ff1-b3fa-59c19c8d83e5", "value": "3072:kYxZ6iyqa9PRn6sO+4YUTHo9rG8KaG5jnThpqcufzz:Z6iyqahhX+sq8KaWTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022040, "uuid": "e9d3bb93-31aa-45c1-904c-285f3c298465", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022040, "uuid": "ff9691ff-7bcb-464c-9229-4d529212e54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022040, "uuid": "a7caaa9f-a6e2-42db-831b-cce86a9847f7", "value": "0de09d55351a5e10c4f51dd12b0edb385eb56da86d54d80276915116a0c847ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703c81cf-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784012317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012317, "uuid": "acb537a7-abfb-4f62-afca-ec6a99b52ed0", "comment": "Malware payload", "value": "887cdae9919d9af177e5da941baae236", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012317, "uuid": "efdde18a-fe8d-4309-98c7-0efe5a697c0c", "comment": "Malware payload", "value": "0e02e5301f19c3126d5e0fa2b52ea72547762aaf3cdc93f7b9c52863853918c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012317, "uuid": "21b3c763-7ef5-405d-8ed0-dcadc5c74298", "comment": "Malware payload", "value": "8cfe8ca218e67b72c9108a5533b4b5e22560082c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012317, "uuid": "1b0844ec-1a36-4845-9dea-ca19c3a3ae65", "comment": "Malware payload", "value": "eb77b097fea3157fddfc8b6524fcfdb9f6a569a15e51f7906abded977d0443c38a650b0432ce717c944f536c7260e914", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012317, "uuid": "5e59e26e-71a7-4eee-a3fc-7b74a0a1bfeb", "value": "T12302F703EBEC0176D4B3473EB5E377105331F764AA67835FAA98950FAE8379116632A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012317, "uuid": "b7f7a0a1-aa39-45db-bdc5-ef9b50319934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012317, "uuid": "a3d7c7d6-50e7-4256-a457-b366a40fd05d", "value": "192:b8LwrF+8s9E/A3Yk2feUxIGDI6/8EmgCC38cV:b9s8ehgfeuIL6/d7CC38c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012317, "uuid": "bb9786b3-eb5d-483b-a54f-4a31a30c5c91", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012317, "uuid": "b88beea2-cc21-4100-acc3-d160a324c0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012317, "uuid": "8713398e-8981-461a-b968-d35f7cdca6c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76abfbee-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023924, "uuid": "472e4e11-ae24-438e-b953-c10085c44066", "comment": "Malware payload (PhantomStealer)", "value": "cedd6ec94252a60fb3a1cef9d41ee315", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023924, "uuid": "c1ccdaa1-4193-4ee0-8b8c-440cefdee462", "comment": "Malware payload (PhantomStealer)", "value": "0e23c87ec9f79d88430c5ced864ee42a01c667061ceb30800012babdd781f83f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023924, "uuid": "c52c5f47-fb4f-4852-baa3-a1c96cf04ab6", "comment": "Malware payload (PhantomStealer)", "value": "feb4e9a7f1a2babedf85cf0453e5184d5db284b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023924, "uuid": "a9302f28-fc7e-4690-a655-e021bfdecb13", "comment": "Malware payload (PhantomStealer)", "value": "45612d5492ce4651953d7791b4650fa539ee18b63eaf164fe7138762f2bcc2a8fb92b208dd3ef4a23e83fc6fe166be86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023924, "uuid": "d571cd4a-4609-4105-a1b4-6b4089e6be1f", "value": "T16F26F1105F882FBFCAAC1A09D07E1A1EB3E1478550A7BCCAEF737D495FAA70051271A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023924, "uuid": "36204cf7-6801-4cdd-84da-bcb234311071", "value": "49152:okpfXPAyMeSxeQuunG/yS3DXrKIbPMuD8R4ZWLLBhZN2+Xsjf:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023924, "uuid": "395ef4ea-c47c-4402-8e1a-0504f3fda8ee", "value": 4817662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023924, "uuid": "dff07fdc-2181-4884-85ca-7c1c73394a8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023924, "uuid": "21ec0c05-12af-4913-817c-7a79c7e2cdbd", "value": "PO 351544.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1bad8b-7f32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1783998944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998944, "uuid": "11cd545f-74fb-4baa-a72f-0b7854a90e8b", "comment": "Malware payload (DarkTortilla)", "value": "d245eadb186f026bc1bc70fd0e2273ac", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998944, "uuid": "f5615dd2-4c31-48ea-83e6-3719a2815691", "comment": "Malware payload (DarkTortilla)", "value": "0e4e0247476003c3efef81eba6fdc6c98876d15ae4fd81994a2a58c598c2011d", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998944, "uuid": "ecf591ef-86f9-47d4-8dae-1ec0fbcf0898", "comment": "Malware payload (DarkTortilla)", "value": "c3c5f2b383a4b4a6ee335a3b5bb9de182cb3cc82", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998944, "uuid": "758321f4-0b2b-4351-9619-2bc97af34c59", "comment": "Malware payload (DarkTortilla)", "value": "c7ac55c7e4b56f3925c9b62d767e7ff9c86d32cd20b510ab253f5cb7f2b6b5c87c9008f6d044b070f7352c933fc1f5b9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998944, "uuid": "7d211593-86dc-431f-80b5-2167698ba0e4", "value": "T14F45E12549466536DB3D0A74C2D6749C13F0FDF39292E71A2EE870FCDB727A4A9D2082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998944, "uuid": "c88c8675-bd3a-4769-9f47-872056d51648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998944, "uuid": "74cab3ef-1745-488f-9733-a4f3409ccbef", "value": "12288:qi2amT2CPpHAP/iGc1ZOM+FhWF2hekxpp4y98G1R12Vg5CkCThajRxBV:G/2UxAPqGcv/+Duyx4K0kYa9xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783998944, "uuid": "6f65299c-38c0-418f-9cd3-9a020b985925", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783998944, "uuid": "1804fbbc-d9fb-4b68-820d-305c0d85c0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998944, "uuid": "097d6c35-c61e-4528-9c59-396463dd0a72", "value": "MV.CORNELIA.M_VESSEL_INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7162c5-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784012497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012497, "uuid": "6a7a339f-2187-4fe0-b3a1-af0e9b8e2b41", "comment": "Malware payload (AgentTesla)", "value": "91a4db6486ceeb4e2f48d3aa684be0b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012497, "uuid": "9fcc70f8-f9c6-42ab-b904-2521f337ee2e", "comment": "Malware payload (AgentTesla)", "value": "0eaf5839296cac7542202494914072b08123ffffe145f3522ca607712e90e42f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012497, "uuid": "f7171def-1b8a-4d9c-a7fe-00f4d8386474", "comment": "Malware payload (AgentTesla)", "value": "2079fed1f05a7caef9ccacaa545ad84004ab8ebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012497, "uuid": "09227bd4-47d8-4b0b-b25e-7488a645d7fe", "comment": "Malware payload (AgentTesla)", "value": "9739f587b842e016b5568034707c754c3adc8acca5c16b43b732eefaa2f228366cfc210717097a5979610d74cfc411b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012497, "uuid": "08c8284d-c2cb-4e3d-8c59-d8842cb96dfe", "value": "T16B613BB9D46A7442E961CBF98BFAD6B0B81A62403370F1876D85E39A81731C0D7B2E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012497, "uuid": "fb0953c5-6073-4523-978e-f75e1eb19cad", "value": "96:nFZy84WZXxL8+BIZXf8bCxn6tLrS0p7W6LPkBf:Dy8VBg+BIZXf8Kn6s0RfPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012497, "uuid": "50085b11-f011-4fdc-9367-0e6e3638645c", "value": 3338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012497, "uuid": "481e6f15-92e8-4bba-86eb-da3f3dbe0580", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012497, "uuid": "465fbe07-39fb-48a0-bbf1-af9769fcbd94", "value": "0eaf5839296cac7542202494914072b08123ffffe145f3522ca607712e90e42f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e977771-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039722, "uuid": "99297b38-5192-4c75-9ba8-be959ae57dfa", "comment": "Malware payload (SilentNet)", "value": "47d822982b613ffeeb50837a77a3f68d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039722, "uuid": "63c097db-774a-4dbb-ad07-b6b7f5b140c5", "comment": "Malware payload (SilentNet)", "value": "101d975cb3b62e05e41f3b2ed57cf1e299dd230654e7a94610875181f1651950", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039722, "uuid": "c3613bee-4121-4377-ba2f-f83e8347ddb6", "comment": "Malware payload (SilentNet)", "value": "1519a72311e51ccfa07a6db3c1614921dc7719f1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039722, "uuid": "7db3b571-d1ed-4400-810a-b73dc399121c", "comment": "Malware payload (SilentNet)", "value": "df20d459357ead67f0ca761377882a6aa635f113046f773bed87ba0e84ea02f3858d42cabded9e02469f1b09c326cb74", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039722, "uuid": "5c3e63c9-e82e-4129-8028-e339eb5eca93", "value": "T13F8302E2A1C8F66BF53886B521C1BA0B4F245F75DA0497EF05204DEE105BBCF9385A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039722, "uuid": "cb2f256d-856d-450f-935e-908075b961d2", "value": "1536:Z+XnTBwKo3JhyW9UycYRG0A9jGFunkNtux4PHPfVuIAt9pBfAPXZp/dIbrtrPSGf:QXiKo3NuTjxkNtY4PnVuIG9ABp/dIbrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039722, "uuid": "99d813be-60f4-4caa-bed5-7c585924dee3", "value": 87124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039722, "uuid": "a3c19ae0-9bf5-4f04-876b-78eeaf43cb0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039722, "uuid": "f98f5f45-29ef-40d4-809a-38ce4e34a91b", "value": "AnaNopushjar.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d52b208-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023506, "uuid": "0a92a0e8-7f9c-42f1-b735-54f5205c9d5b", "comment": "Malware payload", "value": "82d71e57d4ab5718bf86e94a3eeb6c44", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023506, "uuid": "9c2ff312-dd3e-4d84-a16b-c30c3978374c", "comment": "Malware payload", "value": "10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023506, "uuid": "2f36ad19-16ba-453b-8577-05066baca7f3", "comment": "Malware payload", "value": "606dc101ab4646967cf42a10a6c0cb65383d705a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023506, "uuid": "22c53479-4816-4f14-8785-c612c8d9aa71", "comment": "Malware payload", "value": "9a52218e740f8b89bf493f75735976059a59a7658779c89fa1b92775230366b22b62a52d2f8bea58cd27bf75dfbd8866", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023506, "uuid": "3b7576f2-e450-4e60-899b-a95bd3fa9145", "value": "T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023506, "uuid": "3d9a82f9-7e54-4700-b803-44d2505ebbf7", "value": "48:QZ4VNYsZsfdrezyaHNqoFKq6wW49d/l0QvgDcGjd/gSFQd/mCrPb1N1DJvJiom16:QiVWsZsfdAfcgxY7EfFnioHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023506, "uuid": "197acdb7-da50-4372-bd8b-b6a1585a990f", "value": 3536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023506, "uuid": "a212856f-3f30-4e3f-883d-4a2a92c00ad7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023506, "uuid": "8d9c9070-010b-49a5-a1a4-8bae46cb5a95", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f38dd5-7f4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784011206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011206, "uuid": "263efd2a-1f83-40e4-92be-4088bcfc2b32", "comment": "Malware payload (Vidar)", "value": "87700720a8a003a7d6e6da15958e4664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011206, "uuid": "592da236-3fef-438a-af6e-c72a6932a4c9", "comment": "Malware payload (Vidar)", "value": "1105c195ea9bf21dcfc8882b1c3887d5056bece5b96170e0ad349cd82a3203a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011206, "uuid": "9f1b9aa9-9cef-47ce-be45-6f2109fe29e9", "comment": "Malware payload (Vidar)", "value": "e256b2b7d0235138cea6b818f9bb44d7cfb5e4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011206, "uuid": "253e6f80-a904-4486-97fa-c9134030b53a", "comment": "Malware payload (Vidar)", "value": "c47b4e91c4fb2e445a3210f9815326d570c9ad9b6a3480a075aab7fa843131c98dd02385fbef2b3440c409a924a769e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011206, "uuid": "c9d4aafe-ad6a-441f-be22-a0e14f184a3a", "value": "T105E58D4B7CD149F8C46A677288B662923B35BC090F3A27D32E50B7782E76BD05C36B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011206, "uuid": "e4bbe559-7295-4215-ac12-a74f273cee61", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011206, "uuid": "220dbcbf-062e-488d-946c-9aa36f6dc091", "value": "49152:Mfo9n0F3ijuYTI9YBdQVaQv5fot8vKiwILJswv/38NzLI4x:Mf4ir9K8xponwR38NzL/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011206, "uuid": "34f25184-48f7-4d03-827f-6861a979033a", "value": 3090856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011206, "uuid": "49075243-487b-47cb-b508-4f783e795266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011206, "uuid": "df945a6e-12ec-41ad-957d-0a3285026328", "value": "156d287e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dd1199-7f54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784013716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013716, "uuid": "44ab2b7e-bd2e-4a08-bcc9-5625baba56d9", "comment": "Malware payload (Mirai)", "value": "9cc14e5273b272cbb69acc542b255248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013716, "uuid": "77acf5e9-401b-40b7-b78b-f21c38d4cc61", "comment": "Malware payload (Mirai)", "value": "112810a3395df487b7e2d2b27f88366c5889fecf726a1eae9042ead1bab561ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013716, "uuid": "7ae860a2-0563-4953-a4be-c74568e938c7", "comment": "Malware payload (Mirai)", "value": "47fb7d31037a42b83621ea09f74e1f007ee90fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013716, "uuid": "abf0771b-b4e0-43f5-bd8c-55460a667e61", "comment": "Malware payload (Mirai)", "value": "ff3143d545d314abc33b7dfb6d9ffac46993697bfdc8d6f646c9543c0a715876e72bd85d8daff1724d65ac8d31bfbfcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013716, "uuid": "13668542-5f93-44a2-8c9e-1e431ed32881", "value": "T136D3068AF8819F21C4D616BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013716, "uuid": "0844f669-cd72-4a2c-92de-173120e15398", "value": "3072:CFrOW08E1uGqI4w6A3I8c96TC/fZJvxayKaLaOru5QVr60KJeKqMn+Wq:CFrOEKxqdw3I8tTCZJxayKaLaOrCQFKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013716, "uuid": "3cb414a3-903f-42b9-baf5-f29fb0df750b", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013716, "uuid": "bd4bc61d-235a-4207-a459-051648450155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013716, "uuid": "479ad0cc-a202-40d2-b677-5dd412da6c05", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3537248b-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "f12ad4ed-b1ad-4304-b9d7-538b136fbc07", "comment": "Malware payload (Mirai)", "value": "9f1c4f198aad9195f1350e91fb4002a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "e3dd965e-f93d-40b3-91fe-1543721c03a1", "comment": "Malware payload (Mirai)", "value": "117875829e25382b7bacbf3455ad2560496daebb23b038bf18acca2980ad86d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "580949dd-866a-4e8e-9e22-266073c6c746", "comment": "Malware payload (Mirai)", "value": "dd4cf30861267db963153db0bf0c0f2f0e6a8d7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "0bdd6fb6-3ad8-46d8-920c-6b503b508dec", "comment": "Malware payload (Mirai)", "value": "67124ef3ce9c71f57f241f82a12f8b5efcd3a18a51162efde46e543b983346520cdb7cb6564558d78d6f13aa189e016b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "459de04d-6437-4c6c-b370-6e053fc16ec2", "value": "T1F9E30917A3358F69F382D17146E38B9516D850D21BC4855FE07CFB582AC1A4A3C2BFEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "e8ebfae7-7957-4263-9e30-da59806abc0a", "value": "1536:98UX/uJpObR62/a7vqUofDFArUcuK+jOloilyEKHQgPmiJjYJDR5xfo/I6Mp20xj:9B+pR2y7qJEeOLo+sCx+IJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011359, "uuid": "733b5a77-d2d3-4e3e-9a25-e40d467529e4", "value": 147864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011359, "uuid": "857fbdf6-46c2-4678-9bee-34503c52bf15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "542ee0bc-e32b-4e67-be4a-803826af5c0c", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3475fa-7fab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784050965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050965, "uuid": "8da6e41a-e0c2-4716-a09f-1abc79ffdb7e", "comment": "Malware payload (Mirai)", "value": "90533ccffae94164e20a832a6fed4328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050965, "uuid": "27e0ea80-2f32-4a0d-b790-4feec4fd8e0f", "comment": "Malware payload (Mirai)", "value": "12d5387555e9e98571857a89b40cc370dbba56094c317ee6cf4f2e450153a4b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050965, "uuid": "f17f3d47-b383-4f59-ada9-32aa95d959e5", "comment": "Malware payload (Mirai)", "value": "16e4b8e6217d877dc8e228ec594c4dd1bd198e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050965, "uuid": "6bacfbb7-dc54-4e1d-b3c2-aac3b2ddd141", "comment": "Malware payload (Mirai)", "value": "cae3fa0ce87853097a244aedda0412334b3d4b1edcf40d50a3452077419cf18f4d132be1240a1c35fb42b5d9c14c5738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050965, "uuid": "2db5ee9f-baa3-47da-a719-bc4c4eea008a", "value": "T11BD38F5C9D1E7DC2C2C2F2FEAD450F66312675744A64C3F6290062CEEB9EED698B1432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050965, "uuid": "4c014bed-1e33-46b7-8f6e-c14f973d64a6", "value": "3072:DRqDBIEXmV0nStB/NPdzUT2oBXdBYjz8bDCKhR2JP:DsqC457dzUTnB3Ycb2K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784050965, "uuid": "2081db32-d3db-412f-93fa-9df2aaa03bc4", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784050965, "uuid": "e1914138-ab33-40b9-9fa3-66b262ad7d74", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050965, "uuid": "bef6d669-9eb6-45bd-8ed7-c1b83a744775", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63bdc05-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784024031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024031, "uuid": "68223c28-499e-4882-8f1a-08b8a29e9cd6", "comment": "Malware payload (PhantomStealer)", "value": "e8b0a12fc2241c24227571a5265d40cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024031, "uuid": "c4a68044-a5c9-46fa-a5d7-bacd83eb5928", "comment": "Malware payload (PhantomStealer)", "value": "131e5a9bdeea0a91fb744d30aef33159f1cb7882d113500a26d61a79027d49df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024031, "uuid": "f23cb813-986b-4cf5-a3ff-3770c31e9cf3", "comment": "Malware payload (PhantomStealer)", "value": "b650ea99883b358124fd28725e52598f04243916", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024031, "uuid": "8583f9cd-d184-4a1f-b9d8-45079ec60a7d", "comment": "Malware payload (PhantomStealer)", "value": "90b419985b72befba991c72bddce6e37165266a962ddf7148c532e8807dff6c0f8850bc1b799a060d60ac27b4bd51743", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024031, "uuid": "d3f3c39b-e98a-463e-bf3d-0015cec12746", "value": "T185064B1287286471B62ED32CE136AF68458E2007219DDF5D34BE0764FB56F47A78CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024031, "uuid": "bc56444d-6ca2-4468-a9e5-eb708b69224d", "value": "98304:6dYYxa7FpnfQhYSnSuNLn674a9tN6XQBxp5evKiJc2A5AjOM4zT:DLPfQ+SnSuN+f6XmXf51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024031, "uuid": "e25de365-4cc5-4685-8888-e109b7e23dc7", "value": 4017446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024031, "uuid": "c1f4ca93-d558-4736-895a-b6ef7191020a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024031, "uuid": "fa88d9d9-42cf-4e69-9af2-680d30351938", "value": "062G002289.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d42c2d-7f71-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026223, "uuid": "55e369ee-8eb3-4f46-8394-608eca46ee52", "comment": "Malware payload", "value": "5935adcaa4c1e28baae09f81e3aebc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026223, "uuid": "86d4e1e2-01b8-4233-b6f2-e0c2faa14e44", "comment": "Malware payload", "value": "132eb8f87d1f5e0922a3078af71e9be5ec844571fa07e1314d20daf7aaa3f575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026223, "uuid": "f4b50964-5c61-4498-9cd8-1d3e9017c848", "comment": "Malware payload", "value": "5b876d3624d3000b9284c1b1e68675c821adbc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026223, "uuid": "c03143f7-4ab5-4ca1-878b-447097daa16e", "comment": "Malware payload", "value": "60d45dbba6ee718688c2f253cd91ae40f6042e6c49e8f565cd96d69390750db650da9e24be7d7b645508fa219abd2eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026223, "uuid": "ceb5b722-7922-49ce-995f-d307424ecea8", "value": "T17A1833E0427D919BD03D99F20F98CCFA510ADAD0CDA926CF897A8171A3EFD174F58261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026223, "uuid": "4e278a45-ebda-4706-ad42-7737c799c7ab", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026223, "uuid": "c6277f38-c4e2-4c16-80be-ddf20f193bfa", "value": "1572864:z5TRwWndgBFt6ihVdehY/FRF8oKylidlWASR4hB+apolCz0YTx/f/zTx/f/NJB:zfwWndwt6iP8hY/LepyYyAic8ezjTx/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026223, "uuid": "8f30b080-e5cc-4d5e-bb01-0197893bcdd6", "value": 89991960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026223, "uuid": "cc0ee349-6889-4e37-b5b9-caad22426994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026223, "uuid": "1c85505e-7b31-43d6-bf7c-8a5e9f12f539", "value": "132eb8f87d1f5e0922a3078af71e9be5ec844571fa07e1314d20daf7aaa3f575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4dd0b9-7f85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034646, "uuid": "175a0a49-03ba-471d-bec9-1d0c7057a957", "comment": "Malware payload (Mirai)", "value": "2fad04d855dce767592913df8753dbc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034646, "uuid": "c624cf3c-cac5-47af-92b7-7d3f2a420885", "comment": "Malware payload (Mirai)", "value": "138784355a25125fe47f5b002a9405d81f380a20766c02756be9569fdd837fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034646, "uuid": "1a4ac337-ded0-443a-9f73-c60b3dce75ba", "comment": "Malware payload (Mirai)", "value": "879310f896d371ea887582fc3110da34e676a9a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034646, "uuid": "eb386d61-aa66-4941-9c38-4c3a2d365162", "comment": "Malware payload (Mirai)", "value": "0c3f900eb1391c23b755e0e2408c25328bd13a1d9576c8974a18171ab56b44f04e7609a1139843f7702cb548d128cf07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034646, "uuid": "b265675c-5c09-4ee9-b681-a20b7c2ef5b0", "value": "T15863B74A6E318FEEF26CC73047B74A31A35867D623E1D685E2ACC1041F7124D586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034646, "uuid": "95e5db51-60be-4264-9989-c87e591e1415", "value": "768:QQTykb82emn7s7hUqpzKVLRiyUIMMjFw78yATAeRgFchtZ1awQ7/RxIDoi:QQTy3+ngNUskLRUIBGeRgOQwQ7/Rxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034646, "uuid": "ec5626e4-a179-4c8e-94d1-8e4e4208c593", "value": 68428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034646, "uuid": "c5e77808-67fc-41ba-842a-30a5ea1d6af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034646, "uuid": "660afdd4-ae43-41ea-b9de-951bd3fc9fa8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ded2b8-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "652ba952-cccd-4a52-9526-7c85f3e959ab", "comment": "Malware payload (Mirai)", "value": "e1ffcd22183f24c2142a06cf84370346", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "8cdfeaed-c0b4-4357-a341-0c5e4ffb4d6e", "comment": "Malware payload (Mirai)", "value": "138e2c112cb24bbac575c0ba2d93f3fb424df5d75fa0efca5fac71dd4f3e7422", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "6d917d11-b6eb-4711-b70f-ccfb82e3b041", "comment": "Malware payload (Mirai)", "value": "755ccaecba142cedae38a715cedd812f98456937", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "13b74b2f-b94e-4946-85e6-0e7b76c57122", "comment": "Malware payload (Mirai)", "value": "4f3762efdcbb8d07deab0cf446d03bfebfea5af30627548e482f7c252a1b656debe6e2db9ed493c3bd21ec2d4570b917", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "c8c4fc91-b6b8-45b0-a3f0-82d8539757de", "value": "T127D31945F8504F23C6D512BBFB5E428D772A17A8D2EE720399256F20378796B0E3B246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "3dccc2d6-be28-4fc6-b261-6bf41a08b194", "value": "1536:CrS4K8LEk/TvAfO6s8qAZHX4VbfwHTF/rthMWVJO21ABlb4ElwoAUlnbwyweYLkG:CrSp8Imf8qO4NUNrthN3qkaDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011948, "uuid": "086e4a82-6849-4761-8468-b0c1642f66b4", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011948, "uuid": "39bfa502-23bc-4ef9-95c8-e6d3387c8048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "1687d613-d628-4243-95d1-297f94ea52fc", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a324ab6-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784023850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023850, "uuid": "06ee9c09-5a39-4963-8bce-6e6411acd4c5", "comment": "Malware payload (PureLogsStealer)", "value": "d5e5b9deb06e3bd9dc1646f28b9d5528", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023850, "uuid": "0899f7ac-7d06-4628-8a04-4592655fc59b", "comment": "Malware payload (PureLogsStealer)", "value": "13c2a9cc1c290c3ede00c01dff7f3ff5164054a55e74b46cd2a91de1791e08ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023850, "uuid": "3d6ca14b-f433-4a95-9371-92c2113a769f", "comment": "Malware payload (PureLogsStealer)", "value": "7eb6e46fa52b6006bc45b409aa482b90bc22e5d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023850, "uuid": "997a1403-cf26-4ff8-84c2-4b55261ec610", "comment": "Malware payload (PureLogsStealer)", "value": "a6d5bf6a7ad50e5570a495ab632034bc7377a1b4d77a87bfc810ae52465208c6bc788c84c7a4e76c69f7f11d9b2b79c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023850, "uuid": "efc6d868-0a62-48e6-a2e2-4ed8254b3a7c", "value": "T1DF8585095BA2C050B6B71C683BDB6322C58E79F76FE790A366380CFF5357825D8B4A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023850, "uuid": "d4e5f6c6-ba49-4aa5-8cbe-c3eaa3881ed8", "value": "12288:SCmik4cF310AOaEfuBSaPbSjpGM8xLOjTft82JXrdK4FL46+AGsUY:8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023850, "uuid": "d4964b0f-891b-4487-905d-c3aff9c8d121", "value": 1765920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023850, "uuid": "2f126e4e-540b-4978-8010-b7a5ee32ccbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023850, "uuid": "54186f26-a496-4c49-aa73-65d225210885", "value": "output_po57hzhp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02bd9bc-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015458, "uuid": "233b9abe-c663-478f-ab4c-1a1731fc0149", "comment": "Malware payload", "value": "eaac82ebbce56cf939fcabfdb4516d92", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015458, "uuid": "10aa159f-0f2e-48c6-b8ce-b23abbe135df", "comment": "Malware payload", "value": "13db4973db739dc63a83c074167fcd7d9367774a0d3e9bcdae102297a41fb49a", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015458, "uuid": "b4c8f6a1-b506-45a6-9cd5-964a3b296466", "comment": "Malware payload", "value": "77b5b7023dba7ea0c4548e9da661b32080e4aa0b", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015458, "uuid": "5e1c9eb3-2851-4c0a-9535-d3caa23e8cf4", "comment": "Malware payload", "value": "7d7f1ececa5a4dd536a7ef3f76eae7f78200e2c391e4f018eb35a50f25c23f99d6480a95c27158345cd78e79c98c0542", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015458, "uuid": "6b856d69-599d-440c-a5ea-bb3827f6f06d", "value": "T1B634F1A5850701B2C9492E277F2E914C50DE27D098B2316D24DEB9CBEF43377E6BAD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015458, "uuid": "607ef6ba-e7d2-47b8-b184-4683cc08c85a", "value": "6144:1YvUlMKctMLUaUUeqM6cOyHQIQ06mNtN7Db1SlDmDK:mvUlMK8uHcjQKNf7/1SlCDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015458, "uuid": "a38d671c-88e1-48e3-b41a-7f6647913081", "value": 240428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015458, "uuid": "ed1e9e8f-663d-4fb9-aaca-f3a0ccd15516", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015458, "uuid": "308d6c08-2ff7-4ecd-aadf-127a1473641d", "value": "Quotation QU102117.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17826c99-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (OffLoader)", "timestamp": 1784012168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012168, "uuid": "ec2c17e7-5bf9-42a8-a205-ea90e5d9bc01", "comment": "Malware payload (OffLoader)", "value": "d76b3e385a5f85b7c2a547ee7053342c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012168, "uuid": "ec87ad70-ce5a-4c83-9e99-1ab3e9d9e4d2", "comment": "Malware payload (OffLoader)", "value": "13eabc99acd666de32c3db953f8416543a3fa7f86a18b922adda6f3b1045ab1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012168, "uuid": "8c925cef-d0f1-42eb-b11d-adda77933593", "comment": "Malware payload (OffLoader)", "value": "bace6a7c8b3a6df67feb7af9e7ead11a17505697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012168, "uuid": "3cba4716-2684-4447-9fdd-256faefbb0b0", "comment": "Malware payload (OffLoader)", "value": "afb05d5f47137b1ab8b06b4d7aef0332efb32a7741a08109faed10122a3756f6f09ed0747aa3048dfdf7e9807dc41b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012168, "uuid": "b077e54d-1e8b-45a0-8a64-a1c1ce986e46", "value": "T1B0A5D033F28AA53EE06E5A365AB29150543B7A616D138D0BD6EC389CCF352603D3B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012168, "uuid": "3cb950e4-7a72-4209-9673-ba19b12ed7a7", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012168, "uuid": "8167b23f-5f59-41ed-83c2-9325a3ac375f", "value": "49152:yAX7NhIUt1ITeLKFhVCsmMqrc+BG2L8dH:yAX7nIqKTeWFDvqrc+3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012168, "uuid": "23574684-aa19-421c-bbd2-77deee60c369", "value": 2091638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012168, "uuid": "fecfc142-ea51-444c-9032-67d2525f6833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012168, "uuid": "b89a93f9-3af8-4fce-bf14-be2f6afc2252", "value": "Glary Utilities Pro v6 44 0 48 Portable zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a038fd1b-7f55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784014116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014116, "uuid": "e484d0c9-a264-409f-ad18-6c23a442f8f8", "comment": "Malware payload (Mirai)", "value": "d6823064e38709a639002cbf8d2aff5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014116, "uuid": "756090f3-bc62-4b63-851f-53e87d6de273", "comment": "Malware payload (Mirai)", "value": "1875aa41d04e693c7b8b108e1668e1c99d5b4fbf644fda6bbfb028b5106128e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014116, "uuid": "699f615e-f22e-42ea-9c89-ad389c702b1c", "comment": "Malware payload (Mirai)", "value": "cac80cd6cd505d82619668d9f8d873f5554e5379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014116, "uuid": "e29bb0c8-545b-4b8a-98d1-507fcdc6ca57", "comment": "Malware payload (Mirai)", "value": "a196e5eeb04197a0d7346b886702c7bdfb8c3fa4e2973b61a9af5491792eca47614a2a9ad21bfa688a6fea4878a3711e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014116, "uuid": "b3fff01b-79c4-487a-8e0d-ba91c942382b", "value": "T1AF832AC4BC81A621C6C226BBEF5F018D335657E8D2EB33479C294BA4778A91B0D77B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014116, "uuid": "d6ea63ce-549e-45d3-a861-6d0f18fb2f66", "value": "1536:nMk6TYQUwR+gIj7qfhjBX0onfKIsEJOu3+wYQ0qQq/LldpgxG4MFn0D9wVW:nMkWYQL+gIjkpmofKIs2Ouu9qv/bpB4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014116, "uuid": "0d527071-15ce-4701-9190-0f0b09e6e682", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014116, "uuid": "61e29b07-6f0e-46ba-a3ff-0288c722f746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014116, "uuid": "d0296d1b-e3fa-4c75-97b4-063bf9d81d68", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905f7923-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "fa92698f-733d-4ba8-b035-7451bfcfe252", "comment": "Malware payload (Mirai)", "value": "4c590106aaef37cdc307abcaf77537c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "5a2aec41-5a6e-4047-a935-7fcc626b55e5", "comment": "Malware payload (Mirai)", "value": "193367f444fe32817442e0904a08fec278aa131f1f95f5245f141fec2eab685a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "32ca67e6-8342-4e30-a4af-c3fdc9bc826d", "comment": "Malware payload (Mirai)", "value": "fc72a36fe74f8482ce1583bb9d2167ccfb077ed6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "08ff5cea-e4da-4a48-a90e-b3acde414cc8", "comment": "Malware payload (Mirai)", "value": "45a3ae14f51009e0f77ebe0682e0c656de14222f3b799f49eba7b54c327aca8ae0eb78ab9c873d56eebfa23982731e54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "dc26d599-9c81-4aa1-9015-3a4ca1512604", "value": "T1F0310F94E3D25EBEC8F411BEAD4B0311B3759F00E1C77223861C67A86D2AE3C5D2704A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "f3c0e05b-9f65-4d83-abf2-6a62e8e83f35", "value": "24:ug1KGpa7Urz/jlfQAXK1G9Vev3gRGRP9iRBBuLlk8n69gCe:ug1KGpa7UrLZQ/RlPSBuyvte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011942, "uuid": "cbeab47c-1a1a-4aef-81bb-903e1a32ebd6", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011942, "uuid": "e62b8364-28b5-41d4-a365-c77336fab4e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "719c6e46-e96b-4521-91dd-4118b7afa336", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97acee15-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011954, "uuid": "10966cf9-a8b5-47d1-b72f-26cf2ece0d81", "comment": "Malware payload (Mirai)", "value": "7dc1b2b3a66110f136d8ba441fa5e151", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011954, "uuid": "1e9efa75-1159-4154-a409-7eafe41694cd", "comment": "Malware payload (Mirai)", "value": "194dc22f136dc87b5b0129064febfd19e807236de5fccfbc09ec0a211741f2cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011954, "uuid": "3ceff8ca-72ac-47c4-8e07-069847754a3d", "comment": "Malware payload (Mirai)", "value": "22c091b00343c92bf35b6f570f74eb024221c9c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011954, "uuid": "699c5b27-5490-4939-bad1-b33d8393b782", "comment": "Malware payload (Mirai)", "value": "0a33e3db3659b5931e699aada5094a807a14a9b573374b592997e16bde0b357fc0ccfdc840627323e1055af102b01823", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011954, "uuid": "56636c68-d1fc-41d1-9d29-7c2007cfae09", "value": "T107D33A06730C0947D2632EF43A3F27E193EF9A8121F4F644255FAB8A9671E321586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011954, "uuid": "866a2c32-d2e3-401f-ac53-08316e48bb8e", "value": "1536:HExfM1+e8DsPFX+I2YvRxfjIWEPl5U37VGi7nJr4omrvArjWEG+A5NtqGbn/F:kCfoYvRxNETE7Jr42r6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011954, "uuid": "62bd5e27-86ec-4c6f-98d1-67e6e72fec3d", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011954, "uuid": "bc434cc7-adb8-4700-a07f-5c26feda8443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011954, "uuid": "5d84556f-1e59-405f-a492-fd073f1ffc68", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf05f82-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023692, "uuid": "2b3bb802-a131-43b8-aeb1-2cebc0cb8235", "comment": "Malware payload (PhantomStealer)", "value": "835c0fb7e383b3e9c0c2fe699e8ee19b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023692, "uuid": "0c2c087c-9a1b-4184-9272-1254589c807f", "comment": "Malware payload (PhantomStealer)", "value": "19b370ca13b46c0905db4c2021e414ae38c5526f1162034f553f50a9df95fe1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023692, "uuid": "5bc3e686-7d77-4c03-a979-c3580f63418e", "comment": "Malware payload (PhantomStealer)", "value": "3ec716b081cf567d6c41d35391dfceb3b9af3d34", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023692, "uuid": "d23e1ea4-6512-4609-b440-6afd89c2a505", "comment": "Malware payload (PhantomStealer)", "value": "316410ec6cf656e7100775e04af576d36ff9f2bbfbbf974cb228e1a84c89986947142b653054afd2578497aaac031cb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023692, "uuid": "59e36c25-b6b6-4483-ad9c-df7510af45e1", "value": "T126062A119724B1B2A668DB5CD136DF38944E600359D9DF08316E8B287A5DE4BE38CFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023692, "uuid": "137d67c4-0fd2-4cc3-abde-4498f9496cea", "value": "98304:Na14RuRLGvu8AjalP8A87csjXXwHuycO7nnIuImRLK9lR+nr:Na88GyjalP8A87csjgupO7nnIuhRG9Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023692, "uuid": "e29644b6-cd88-40ca-896d-5104a8f11d58", "value": 3837983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023692, "uuid": "3205cfae-f3e1-45c5-aaad-b9abc3ce1796", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023692, "uuid": "caa1480a-b464-4a4f-8584-f64a3bff2949", "value": "LPO 600798 & 601501 \u2013 50% Advance Cheques.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd36b6f-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784035831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035831, "uuid": "bafb87ac-9d7f-4cf9-8e2f-996c52184395", "comment": "Malware payload (XWorm)", "value": "a36374b54d03e24d666466928d208624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035831, "uuid": "ce3119ef-ee0e-41c2-8306-a85b8f3463b0", "comment": "Malware payload (XWorm)", "value": "19d6b52e50a865b56f34724d77af88b87e065c179d91ea6614d7e36ce1370216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035831, "uuid": "d6bc46fb-ab27-417b-a905-4c8cfe3405c2", "comment": "Malware payload (XWorm)", "value": "15585c70f6dc9bfb5a73d8a70766c63355997dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035831, "uuid": "4f24f656-1a3d-4d1a-b0ec-2ed71061ac1f", "comment": "Malware payload (XWorm)", "value": "e62b5c083bd933a0fc9e0bf7383356da0686e119c498797aa48a77a54f13acf3a81cf22645ca2d5088d1ef2bfe3ba8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035831, "uuid": "b405aba9-b3d7-4950-a411-44d3ccf31df2", "value": "T1C5E4025D7156EE07C94943B409B1F2B456AE1DE9E802D323AFEDBDDF7A62E088C50183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035831, "uuid": "3a6b1fe6-eca5-49ba-b6a6-c87d1f9694b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035831, "uuid": "06eeb47b-ae43-4c24-b194-bc7442e5dbf9", "value": "12288:ElJdbePFjEwzwnDkkDB5O3X1SfK/ol9UdwxTA4NH1n0OrGBJb+K7D:EEPF4wzIZt81UKcAwc4NVn0k4QKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035831, "uuid": "a0200dd2-f5a2-4e21-99bd-50d4dc5fe19f", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035831, "uuid": "bb9df072-b1c4-4307-913a-053905c1c0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035831, "uuid": "9bba9d76-212e-413d-8099-da4577e47621", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19626.27159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202b8132-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "c84839fc-e121-404b-ba6a-89c473b5389a", "comment": "Malware payload (Mirai)", "value": "e6307755910186cfb8f0ec3a31abb009", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "ce8d80a4-7a89-4e02-bef0-8464550893e0", "comment": "Malware payload (Mirai)", "value": "1ab0bca5cdb14b03bc6a5ee7dfb5b19e2849bd7c802d9efc2781c65c8c98fb3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "4b1835ae-af6f-4879-87d0-05be63420968", "comment": "Malware payload (Mirai)", "value": "caa0387e8bd84e1f68a6ce298d460b15ae694332", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "d225f58a-4998-4304-af4f-a6c9836e25e0", "comment": "Malware payload (Mirai)", "value": "0df73bdeb6a0bf6582ed48d3ccf4ea873e50fc7b3d2f4e855b551ef9039a452dc8d9adb649f81d6c3b43721308b93456", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "fef01b2d-b906-4b09-8a3e-51a6cf0af422", "value": "T195F2E146E0E75BA4C00BE23414AA74662A218A2D518DCDD7FFDCB136BCEDFD6B0241E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "aaf297cd-c4dd-4978-acef-3b9573534a3f", "value": "768:uGXR9dYaC5QHigaJsjA1wauH+FnzLY6PzWIHKQPnbcuyD7UrQRjS:uGXzdI5YDay+NLHXHK8nouy8ry+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012183, "uuid": "8626dc9d-b586-43e7-ad96-3912f10ad602", "value": 35828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012183, "uuid": "25258f03-de66-4bab-a0fe-cee193466484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "ce13490b-4367-4a08-a8b0-6e6b527fe1a0", "value": "zombie.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b26628b-7fd1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784067311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784067311, "uuid": "40b7414d-f781-4561-bbba-df4acea114d8", "comment": "Malware payload (WannaCry)", "value": "5667a191efb1c5f4a2797c3c8aa86350", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784067311, "uuid": "206ef31b-fa0a-45ac-a2d6-569d2c2b3679", "comment": "Malware payload (WannaCry)", "value": "1b9d1966ec3bfc3d78ee8bd6715f11a2a3a7d22f1b5d3eb19ae3ebd8879bdc35", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784067311, "uuid": "043bd937-66ae-4c48-84ee-b05b13358827", "comment": "Malware payload (WannaCry)", "value": "df5c60a549fb5a13ef35f7cab4888a98ab6028da", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784067311, "uuid": "1162aa3c-856c-4286-afc0-fc1b2ef603ae", "comment": "Malware payload (WannaCry)", "value": "56e3feac2ad1150d11e4a8464f6a61dde095e479e93db0562f2e09a0108c6f508549b99259920c98d7612b0a1de418d3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784067311, "uuid": "6f932085-2ec0-4e6f-900d-86bf082d5e62", "value": "T1F536126972D86ABAF7B32BF121758B6457B6BD01AE1A461F1260054E0C73F48DCC3F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784067311, "uuid": "45f89e47-027f-4aa4-a3f4-5d51007e3850", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784067311, "uuid": "a6afdd2b-8cb9-4a81-bca3-9945a4101a95", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9ocpis2xgzBJriN:DI8qPe1Cxcxk3ZAEUa+cpis2xgzBJriN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784067311, "uuid": "02a1f56b-1a0d-4f67-a9b9-32723fbb1c09", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784067311, "uuid": "6e8b2b88-0ea2-47d1-b837-de9da5c317d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784067311, "uuid": "562dc55b-01f1-4ae5-88f2-067485d994a1", "value": "1b9d1966ec3bfc3d78ee8bd6715f11a2a3a7d22f1b5d3eb19ae3ebd8879bdc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94853fc-7fad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784051927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051927, "uuid": "5e5866a1-e1d5-4c02-b4fe-b834ff2c53bf", "comment": "Malware payload (Mirai)", "value": "2ea2b67370560692e43d23a3e9dce1eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051927, "uuid": "87b6bf87-1758-463d-ad6c-30b838c28ffa", "comment": "Malware payload (Mirai)", "value": "1bd9e446a11bf2dca961562ed807476067ea4ade0fa068c97b58173e651060f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051927, "uuid": "0d08f61b-9a06-4823-91d1-6d7632696718", "comment": "Malware payload (Mirai)", "value": "9ba9b4c24f1913a8644969a271f62b828e79f4c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051927, "uuid": "1940234c-0fad-4472-a9d5-53ef17962c05", "comment": "Malware payload (Mirai)", "value": "375c0333b0c0e6761e3a7ba893a4959d20ca90ecc8479c64819ee4d75bbea554b7d7fb54580b56c22edf2fc665c8e126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051927, "uuid": "ee4237da-5e52-4a37-aca0-9e3626fe0725", "value": "T165D3068AF8819F21D4D612BEFA4F518D332367E8E3EE7112DD245B2477CA51B0A7B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051927, "uuid": "b2f66d04-1122-4762-9a42-7b362019c399", "value": "3072:8mH2rHQ6qvC2Hup47aL4u0fpgREkjujkaDKaMnersXuGobKy44NVnbWt:8mH2DveVHN7aMuggpCIaDKaMneYXGKB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784051927, "uuid": "5dff460e-31c1-4dec-9400-d1ffe578ae1d", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784051927, "uuid": "2fe3fe06-e2f4-4d62-a9e8-c61543e28e6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051927, "uuid": "50d9e76e-f687-426f-b044-dfbcfc08622d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcc4b06-7fc3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784061225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061225, "uuid": "e5abdb7e-0f57-4380-8fcd-8b6e3c1613f1", "comment": "Malware payload", "value": "74bb7fa4541d236106940bd78ab50382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061225, "uuid": "5728a260-5a54-43c0-88af-d302a1e749b9", "comment": "Malware payload", "value": "1be1cf9f734a326dab0e909204f981c305923ccb2ea476e8b804f3317a8dffcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061225, "uuid": "9377c5bb-cd04-4089-a392-6d9024e51770", "comment": "Malware payload", "value": "c0e75e1e4cdb802934f5fe6d24a1344c779aa8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061225, "uuid": "f594e651-1606-458b-abb5-8a67896b8aea", "comment": "Malware payload", "value": "dc75268d1d3baadb9ddf88b9601c36aef95612ce2d8ec6d49ad4e2eb9ca1216a6995c376b3b7f132fce490df6743108a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061225, "uuid": "865bbf30-878c-4832-baf5-6b2625759063", "value": "T169D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061225, "uuid": "b440e96b-6d1b-4c6f-b287-c2eaf8726b66", "value": "92576cbf961890053b0276abaa28bb78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061225, "uuid": "8895e984-1dce-4ccd-9260-eee1b0299d88", "value": "12288:FNH+AxETh1IpJWIf9KvvGQJClDeSF6XPj:FkAqTXCJDWgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784061225, "uuid": "4dd7d4db-5192-4344-bf17-32ae24b695b8", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784061225, "uuid": "5b692789-74d0-4628-b2ad-7cbae88c1835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061225, "uuid": "216a4dfd-679c-4eca-901d-0fc519501592", "value": "SecuriteInfo.com.Win64.MalwareX-gen.98861688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3535e78e-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046578, "uuid": "f9d04c17-bb60-404b-b23a-803b33777a2a", "comment": "Malware payload (ConnectWise)", "value": "cd609d2c607c6bb70cbf4d5c7c21a891", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046578, "uuid": "b24f2e0d-3027-4969-bfcf-0bcfb215a29d", "comment": "Malware payload (ConnectWise)", "value": "1c581a5bcc6a4fb4ecb9d6151c9c88adfe678d3771fdd1accf9820152064f0c2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046578, "uuid": "9ab6774f-5924-40e1-b7f7-a7d8af894ca0", "comment": "Malware payload (ConnectWise)", "value": "9e6fef572d60322135fe2a2312880006d39675d8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046578, "uuid": "0d3ad5ba-21bb-4065-a51a-f0d78b0402fa", "comment": "Malware payload (ConnectWise)", "value": "f1c862d460704bd6c207e059f78c3eeedff49780505aa1b6824024a235c5f62135635b158d00f2313a0930c7c367ff40", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046578, "uuid": "ba1d9b27-c060-4b9d-854d-1abc695dde41", "value": "T1AD46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046578, "uuid": "13ba6629-e990-473c-9b30-6a04e23937bf", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046578, "uuid": "e6f0f4d0-e8ec-49b3-ac4c-5e4077c8fd9b", "value": "98304:6zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:6hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046578, "uuid": "f956cf2f-48bd-48fc-aeea-23606335db6d", "value": 5641480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046578, "uuid": "a7fc311f-176b-478f-8918-085d7a3befdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046578, "uuid": "d97aeaec-00c6-4e07-8586-1d18d5d1e98d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9857d55a-7f3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784004654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004654, "uuid": "b7d9ed1e-47f7-4f60-b7bf-4c16800ec00a", "comment": "Malware payload (Prometei)", "value": "c72b40cbe17d6d59a4489069d18142e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004654, "uuid": "df6f3cb9-9054-49b0-b718-78bb765c3758", "comment": "Malware payload (Prometei)", "value": "1de0ece47647946782f790d4aa8e74295df8db96bc0e2442337edf320e2c76a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004654, "uuid": "b4609791-d8f6-4c95-977c-7d5403107d0c", "comment": "Malware payload (Prometei)", "value": "bb6be467716e209ec3737b6772d8e945e5e456ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004654, "uuid": "78ccfd1f-0a29-4478-8d8d-3c5928503adb", "comment": "Malware payload (Prometei)", "value": "805bdea932e17b2ad8fc9931d7e11e8df020fa00b035b62bbedc08a34816e996768880f2b5858d3e9d628605901d1d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004654, "uuid": "932c0e40-2af9-4ea6-9891-35b7ce101b40", "value": "T10B74DF63B6B8F14EE88297324B57CB0287A53FA58892D09E79B4230F2C756544F74F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004654, "uuid": "0d53aa7d-adce-4105-a757-db1debd9559d", "value": "d9210cd966b2e5956644b71b6805e8d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004654, "uuid": "3df20a7d-a56c-45ee-a841-c2bec2e94d53", "value": "6144:m+LQwhNI65MY5wH2l3D5YolYvRjf6yl/5JTFw1iKzHk2oGbksEb5iFeT:mMQwA65YHWDeXvRjf6YnyixGbk1o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784004654, "uuid": "a8c201d9-2318-4a39-9090-58e5bf987192", "value": 348436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784004654, "uuid": "2abd8673-ca5a-4182-ad56-71a101d386fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004654, "uuid": "cd2afa64-8c54-400c-98e6-9af689d594c5", "value": "3d49444c7f58ccbd6ba93587fce2420f1e1775cfa8592b259d4a921b38e42533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973468cb-7f93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784040729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784040729, "uuid": "5564302d-886a-41da-be19-05b5c8ae799b", "comment": "Malware payload (Efimer)", "value": "b171382e01c1dc929798fd9deaa52217", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784040729, "uuid": "51954856-04f9-4247-b986-0a84ec465514", "comment": "Malware payload (Efimer)", "value": "1ea0efe8085044813cd678376144c54efc5c6a56bbf41ff2fa5b64099c4a689a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784040729, "uuid": "fe97dc54-e730-4115-a222-1f924055334d", "comment": "Malware payload (Efimer)", "value": "6b135dc844dd62a0a875e6bd143a46075646cec4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784040729, "uuid": "ccbd1190-c28e-4be1-8b62-8e087952cc43", "comment": "Malware payload (Efimer)", "value": "77fa257941234e3e843f548b19ed5da77687985cd5f24a0a463b266f34e47a30a4171b240f141e5d5d9ed2501b3115c8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784040729, "uuid": "627fa422-4381-4a78-a4d1-5b44e5815fb0", "value": "T145E6334866C012FDFAF78439DEB25194E6A8B46603B1C5EB43E89BD61C570E04E3C76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784040729, "uuid": "3376b157-f7fa-458f-bf66-b9c30f3c1c98", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784040729, "uuid": "a15b5f24-fe2a-4c8a-be7c-5fd3984045a1", "value": "393216:OICbqN7BZnNA8IhLwRc+Kt1zXMCHWUjX6cuI3/PGTAI:Oc7L0hLYc+Kt1zXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784040729, "uuid": "86769412-adae-45bd-96c6-da6093295a07", "value": 14324723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784040729, "uuid": "be0d5661-0a69-4be4-9d16-ad7eb433ab66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784040729, "uuid": "ef9ef44f-fb0c-4d81-b308-bf6da9110fe7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd78441-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039697, "uuid": "2795ac78-e371-4f62-88a9-28ac457acc77", "comment": "Malware payload (SilentNet)", "value": "124dc47fe247ccb6966e3e9a3b92c151", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039697, "uuid": "071d089f-e365-4b08-9561-d63c606f1672", "comment": "Malware payload (SilentNet)", "value": "1f79ce70cd5c4f7829c34604c2a62db5d5b2a4d00d5d8b6a8b246e3059e77f17", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039697, "uuid": "680bb75e-2874-438f-99c6-29ac31ca9f2a", "comment": "Malware payload (SilentNet)", "value": "6695fcbe90678e915c620aae4ef4dd051f60e67c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039697, "uuid": "60239b43-c60a-421f-a727-d5b0a7d87a9f", "comment": "Malware payload (SilentNet)", "value": "bb6d0a119b23bf37558f0521c714622cf68d81278de449fcb2e3e5d9aff1147e9ef8dd5d35aade9a4d50c691ffb69eca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039697, "uuid": "f0eab3b6-6acb-4abc-b38b-ff1b479211d6", "value": "T133363390C80A9796AE517471B7FF9A79336E58AC7C02B4A7B081FB2CD010F327593567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039697, "uuid": "01980505-89d9-452d-b397-4cd0b3f22748", "value": "98304:Sg+LvwN584qgmw2WbCisrXTsDIynRJzGS5JB9X:ww5cgZ2vrjSIORxGS5JrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039697, "uuid": "8bf04453-799d-481d-8f70-78b71ae8d9f4", "value": 5134136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039697, "uuid": "632ae4e3-6362-4920-8108-16045680a4d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039697, "uuid": "e82758d9-a1b2-4f60-9c1f-84627c1cb5fe", "value": "Matrix duper.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e05394-7fc8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784063388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063388, "uuid": "6f8e0af8-d16e-4cc8-92c4-36232cfd7739", "comment": "Malware payload", "value": "1197411c01a27f66455d004cb2013cf3", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063388, "uuid": "7dcdf4fb-f143-42d1-aa82-e6d141f4e2b6", "comment": "Malware payload", "value": "20226b2b49c6d721bd5458710c111510a0f501616d5a2859943b4dc2d8f74736", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063388, "uuid": "4e8d56bd-54e5-4398-a0d5-90c6e43fb2c4", "comment": "Malware payload", "value": "a12add941b37c26aaeca8d2f43c17ff00a20709c", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063388, "uuid": "d0907b63-f330-4908-8214-85ec968818ba", "comment": "Malware payload", "value": "ac6f59c6bf2883767344a9f2f1c9cdc06df979f604a5c6012ecf27137bcced9f6e2103f5da5fc919c983eb70d2714bca", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063388, "uuid": "3582e6a9-2e43-43a2-8e14-604beb59f2d8", "value": "T127868D2BEDF445DEE49FB53C81137211BE223D0017126B173AE8B3391D367646A69B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063388, "uuid": "917dd46a-f1c4-4fea-b726-740eea583186", "value": "17959180aa6d2c96074ff57e33017f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063388, "uuid": "35521fc4-c817-4510-a025-9066051c04fe", "value": "49152:WcbyJq/u6aikMSiJuhJIvtnceXxcHYOVGHS3enuNikeeNwhc+eVER4xHbdkYrR9f:8Wv9cqcHY/yejg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784063388, "uuid": "9ae0fe48-cfee-46fd-a48d-953a6be7b4b6", "value": 7890848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784063388, "uuid": "3eb45816-6e56-43df-8aa8-98e80df3408c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063388, "uuid": "c0e01c9b-eebc-4f57-86ec-8eebda8246e8", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42d13a9-7f53-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784013344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013344, "uuid": "3f05c507-1728-4889-8e16-e2fd4afce8dd", "comment": "Malware payload", "value": "8c05df37e41a68d816b873a859f6d612", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "outlook6web-com", "colour": "#E6668E", "exportable": true, "hide_tag": false }, { "name": "outlook8web-com", "colour": "#29F9AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013344, "uuid": "5c78cc9c-7b6d-4335-9ce4-e14b633b8a24", "comment": "Malware payload", "value": "207741d9d63231ba39e566f768da125d5a42ebb30d5f0c367c2e064681ff8bc5", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "outlook6web-com", "colour": "#E6668E", "exportable": true, "hide_tag": false }, { "name": "outlook8web-com", "colour": "#29F9AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013344, "uuid": "fe2eb5fc-d9a2-4163-9ed9-e39277d45c23", "comment": "Malware payload", "value": "bf27a48b025a7da1a2fe1781525a882e2118ea0c", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "outlook6web-com", "colour": "#E6668E", "exportable": true, "hide_tag": false }, { "name": "outlook8web-com", "colour": "#29F9AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013344, "uuid": "6df1a35a-0ec1-4414-8fb3-d8bfcc26e958", "comment": "Malware payload", "value": "c1fe206f5b6c42652870ac2bbc7a35939f207b239e1b79cd3bef2609ffcafba93603e1c414aa30ab54d77f7f92a4f6f7", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "outlook6web-com", "colour": "#E6668E", "exportable": true, "hide_tag": false }, { "name": "outlook8web-com", "colour": "#29F9AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013344, "uuid": "ff9a8971-4792-454d-8925-12951bab72b2", "value": "T198029E1ED7D84C83D09FE6751A948101CA2BDBC846E604490BF962D97B85EF7A632371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013344, "uuid": "ab8dc1ec-3446-41c3-86e5-389ca8c19eaa", "value": "192:hRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+Fc:hRm/wksuQJ/g6dI+Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013344, "uuid": "c2a3ee16-19dd-44df-9541-1edf68d7b0dd", "value": 9003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013344, "uuid": "8dcc5e31-d0fa-4085-8752-851c398ea687", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013344, "uuid": "75dbe511-d83a-4285-8c1c-a43090284888", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771f9cc5-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784033804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033804, "uuid": "199c954d-b709-46f8-8821-068407e3f06c", "comment": "Malware payload (Mirai)", "value": "27be5b624a879da0067201fee7cdcaa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033804, "uuid": "91886a7c-059a-49e6-b695-b5dbde39e1d2", "comment": "Malware payload (Mirai)", "value": "20a4cff152934045821b84cf2d9bba1f2e3118734b98450a1708d67c599fb748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033804, "uuid": "aae68d8a-af6c-4e1d-bceb-ee3d66610fec", "comment": "Malware payload (Mirai)", "value": "0821adfa8d83e85ee805190acdc926186b93b33b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033804, "uuid": "7bdc330a-413e-42ec-b2bd-62865373fb9d", "comment": "Malware payload (Mirai)", "value": "47f0896df279ed10145db42983c25b812b5bab3df01f15945c9db8db27d6fbf45bf16dea72a2a048f87377356e63bc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033804, "uuid": "ddd74ac6-89fe-44dc-906f-8ec1e06391d3", "value": "T1FF44235DF95669F8E10579F3BE71EBE2742385108CAE720D44EC89FB269073A82391CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033804, "uuid": "a2735906-ec73-4566-b51b-ed5fb3c7e7bd", "value": "6144:UYT0xwOI64q4BDU1ktHHFk/Iullvajgl+QXOdwNZSfJPKpvk:TQw/1pBDU1kta/fBaI+QXOdwI+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033804, "uuid": "748f9146-a0ca-4951-973f-49895cf7f01e", "value": 257992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033804, "uuid": "7e5a8af6-cb75-46e6-b4c4-0a9d1fd856b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033804, "uuid": "9c61462c-8724-408d-a385-140ba6d8cf23", "value": "ikydgrvum", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929727f5-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011945, "uuid": "09d010fb-c7a1-4f7f-bbba-fa049922695e", "comment": "Malware payload (Mirai)", "value": "09af98a2ebed69c8d570c8c438ee75a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011945, "uuid": "3b4f111e-ed92-43ed-814c-6641288d299c", "comment": "Malware payload (Mirai)", "value": "20cef6c176b99c78d3cc412a57eee73d04b5d476a173b9cd7972249f04d76005", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011945, "uuid": "a3063ea1-1bf7-4462-b658-81b1c9f68852", "comment": "Malware payload (Mirai)", "value": "2dc15052c3067e290fd2499b42f4d80c95b1be0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011945, "uuid": "4726a210-4ffe-4a73-aaec-5d497e28f272", "comment": "Malware payload (Mirai)", "value": "ad4575e0f86ace4aaf41ee587a8a4f6d283cab7a51a1b209f53e426bcaa257087dcf75a4c00fe3efc7e963e69de2d524", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011945, "uuid": "bc38cda4-8376-4111-ae06-f68eed666ffa", "value": "T1A921F03BFBBB8716C450907A0EA333223734DC5C0015C229BE31695DDC126256F821F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011945, "uuid": "f12c13a2-ff73-436d-a4a4-f113cf861337", "value": "24:3DdNDq3N0yTK69k+sMA/elMSkvsKJ9lQuNTawqlE:XWVTrjsMivD95NuvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011945, "uuid": "2150932f-c3c9-418e-8f28-4c48dd06fa53", "value": 1304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011945, "uuid": "9c0c9c30-b50c-41f9-86a7-33f6ad7e9cd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011945, "uuid": "dc8f4702-29da-4775-aff9-5abd5687d260", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b2a867-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012318, "uuid": "0b78f3a0-928f-4470-bd78-c0428b4b8ce6", "comment": "Malware payload (Mirai)", "value": "4bf627f6b2d4f1557a71d2b9a78a7125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012318, "uuid": "c169f057-2c05-4ede-80a2-73b79e24413c", "comment": "Malware payload (Mirai)", "value": "20f516bbf634028f6ca88e4750ffb997e425a5680074559f64cef1456417580e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012318, "uuid": "22c2f6d8-755a-4f00-808d-c118a93a7941", "comment": "Malware payload (Mirai)", "value": "b306920bda84ec87fa1b5ab1b3ca0b9391f07205", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012318, "uuid": "b274230f-f734-4050-8b59-3bad264c634d", "comment": "Malware payload (Mirai)", "value": "ececb5e07bfb3b0dc447927e7a159350251ac4d4014c22e1c9368fe2a16cb959d0fd256cd74a6679fe7ac4e2e2ad3cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012318, "uuid": "151698eb-2682-4d9c-9f7f-24a0c565f32e", "value": "T1EAF34B46DB418A03C0D61BB6B7AF42493323A764D7DB73068D28AFB43F867990F67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012318, "uuid": "4ebffe88-59a3-48ac-b018-8d406c614076", "value": "3072:72z3X5ia/A9r8iqW/aOgyprrLGFAOM5BIoegT6M/96ByV/1:ir+9raUaOgyprvG+LIoeguM/9Ww/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012318, "uuid": "ec5f027e-f4b8-4085-9ef5-299251f2a683", "value": 168865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012318, "uuid": "38360d98-ab7e-44dd-ba2a-cf85e616d353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012318, "uuid": "0777f3f6-10fd-46e3-99f9-bd3362d09042", "value": "zombie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdebe3c-7fbc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784058514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058514, "uuid": "3339de01-3fa3-4558-9103-4d7e510e0c1f", "comment": "Malware payload", "value": "ab8a67365535555becd7fbcac05adb5d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058514, "uuid": "35d4b315-cd90-4515-9f32-5f2875fa8c5f", "comment": "Malware payload", "value": "2172f09302778dbe9ac1970784517b318ab9d6a0891f40713ae21b2e982808c5", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058514, "uuid": "822ab1bf-8bb0-4375-9474-caae22dfa78f", "comment": "Malware payload", "value": "64bbef24b52ec1dc2db886715beb24c104eb9e0f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058514, "uuid": "00843e5d-8255-4076-952a-8e4b44c6c8d9", "comment": "Malware payload", "value": "25cf633487ec486728a1f7f3385bf62e2b2bf3978a7987b58d7307630cc6fb7023fb135f9e25b292bc59614c0e613ba5", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058514, "uuid": "3f694e85-c803-4ad2-98ea-6220ccf9512c", "value": "T157C52223E1309817D7BE0230A9D34B40863658EE86FE99369AD336A0B7DEFEC315454D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058514, "uuid": "36a89cac-6b51-45bb-bb33-5ea64b7b44af", "value": "49152:cvSxSAlVP7+eTkzaWLzP9BftNBXwc0GeBnzRL7bHAbmnc:cv/4BtkzTLzP9Ffuc0GMnzRrASc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784058514, "uuid": "b3922ca5-6179-4d69-80a9-12ba92872c63", "value": 2627496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784058514, "uuid": "3ad147ae-9c00-413d-8522-03c5dceef958", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058514, "uuid": "1c2538b2-55c3-4629-9564-385e3bd8f055", "value": "macuifang_only_criminal_regulatory_request_HIM_AUT_ZhuhaiYuheng.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc98a0-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784022276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022276, "uuid": "f98c7d09-9233-4da0-83d4-18964639be6e", "comment": "Malware payload (SnakeKeylogger)", "value": "2d6d6162ab898b7ba14d2cf76427c4ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022276, "uuid": "9151c91e-0ed2-44a2-9976-ba73c9e89908", "comment": "Malware payload (SnakeKeylogger)", "value": "233e22ea1259c85e521ab9ec1f92ad3c95ac98433e0bcdc5b7c21888ae8317d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022276, "uuid": "c20fb1ee-09a5-40b0-8875-1377f76397cd", "comment": "Malware payload (SnakeKeylogger)", "value": "a5b1e0a6d9d13918e185a70e8830ef8ef9c87428", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022276, "uuid": "fffa11e4-9d58-4fbd-a03c-af44c1bf6795", "comment": "Malware payload (SnakeKeylogger)", "value": "ebce6479bd3f65e8e42dce879b7486b4e931786da1e0b2a8b337a58e28da7a0704b800a0a4161c09a2fcbf559285c714", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022276, "uuid": "e12afeb9-fcf2-4cff-9411-ca86e8a90cef", "value": "T1B8435C0A91FC44B0500EC305FE20D80CA905D6B68DBA1E2A69577BF1FBB5A370BD7769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022276, "uuid": "840aaa0a-8188-4faf-8aed-5cb00bccc5cf", "value": "192:UKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKdce+9:kcTPDwUWlFkgsJu3T6pVgADPFmEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022276, "uuid": "42880246-57be-477f-b10b-3255b81c3cbe", "value": 57282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022276, "uuid": "57e3a1f5-2e4b-4fd2-82ca-68b7e4df417d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022276, "uuid": "8f00a461-86a4-4d17-81ef-e13584d0782f", "value": "PO#94002191.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7c2b77-7f8c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AMOS)", "timestamp": 1784037547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037547, "uuid": "fbe6e523-c6a8-4bed-8e67-0d5cfc54742c", "comment": "Malware payload (AMOS)", "value": "057e87fb81fe57fc6bcc006a6cffa2be", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037547, "uuid": "cd8aef04-2cb1-4cde-8de4-5c0047ca1200", "comment": "Malware payload (AMOS)", "value": "23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037547, "uuid": "495c3444-8f91-4d0d-8b6b-512ef26a23ff", "comment": "Malware payload (AMOS)", "value": "3bc874603ab271dddd507dcdd201d0a4a05606db", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037547, "uuid": "a3aeaf48-a3a3-4f30-93d5-9b0d9bf04f83", "comment": "Malware payload (AMOS)", "value": "681bdf392d05223039fd7084c7d5865eb4b58ade9481216f5200e8e092800be9b75413a3b390c5e88b29364486389ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037547, "uuid": "22c3f2ef-1d97-4514-aa58-2d58d160dd33", "value": "T138747C5B263D16B0C4CCF27855875F2FEB24FC151470A36A4F44AB249EFA3669E0A31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037547, "uuid": "98e960d1-24f4-4507-8545-576fb8f3f621", "value": "6144:8df1hQZ4K/5Oj8yXQaPHm+Ol6KwNQhjeyHL:8dNWjVDafmHw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784037547, "uuid": "9970fe11-d989-4ea6-91af-af6c00cc18c4", "value": 356496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784037547, "uuid": "cd3a0411-bcd5-478e-91e0-201fa4aa5b68", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037547, "uuid": "20e5f8f3-d0f4-4854-95e1-09121c0e0293", "value": "AccountsHelper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85fb282-7fc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784061079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061079, "uuid": "a4d05f66-3854-4999-af8b-7a8738485720", "comment": "Malware payload (CoinMiner)", "value": "f4027e98c618c01beb38ae402cc15b6b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061079, "uuid": "51c72f6f-6952-47ba-a6b9-3d30cd85d8f2", "comment": "Malware payload (CoinMiner)", "value": "246dca0b1a6195c4c6fb26bcb9b31aef79f1af5f8e506007715d53c794051d08", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061079, "uuid": "b88a7102-0d77-4277-872b-fb2a6da9b5da", "comment": "Malware payload (CoinMiner)", "value": "75d6e27fc673f8d776fb8d0682a5cc96e1414ef8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784061079, "uuid": "b9444839-462c-4152-8a37-26f803e722f6", "comment": "Malware payload (CoinMiner)", "value": "064a53c518a713790e24d06f4a01e3a136f819b4d6058b91b800aa84efae0d23650637f88a4bd1cc5fa3a4e53a3b3681", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061079, "uuid": "5bdb8523-8af1-4ae1-8ebf-853517d11e73", "value": "T1CAC533E5B0801BEDC351587BDA88DE396B5B74EA176270C3BF93531580642E0B378A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061079, "uuid": "b6409a08-7dca-473d-8161-fe0434165c62", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061079, "uuid": "30eaa9ea-de74-43e6-bbb6-827392cfac6b", "value": "49152:qtYsSZ/XS3k1qG1K4T4u+HaG76gsRSh6QwGmd5S:qtY5Z/iRG1K41+HaGWlSKGm7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784061079, "uuid": "7e9f806a-92b2-425a-9e85-81bba6d22d6f", "value": 2673360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784061079, "uuid": "79f2df7b-008f-4df8-bcf0-edfe7a63c981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784061079, "uuid": "c0e22cfe-962b-478f-b899-3f476f25948a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9450d27d-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "73abd0cf-fb55-41f3-8cc0-8312811795a4", "comment": "Malware payload (Mirai)", "value": "ec4ee344d6611f517bac03876d89ef52", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "4d830a44-5639-44fe-986f-564ac22000c3", "comment": "Malware payload (Mirai)", "value": "24876bc64019074d3356ccfe52d7839b7ffba67af2f3900740f494f2ea000ee7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "3d30a493-3f44-4253-8952-e17792f7c8a6", "comment": "Malware payload (Mirai)", "value": "51d9b615111e1ccd468d9791f02eae8ff7cb19c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "5d6a6451-2993-4d42-9b76-3c05e74a17da", "comment": "Malware payload (Mirai)", "value": "d8eddb6de4766ae0dd80dd7ef571976ac1f002d14bc33a38dcf91f40df99cf2991a8c1f6fbc2e9455ce15949fc51c3b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "bffcef1b-5d98-499d-8c35-6d24bca82b8b", "value": "T125E30A46B8818B12D5D111BEFE1E128E33231B78E2DE73029D246F65778A9BF0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "d1f27505-f16d-4f72-ba17-a00c29f92773", "value": "3072:60WNcRHpUC2thzX3FTn4yaWDXhJW+DYug9:UyRJRozXVTn3agTDYug9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011948, "uuid": "6b27a63e-fe91-4da7-bc4d-1a238ad7baa3", "value": 143836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011948, "uuid": "d94000c0-a9cb-4900-814c-ed169888c601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "6a545bcd-fcfa-4ee6-b63b-bf6f17ee50b8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c0061b-7f34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783999809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999809, "uuid": "4fbc8e97-159e-4c6c-9229-20d22e5c1c52", "comment": "Malware payload (Mirai)", "value": "2dc0768b02714eaa0e1050772cb8bbe3", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999809, "uuid": "143d4504-f490-4f3a-963d-ae5b765f51f6", "comment": "Malware payload (Mirai)", "value": "249d3ed7abfde1173249b693c7f64b7c7c6b6dffb11277e205bccff88447feae", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999809, "uuid": "be8d7a8f-34f5-4383-973e-997c7dcc5833", "comment": "Malware payload (Mirai)", "value": "85ff2c293c1dbac90159712420a4ee410358f12e", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999809, "uuid": "0e31626e-2ace-4a17-bfcd-e8c849fbbee6", "comment": "Malware payload (Mirai)", "value": "52232b82f9921cab91b6811c4005d9f0a5349b4bb485529b44b246b0c624bad335333d1c20983e1643818cf9c0e26845", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999809, "uuid": "7a2d17c2-20ae-4f17-a776-9c9594059d9d", "value": "T1AB115B84056449DEEE138E44F76740C8DA4942E7FD83BA2AE5A1056AE45CA38F6DE6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999809, "uuid": "ed68fb8e-4c6b-4c6b-bf60-8ae561352e42", "value": "12:MCQe3W7W2xrWDLWUW1iW47iWOW5WDfKMiWeNIycWAAa:HBG6PDqf114ZRAzKIeNIau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783999809, "uuid": "c4d7b593-c22b-49d1-bad5-be352387c7b7", "value": 933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783999809, "uuid": "cc3f2ac0-d99a-4d14-b0a3-b9d6b39ad54d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999809, "uuid": "e61104dc-673c-4bf2-ac31-a87c2d00200b", "value": "249d3ed7abfde1173249b693c7f64b7c7c6b6dffb11277e205bccff88447feae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20242546-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784022491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022491, "uuid": "0656c1ed-5e90-406a-b1e8-816cdd2ae767", "comment": "Malware payload (AsyncRAT)", "value": "be420d1bc6072f9e538a4fa510d7505b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022491, "uuid": "44fe2cce-8dba-407e-b07e-bfaa21362d41", "comment": "Malware payload (AsyncRAT)", "value": "24ae9a43b77aafcbf4fb08285ab0fbd725fddf2611f1713ab1a7c1097ecaa3db", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022491, "uuid": "e3a3d912-1418-435e-ab5f-984f664e2c06", "comment": "Malware payload (AsyncRAT)", "value": "16d395f118037cebe06e3219eced18ab2b6fb9ec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022491, "uuid": "a397034c-6e54-4bac-bd25-db59d12cb8c7", "comment": "Malware payload (AsyncRAT)", "value": "b1f5a4ca11fa1183268491dac06721ce4b5aca854d3d8c6d3d40b3be5f9dbea1c15483cc8068edd4500f4c5aa06e2287", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022491, "uuid": "51f50e28-42c4-47dc-a8fe-4387331633f4", "value": "T163A185462DA01761009ED6F36A45A286FA4D927F0540BACDB8CEC14C2F2D1F6C5FEAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022491, "uuid": "c9c88a3b-6fe3-4551-8a60-22911d46aaf1", "value": "96:ae/XkFF0EGYsNpRS4hisWhLhWhLvWhLHCPMODbdF1uMYw+fkdbE0xS:ae/UF7mpjZGQoCPLA5ZkdbEaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022491, "uuid": "20d9926a-5302-4728-a816-50b3907cfd16", "value": 4654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022491, "uuid": "d6ed57cc-cb13-4132-9bf1-34d12b404a51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022491, "uuid": "9b541d92-851c-431f-bb72-649284475101", "value": "fjkdhjdskqke.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d912e2d-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046565, "uuid": "15936e79-a597-4617-9cf7-c1913d0e0adf", "comment": "Malware payload (ConnectWise)", "value": "7b6b7be273f8c409f44fd94655b3e6cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046565, "uuid": "c728beaa-2a71-4ebb-b70f-a5c5de32704c", "comment": "Malware payload (ConnectWise)", "value": "24cf9f32c1e3ebec5e810a865ad4acdcd28669d4b548929c8e4a962d77e44b1b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046565, "uuid": "bd3e4df8-2361-4d99-b434-a2975424ddf7", "comment": "Malware payload (ConnectWise)", "value": "24e62aa365df0031addf76831f231468b7b8bef2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046565, "uuid": "987fe1d8-f8c7-473f-8c5c-48294017a230", "comment": "Malware payload (ConnectWise)", "value": "1e281aa395d8567d23b1ed583db7f2187e15f2a4ab4c175ebab513280c905f6745fce1834e361b48887b36a1a9c150fd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046565, "uuid": "ddc3a684-3b88-4f47-962c-44e32b5fe820", "value": "T1FC646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046565, "uuid": "e4d71be8-879f-4c4a-82ad-228f3c7697d9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046565, "uuid": "cd92f356-0922-43d5-b242-ae701a2fd1d1", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046565, "uuid": "6965ab85-66b5-4a3f-a032-b455de33d006", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046565, "uuid": "a7dcd768-29a2-4b41-afcb-5cb35d6df024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046565, "uuid": "e1d25282-f90d-451b-a8db-c9a9be39ef69", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad82479-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039715, "uuid": "e79e75a1-4848-4802-a9fe-0f329e3be2b9", "comment": "Malware payload (SilentNet)", "value": "b8292d25ac77562dade74fc572d2545b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039715, "uuid": "cad624e6-4f29-4d70-a217-751c7e730a7b", "comment": "Malware payload (SilentNet)", "value": "258aeae198f6d5809f8f33e53137ca719864eba90b20da0f52fd488de5fc4f6b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039715, "uuid": "731ebb7f-dca3-4a15-8fa5-b13ae6118db0", "comment": "Malware payload (SilentNet)", "value": "fda4e0cb9a0cee67bb355d11d1d2828813d48717", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039715, "uuid": "ae7e7333-5b82-4b4e-9923-3d2cd8566296", "comment": "Malware payload (SilentNet)", "value": "c4674009a17f6bd53a8e0170d75b336ca16dd6bb05653ac1451d0c915731a955ad6969aecb7d141dd0fdd548978c13f6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039715, "uuid": "c664ab29-4beb-4ed2-9043-c82d02cfb2e3", "value": "T19FD423C3399E0D22C591C2B49C16D7D1F46827569A8618B10CBDB35E8A37ECF18CBA7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039715, "uuid": "0810dd1e-3b9b-4003-9fef-57cdacd5cb5a", "value": "12288:1rAh3KvOgCAGsp3P1GOXm3AIBaCTcp9x1MCVQSnNzLCsVLqQDXq:1rAlKvgOpfvGfedMC5NzLbLtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039715, "uuid": "e033f668-acea-4fa2-a633-8924abd34fa1", "value": 611518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039715, "uuid": "e7ebeeec-9314-4071-94d2-d21600ffb3a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039715, "uuid": "9c75d4b4-93a8-42f2-8176-4647381a2287", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72145ae0-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022628, "uuid": "5d77b126-ae5e-434a-a017-6c7b10538492", "comment": "Malware payload", "value": "a7038c869059b0f49aace92231886a41", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022628, "uuid": "3c0c48db-b691-49f4-a2f1-043fe8727fd1", "comment": "Malware payload", "value": "269652ce5fe08e21c766a9fa4ad9494ba746b6e397f322f87cbc028b95c9545f", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022628, "uuid": "c92b2b2c-3992-4e72-8bf5-741dc717e928", "comment": "Malware payload", "value": "cbbd9f493b33abae8c6453053fa2f2df626ba4b6", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022628, "uuid": "73236e62-5ad3-431b-a2b7-f403390464b1", "comment": "Malware payload", "value": "8135a838277cae59ef79da2616d859045aa00459bd5634c58b0d07987d142f3c3b1a597cb4aa9b21a26ab04ba75cdd84", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022628, "uuid": "fc64528f-1084-4aa5-82ea-3036574af702", "value": "T14DA1229AFF809C21CD18067AE98E07186321EB65E0E6FB17DA485F515E8F2AC1F641C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022628, "uuid": "8a0f2ab1-700b-44ac-bf0d-6a63683235e6", "value": "48:1eZI7G5qKkY7RrzZCBrDOX1bLq3tBcV9dODKScvq6Ee:1UkG6DOlbLWtBoNvq6Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022628, "uuid": "64c551f2-b9f1-484a-b054-8c90dd0f60b9", "value": 4856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022628, "uuid": "6dc017dd-8a16-4de8-bcdb-45fdec8d9cc3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022628, "uuid": "d7447f72-e8e7-4c12-875e-95c608bfefca", "value": "269652ce5fe08e21c766a9fa4ad9494ba746b6e397f322f87cbc028b95c9545f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9566374f-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011950, "uuid": "1fcafc19-d1af-4d2b-89c1-51a746316d48", "comment": "Malware payload (Mirai)", "value": "e5270a91dcc405111c7ac74cd9d9f881", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011950, "uuid": "fa4672d6-ba82-4f5f-955d-b94c89dbff73", "comment": "Malware payload (Mirai)", "value": "27e3ef2a0cd6661917ca39642b160a66f49f9288d8131f32c991966c992e5109", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011950, "uuid": "3b38ab9c-0087-4dc8-ba4b-5b586bb5d5d8", "comment": "Malware payload (Mirai)", "value": "5d14b99cef5ac78873ee7991edcdce72c75bbea5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011950, "uuid": "70558087-f5ff-416b-8f53-b909431eb84f", "comment": "Malware payload (Mirai)", "value": "80b4c428d10e2b1be3e91a9a091e63e20d350f1ded8fe98f98b28a30867aa8b7e7d4c686f31aa9899ea9b5b04d5efac3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011950, "uuid": "4aac8f38-7079-4860-830a-e7f6c9750742", "value": "T170E33BD7F900DDBEF80AE33748130909B230BBA154925B372257796BED3A1991973E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011950, "uuid": "27baf931-0af5-460e-8b0c-f73ad7cc4c45", "value": "3072:U2yOp1f5JnVy4b2y6Xj0fewoCiW/rjY6dfVxjbiJL8Zhgfa:UPOLs+2y6T0fewofWo6diLlfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011950, "uuid": "7fdee3cb-0ffd-4088-96da-ab45a22d9841", "value": 150272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011950, "uuid": "bdc878ae-4340-4c43-8c3e-fc08c2c8fecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011950, "uuid": "4869c131-b3ee-44c9-9bf2-4197bd85405e", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55bdd28-7f3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784004729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004729, "uuid": "f6acd06f-2920-4793-8f3f-5866322ada3f", "comment": "Malware payload (Efimer)", "value": "c8882a903137e17caae8a542aa460e64", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004729, "uuid": "12840033-2571-4d15-9b3e-e09f7fb5e4b3", "comment": "Malware payload (Efimer)", "value": "27e86594b78358d7c9f7440d4d7f7f5e63e7dd43cd6bd5e55f2f6072754ca02c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004729, "uuid": "49951489-6d56-4f87-9e8a-ca7883a20619", "comment": "Malware payload (Efimer)", "value": "bf03dd36e9419eb8630dcba608febe5d24ffeadd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004729, "uuid": "178fd900-6dca-4c8d-91b1-40fa10395e8d", "comment": "Malware payload (Efimer)", "value": "68c99df23033fea33cb4c0fa242efc88fe9bc371c5c074387708c4572e09c8a596907c42b21c8de4d4b923334d52d92f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004729, "uuid": "291d972c-986b-4a24-8fed-656932320038", "value": "T189E633286AD813FEEAB26278FED0A582D0A974B14733C5DF0B7C96726D530E05C39653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004729, "uuid": "c4f9617d-41e9-4fba-8696-9adf6519a9a9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004729, "uuid": "3aae97eb-e109-4f6f-ac6b-c95452267e98", "value": "196608:8gvVptX+wips+S7x2vIpXwGmRAfXMCHGLLc54i1wN+MCpPIcu9KYK39sI3PPGTMj:8gdp1+MDQIXbXMCHWUjXGcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784004729, "uuid": "9652586b-8b94-4d66-a902-1068b468ad70", "value": 14300654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784004729, "uuid": "4b4d00ca-30f8-45d8-8a0d-cae7060fab2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004729, "uuid": "22443774-91e8-4e9a-a351-9a29ef45f5ef", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba21af1-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012175, "uuid": "b6603c48-0552-491e-9e86-2f33e688543e", "comment": "Malware payload (Mirai)", "value": "cf9bb508705ae6672d955edeace31544", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012175, "uuid": "2a2481d0-2aa5-417d-bd54-98cf7b17358d", "comment": "Malware payload (Mirai)", "value": "2841cccb41096bef9bb0c86dab63baa2f6e7e127ce1695866fbed031a063aab0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012175, "uuid": "b7ddf45f-24d4-4533-a6dd-c98986bcb81f", "comment": "Malware payload (Mirai)", "value": "e2ab1feac3d94652d240c416a93e47de49995cb3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012175, "uuid": "55c1a9f3-466a-4465-9204-2a87eb80f506", "comment": "Malware payload (Mirai)", "value": "52c6dd4dd0b209f954c1c0c62529a6c90acb7d22f03e576c34707806de896a3e443c2806957a3ec0e725d7a218d314bf", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012175, "uuid": "fce445f2-d543-4d6d-acbe-af6910c58faf", "value": "T10D030130E26F5EADC7382C31FA2DE68907A62B5D418D34A812360634EB19DD99D3CA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012175, "uuid": "4fcab4d8-4f2e-497d-a4f1-180352713625", "value": "768:0fZ51zp/LyPSwtdtNZ14n59dWAyMW01MUb+XQFNoDeC4S0KKECWats3UozT:0/iA599yMdM5XiOb3owzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012175, "uuid": "718182b3-6b0a-4b76-9baa-063ab62a4252", "value": 37660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012175, "uuid": "72a3cac2-a92e-4685-96fb-bc6966b545e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012175, "uuid": "139cf388-33df-4937-9f20-5aa7f9d2f904", "value": "zombie.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02032254-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022011, "uuid": "f1ab7cc1-b531-41f9-bd61-d50ee7d6c4fc", "comment": "Malware payload (AgentTesla)", "value": "578a549be9926fbd8016a8ff8ec0636e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022011, "uuid": "61120e62-5a12-4fdf-b5c9-2a4629e76013", "comment": "Malware payload (AgentTesla)", "value": "284ad50e9107b510ea42440c143b96f88fc30b524f325e4c450f659871438475", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022011, "uuid": "1c46035c-1311-4331-8610-4b0bfbb76208", "comment": "Malware payload (AgentTesla)", "value": "7c61077ca3c1d12c73e308b2a674212bab4bf88b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022011, "uuid": "94b6e14d-2fc8-41de-9eed-fe440add1a93", "comment": "Malware payload (AgentTesla)", "value": "a99e1152e730def8578b63aa1c1c69aaa2304a20ae3cf41226d145ca230e5f795417484b322438e00ebeadff91b8c263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022011, "uuid": "281e5962-6f36-44e1-8a9e-112b79ef8304", "value": "T12B3400027F88E715E1A93E3782EF6C2453B2B4C71733C60B6F49AB6524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022011, "uuid": "f9449702-d721-4f10-8a96-c435c953cb75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022011, "uuid": "8e005833-1ef4-41af-bf0c-38fcf5da3b1f", "value": "3072:I1Bayiq6lEAKt9sOW1IkTHo9rG8KaG5jnThnq0ufzz:4ayiq6bA+Zsq8KaWTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022011, "uuid": "67023db4-c245-4f3f-9880-28c4ab24b757", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022011, "uuid": "fd3e3606-4778-483e-8c17-81d2f9be9c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022011, "uuid": "8cc1481b-a054-4def-a106-83914eafadac", "value": "284ad50e9107b510ea42440c143b96f88fc30b524f325e4c450f659871438475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d72164-7fce-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784065926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784065926, "uuid": "cfbc9cef-a809-4d07-8055-4cac31a3f16e", "comment": "Malware payload", "value": "265b041576785229f47cb65c8c292dc5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784065926, "uuid": "b871d0a4-951c-466e-8ab0-a04b8d5efd2a", "comment": "Malware payload", "value": "2892f77e6c5389ba707efd4e12024e309fc4d9994a0747cb80f0cd0cea507c0b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784065926, "uuid": "09e05ee3-efdc-4751-9cc3-d4e0c9a9c040", "comment": "Malware payload", "value": "634d94966d4ab324a8c1b54d76f04696f4e39cb5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784065926, "uuid": "ebd5d8d4-6854-42c4-be3a-478e8355ce92", "comment": "Malware payload", "value": "7c0cf9c842d4b960f7e24088378ce9ace1bba4839d00d39333cc849c61424de86d1c6efc62cf3f22c1f922f2be5e2dfc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784065926, "uuid": "0dd5a5fb-0082-4224-bf69-a8f9c6647e4e", "value": "T11EE6331897D006FFD573903CEAD35665E09838A24F31CBCB4F6883A99D6B3E0553A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784065926, "uuid": "db8e921f-edec-4595-9ae6-7581721061d6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784065926, "uuid": "ffadeb1f-9256-405d-b8fe-a63751f5f5e8", "value": "393216:MbgKd8zciqvD11WwCSQnXMCHWUjXVcuI3/PGTAI:MEz4isD11unXMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784065926, "uuid": "570d8ff3-f8df-49b0-bc77-f549edf17df1", "value": 14275738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784065926, "uuid": "d80e213c-aac5-4ee0-a74b-56824434076f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784065926, "uuid": "f0a8824d-acf6-401f-b722-aa1ba7736094", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3310e4ab-7f9f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784045715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045715, "uuid": "7c7fdd22-6bf7-4fd9-a256-f400ea6c167b", "comment": "Malware payload (WannaCry)", "value": "f6e76ba53c968b6c967b618fe1788b0d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045715, "uuid": "7fac66a7-1d4a-4645-9bcc-93b3c61ec4cd", "comment": "Malware payload (WannaCry)", "value": "28f28077680c530e9d4278cecf0d8a9ac0682ed63bf9ee1d6a90cd18b88e67fa", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045715, "uuid": "f5fcdaca-4114-412e-80c8-61bc8d453ede", "comment": "Malware payload (WannaCry)", "value": "a62e579ffd189f9a7c4e962b7a517dec7561a10f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045715, "uuid": "eb9af9a9-85d2-4375-87e0-c3fc3762e4ce", "comment": "Malware payload (WannaCry)", "value": "69abd6408f50435f7bceaca7e169d988224a30efafd49efb5074a943b6e7c23c0ec6e0333955bc2d696506837cfb5b40", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045715, "uuid": "cdf2660b-4981-4d6c-9098-eb54579c5f1a", "value": "T15E36129932AC80FCD4165274D4B34E25F6B3BC9E12B9870F97948B6A0E13391BB34B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045715, "uuid": "199bac75-1896-44ed-aaeb-363f739278c4", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045715, "uuid": "cdc9c41f-9b3f-4a83-aedf-49fc15a3e024", "value": "12288:jbLgD1bLgmluCtgQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLgBbLgurgQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784045715, "uuid": "da7639b1-9342-45b4-afdd-f0d85b593b9d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784045715, "uuid": "da61bebc-34ce-44ec-ad02-eef631745b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045715, "uuid": "a5fcbcc1-cf84-44a6-9eb6-3c3922b75fe8", "value": "28f28077680c530e9d4278cecf0d8a9ac0682ed63bf9ee1d6a90cd18b88e67fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb12e28-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784023966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023966, "uuid": "3b7e7667-bb3b-479d-b012-f6c651c31903", "comment": "Malware payload (XWorm)", "value": "f401e3cc7fa5ca9024fb9aa46df82012", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023966, "uuid": "15903a30-e19c-42f0-bf84-86e5df91b92b", "comment": "Malware payload (XWorm)", "value": "29dc8542e97e280e6e893ef5027eb205dc786f3e376daa4b1be01bda67125013", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023966, "uuid": "014168c0-4b02-40b9-8863-a12decee68e8", "comment": "Malware payload (XWorm)", "value": "b02f7127d2ef7a8bd669772263841f74ca5ddf4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023966, "uuid": "3fc3df53-ad7c-4ca0-b154-86387b43fae4", "comment": "Malware payload (XWorm)", "value": "42d882517e0c2c878f84d68d2fa1ee5a406b304cbb5b4687f2be57fca735b2357bc03caf22d9757ac26a885b5d143207", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023966, "uuid": "4bdc8f1e-d227-42b8-9829-edd75cb454ec", "value": "T1D89522B93B94431C48FE2F6CB9DC3A49FDB9B3FC4C4A65483B1256806272D89A617C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023966, "uuid": "b72b7203-1573-4c96-9341-b205b4656e88", "value": "768:pt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3mt3x:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023966, "uuid": "b4cac0c4-b725-49d8-b47a-7a660178f3e4", "value": 2024585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023966, "uuid": "ff6d39c1-4c0e-4fa5-9266-9e57bfe123ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023966, "uuid": "f1a66ca4-66c7-4dd9-8094-bafef925b18c", "value": "Proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb31f64f-7fc7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1784063231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063231, "uuid": "2071e20b-e35a-4a66-ba1b-80d364b4a951", "comment": "Malware payload (ArkeiStealer)", "value": "988676498cc49e5b9e8d4c741dd38bb2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063231, "uuid": "5648925d-e93c-4e52-bcfe-7524c5ef24bf", "comment": "Malware payload (ArkeiStealer)", "value": "2a19ad3ce75c78d58025e0f4612f3d950f45afb4d8c11d7470642e554459a453", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063231, "uuid": "aaad2b65-2f65-4afd-b545-c2e00cc00f91", "comment": "Malware payload (ArkeiStealer)", "value": "57e458baa3567d75981318582882d48065067a03", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784063231, "uuid": "c08ff78e-68f9-4b01-9b2b-1db801e90595", "comment": "Malware payload (ArkeiStealer)", "value": "eb37156b11321d2d008d6c46decfd9c06e5cd93d3a340a6361eed234d7c0518e01eff14dbbc67c25a8aebc30704f5db1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063231, "uuid": "3f7c201f-eba7-45c5-b416-1e6601b67516", "value": "T1B8B5418ED68207B5F3DAE777522AD62A5DF6314580728A31CF463D354F0BE206029EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063231, "uuid": "a44de8af-332e-4c2d-bc72-46b18a2d7da7", "value": "12288:0judCuw8n1Ed4CG7qPGXMASMfcD9V0krO:0co1d13d7Sky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784063231, "uuid": "b8df4366-98a7-4ee4-a7a3-88680851d06a", "value": 2302956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784063231, "uuid": "d73b4c00-c796-457f-b991-64579791c7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784063231, "uuid": "fefb8d0f-bb32-4af8-84a8-9a6830e7d84d", "value": "Order-269916_71038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333daf11-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039703, "uuid": "2ae47452-6c1a-4b9b-a6af-74d1422fb66d", "comment": "Malware payload (SilentNet)", "value": "fa7ba124665c50ed72f74bc41ef88adb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039703, "uuid": "28d47f38-f465-4e6d-9edf-c7a861b36ca8", "comment": "Malware payload (SilentNet)", "value": "2ab7bda4b0d3f5d5fd9d9bbf56733fb4162774a464b5acc292cc0a6fa5b37e2f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039703, "uuid": "b2a9b89a-295f-40b6-a04f-212efdebe7e8", "comment": "Malware payload (SilentNet)", "value": "9653b7a96505b29d4404840e4ceb0760d3293336", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039703, "uuid": "bbdb7302-4c72-4a97-97be-0fcfaf067918", "comment": "Malware payload (SilentNet)", "value": "75a42278b39f1c5228c1710440b2581fbd10ff50593fb2e35e9c0c26af9ac68bb0300244ae993d218d207b7723d03ae9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039703, "uuid": "ef1d30f8-6033-4c9f-a526-102bff69c394", "value": "T10E260105FD1E1475F103B3754BD12F2DB9BC8290EF0AB1AA2DF188829AF15D68F79216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039703, "uuid": "11483691-3fd8-4b51-b78d-ed4f9941ebeb", "value": "98304:4ddTAXqfDmkLoHXGBbaclgUgqsb26z3iK40z5zm+FvQX4QMq76Gz1:4dd8qfD/ac9siy3iI5zmQ4XEk9z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039703, "uuid": "248ff80b-dd58-4c89-941b-7ed18112be28", "value": 4549835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039703, "uuid": "9d036bef-2526-4031-b0c4-37448d72dd18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039703, "uuid": "05405d1d-ef29-4f96-90fb-434d266f9607", "value": "prestige client 1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f72728-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046572, "uuid": "dd9f6931-4fcb-48e8-a3b8-4cecb64eddb6", "comment": "Malware payload (ConnectWise)", "value": "1002b1cb400c7198c2c72b2dd6dfb029", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046572, "uuid": "8c77e3c7-0398-4592-a4cc-679c655f4ed9", "comment": "Malware payload (ConnectWise)", "value": "2b5f7211a6c98dc9302023024cf7e11e5360314160a6b291f74350eeb46c072d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046572, "uuid": "7e832577-2ea2-478b-9bfa-6c5818ec357b", "comment": "Malware payload (ConnectWise)", "value": "fe327af001f6ffb002f053c3a03e15cca1384a1e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046572, "uuid": "afff753d-0985-4c1a-8e2a-dd308d4ebacb", "comment": "Malware payload (ConnectWise)", "value": "f4455c492aac31a3eaf0b03677c56fe3573b3662e8a0b94e6b7b8a93cf4bb61937c1f7c981832f9d45a3d27c2c7729ee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046572, "uuid": "c118d8b5-063a-4a62-856c-ad238c867fcd", "value": "T1D0646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046572, "uuid": "25ff20d7-bd5b-41a3-a729-47f5171b394f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046572, "uuid": "705a16bb-8cc2-405d-a59b-6d78cf263f5a", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji90:B1iw7gryNkSV1hy1Z1u2JLu90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046572, "uuid": "3159c9f3-cf39-4e8c-ba6d-3083d67bbc45", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046572, "uuid": "8b700cf0-1f98-4d7f-ad52-06bddaf4a24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046572, "uuid": "af3bf5c7-e9b5-4aa9-9a22-98d215b95f78", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c30f0bc-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039718, "uuid": "5fc033af-46d6-4c2b-a80a-3d407bb96096", "comment": "Malware payload (SilentNet)", "value": "2e935b75899284063bf1ae5e7a21f147", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039718, "uuid": "bde138d3-1702-43c5-a93d-a3be9498cfc0", "comment": "Malware payload (SilentNet)", "value": "2bcbd9cb45c30b298f13b2a56e6d5a3566d22f9633c30d4249ac218abbc01fea", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039718, "uuid": "71763291-baff-4db6-968f-be476a5b9039", "comment": "Malware payload (SilentNet)", "value": "da61810ed2fabd038064ba86fe52d1f377a18424", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039718, "uuid": "febef61c-8a7c-407d-a2e9-729643b2e470", "comment": "Malware payload (SilentNet)", "value": "4e72f1e2c370ab8f8f36992ec4c6bfd20013c4513c2db768f791882a0ffed17f4cafb9c82b07643a0c8945896aaf559d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039718, "uuid": "6152add6-1c0e-437a-b8f5-421c50462dd9", "value": "T1821533CE9872DF0E985945357466F3D6B1A65018B8CA16CF2EF80A57B03B8E94017CBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039718, "uuid": "4a6f227d-7f61-4309-ab0e-19dc644d78e8", "value": "24576:/YMGTVXQdFLUcPrTgddIW8n2lrpsFyg/WrHF4OC/x7:/XGtGFLpwHlPKWDi7/x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039718, "uuid": "6747266f-304a-44a2-a359-bd22fdaa3a25", "value": 942032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039718, "uuid": "e42ed086-d7d5-40f0-bc5d-5e6525a6659b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039718, "uuid": "c64dbea4-f8a9-43ba-bd3d-f842db6a5f45", "value": "DE-spawner-protect.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4945909-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784015438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015438, "uuid": "0c03ea46-14f3-4f1c-863c-39d8ea08d54e", "comment": "Malware payload (Formbook)", "value": "0a32fb4d8ab573dcbbd0da5b61c2b69c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015438, "uuid": "60c0bff8-aa45-4856-88ce-8aebf42e2144", "comment": "Malware payload (Formbook)", "value": "2cdedb9e87b19f3da82e49563e2f3ca9b1e9f4e195a89b2e60e24e380261e2ef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015438, "uuid": "1586ae5c-1d1a-4c9d-be58-34387f35b041", "comment": "Malware payload (Formbook)", "value": "39da89799658efe2d1ca4d5b7a37ce92fabfc857", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015438, "uuid": "eaab5a07-e6c3-4d0d-a66f-146e0cf7d65e", "comment": "Malware payload (Formbook)", "value": "1e5aaf3c9ae2f3f8788f5957f47064e71f99793454c4691f8ee8cbdd3001f49f4e187d8397ad79b80d11f0218ea5a5d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015438, "uuid": "6f4ac65f-6532-4b6a-8bac-f8b0e0983a5e", "value": "T141A533013D7F6B20D90D01F8968071AAD1164B3EF391A25FBBF3750DE89326F6A4985E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015438, "uuid": "d0b691da-f237-4dee-a51b-dd6893127854", "value": "49152:BEm8Us/OhLFTTAaXY2Q27vryTISHyc7229hqpiHP65yhj4SdlO4:f8Us/OpFTTAsQ+zyTISD60E/4hj37O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015438, "uuid": "409e238e-538b-4169-b33f-fb68681390ef", "value": 2220315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015438, "uuid": "66b24d5f-1155-4136-9a89-af0dca715d83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015438, "uuid": "7516eebd-5e72-4b40-bc8a-30c786590716", "value": "New Order JU142026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30efb18-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021986, "uuid": "608a9411-7fde-4bd7-aa3e-51d42b8a72c2", "comment": "Malware payload (AgentTesla)", "value": "ef8f13b261d94fd7723c1063ed3775d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021986, "uuid": "44453ed3-c13c-48e2-b8ec-e0a163460ebe", "comment": "Malware payload (AgentTesla)", "value": "2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021986, "uuid": "9b799571-3cb4-4eb2-9886-7ebf0222dc7b", "comment": "Malware payload (AgentTesla)", "value": "86e9ff3bb8ee40ce38d922ff74d78caaea98fed7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021986, "uuid": "36a21bd0-9aeb-4c48-b3ca-7885a6c2ebd1", "comment": "Malware payload (AgentTesla)", "value": "8a518eaa1188492592a9cdc4c394998917236de31b6063c0555f58ceeadcb234892de8bde756ea6c1a65a81e892a54b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021986, "uuid": "e942587d-2fa6-4194-a354-c64b5a624d99", "value": "T1BEA5339BEF32275E6C55DC598B23722C8834D8360FF5331B7915C2091AD6BCA99F2D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021986, "uuid": "2d6d8e5e-0947-4408-aa2c-c214b9437ae6", "value": "49152:TEteX6dhMO/Q45zEnLkUlqt4gVg0zrejccDkLaE7cC05CcW:TeS2FQMzEwUIex0mPkv7n0ocW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021986, "uuid": "53fd929a-d07f-4098-8f41-9ff273dedf83", "value": 2267593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021986, "uuid": "d5e53c87-616f-43b1-8315-46bac5f91e2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021986, "uuid": "6e2145a2-fcaa-43a3-a898-44dffbad4b92", "value": "2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1885d7-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784023964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023964, "uuid": "e6ce2788-9618-4698-8b33-6bfd855065db", "comment": "Malware payload (RemcosRAT)", "value": "54f4cf6b3727d603cebb39cf0be5b42e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023964, "uuid": "c858b5e2-799e-4c62-b902-afa979920998", "comment": "Malware payload (RemcosRAT)", "value": "2eabe71b18863d2044945eb371da1dbd5d12bc973538755b6177a235712db361", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023964, "uuid": "5de3a7ea-dbf3-41bc-9aa1-912445c01429", "comment": "Malware payload (RemcosRAT)", "value": "8db23da6fa743c8d532f5af922eb2bbb0301c15a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023964, "uuid": "2db21792-9610-4cb4-8b39-ea499c6a2b3a", "comment": "Malware payload (RemcosRAT)", "value": "200f87bbf8267c3650cadf2bd2e48e3b4d375beaa3760ba4305fc1bad2b56e33f8bdcb8346960cd21179093ab14307fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023964, "uuid": "539eb3b6-d206-4948-ae43-77b09295bd63", "value": "T151B57B47F3A347E8DB1795630E5BE085981D868277A3CA5EF025CB0A2509C4BAFE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023964, "uuid": "af9bfa33-f035-4fbb-ab74-12c51ab335e6", "value": "96:feoAZtVedtPJwAVqU/dvGkDL32SuwNfQonA0C2lMEBJR8:GoAFedtRNqU/dvGk8wAJKMGJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023964, "uuid": "a277f56c-b7f9-4d03-8f7d-6c6dfeb5bb05", "value": 2463124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023964, "uuid": "f0e9b3a7-d6a0-4799-9332-35ce97ed3609", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023964, "uuid": "4284fc60-cf87-4ff7-a381-108cf5162e76", "value": "RFQ-06114-INOX-00018590238-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75746953-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011467, "uuid": "bd779853-9f93-462f-a3e8-bc9909730c23", "comment": "Malware payload (Mirai)", "value": "c3ec29c533b1fc9e0f95278e7b032c7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011467, "uuid": "d39f3c53-357d-4457-8936-f14442e9f6b1", "comment": "Malware payload (Mirai)", "value": "2f267396d06f85cc0fe16c48dc0ddaa15a3c080a1d82209a1492067c249577a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011467, "uuid": "c8b7bb76-1aab-4edd-a344-c1933849b9fd", "comment": "Malware payload (Mirai)", "value": "81102550cef4af2e82e954fe80024ed83529f8a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011467, "uuid": "c9e5239f-df6e-45f9-bd0d-c74e22a3c7c8", "comment": "Malware payload (Mirai)", "value": "c68e78e73a9cc27090840c16e430ab8b0c0dc7098baecdd22fb55a88daed6efa09823f00a3017306650655077719a684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011467, "uuid": "feb29093-5b19-4ca2-b7bd-36ae895aef7b", "value": "T112A31989B891A724C2D216BBFE1F018E33134BBCD3DE735299145F64778B95B0E3AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011467, "uuid": "b25e0b3d-c8ac-44ee-b033-4d648d5e714d", "value": "3072:Kso8TokNwYuqBI8jaQcOWMIuk9yJralc7uL7fbVk2wH:7o86bqBI8jaQYXuksram7uiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011467, "uuid": "e0c101b9-33af-467c-8077-cbab285da6ab", "value": 100356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011467, "uuid": "a3fe7547-6442-4e94-a6fa-a3aad83213f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011467, "uuid": "98ba2a57-13d8-4e36-a1d2-c320ad7b63fa", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3bb2b9-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "649e72f2-43d1-4397-9c28-cb6b5b33fd60", "comment": "Malware payload (Mirai)", "value": "449094e0a776e0021f0d8d84fb70fb09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "7dbaa344-294e-4fa9-9da7-4c93a58b23d7", "comment": "Malware payload (Mirai)", "value": "2f777ec5735221f2292f89bb8004bec3d76d4a0c78386e95fbd6c58ea66fe70b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "ef1365dc-2f50-4092-af9f-8714d5175919", "comment": "Malware payload (Mirai)", "value": "22145a7a1e2819b7182b6caa99a8f2cfc88f0730", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "c6a19b89-31fa-4231-8daa-99604e48ac51", "comment": "Malware payload (Mirai)", "value": "1c226d89517c9db6bd2bca845c698e0a6837335799621e8fc94430593f6161b983dbb5a32befc9921e7057b263b3b16c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "f45e7064-4b41-452f-88a3-bb5b7845a621", "value": "T122935BC0F683E0F6EC5705B1A137E3368772E43A602AEA57C3695932EC91950DB1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "da66badb-cea7-4adb-abf0-582781047d92", "value": "1536:W0M502vLl2u28hzXvvFN0TlZwTvESBOKxgnTTHIClzgQS9flsT:Wp502zl2u1z3FeTlZwTv1VgnH7mt9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011940, "uuid": "e941781b-554d-406e-bb19-0a5414216758", "value": 90892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011940, "uuid": "e2211b05-46fc-4f32-94b3-73d445b93901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "7757783c-926a-4b72-9a10-3a5ba7c28e99", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74316c78-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012324, "uuid": "6349b765-9715-4493-b270-5a97b6c1eb4c", "comment": "Malware payload (Mirai)", "value": "b3fc8f1b1d03c66f85ca4224398d36a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012324, "uuid": "bebe7d0b-cc7d-4185-900b-825658fbf84e", "comment": "Malware payload (Mirai)", "value": "2fc3c0c4d2b8060fb1262a143d29870b194efb4fb62a3877f0897ce4ad55f9e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012324, "uuid": "fab329fc-d58d-4764-829a-d88270fa1e34", "comment": "Malware payload (Mirai)", "value": "28751230d2c25b6b1fba57d8e9d327907575540a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012324, "uuid": "16fc026a-8bbc-4ee8-a5ae-ef9bbde8ba85", "comment": "Malware payload (Mirai)", "value": "3e65b1214e854d01aa539016fda0b33fafcd87f35c9aff603b1049586047cde17b7974da2a3e346521595e9ca349d1c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012324, "uuid": "d9946f64-0712-4c66-ba24-a630def87a19", "value": "T164B3834E3E325F7CFEFD823483B79A65924E279A32E1C5C4D1ACE2021D70249645FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012324, "uuid": "f2f129e8-f664-4289-9e83-fc48829bb635", "value": "3072:urxVxLRFd4XdCPxgx/uXJqr0DyGkHdAWhu:LX4Jgx/uXJqrIzghhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012324, "uuid": "b30f6404-e6d6-4950-926b-dbc386dfd16e", "value": 113708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012324, "uuid": "3b13cbb0-80e2-49d1-a9bb-ea4262e82928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012324, "uuid": "c8dcf1f0-12be-456b-9e1e-913393d68dd5", "value": "zombie.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46cc320-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784012485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012485, "uuid": "e90c55d5-e04c-4aba-8a9c-3a0ed68516f1", "comment": "Malware payload (AgentTesla)", "value": "ba48ab60110ff30c992d380ad9893058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012485, "uuid": "e1c94bde-8371-4872-a25c-a98080550596", "comment": "Malware payload (AgentTesla)", "value": "30876a3777a474cfb1517a30d48d1c588774c8e69c090377dbc6e7f554e16e54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012485, "uuid": "569899fb-6c4f-42ee-854e-5be73acb3861", "comment": "Malware payload (AgentTesla)", "value": "eb40876bea581f220e8d8c9e72bf590de55f562d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012485, "uuid": "0591d370-ad20-4966-a92d-f7e8f2060d69", "comment": "Malware payload (AgentTesla)", "value": "6f2f32113657ab4188e9f01830dd32c574ffd7efd66b5472767bc5fb4f3af49ee0e5b8985c5bda0b5c64f17ca1905445", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012485, "uuid": "115ef147-e527-426b-bad5-bc259717a883", "value": "T1BEB512B82F9C6D2A40F097F98D8C92B50775C6229EDA4499F64902DA01DDF3901EFCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012485, "uuid": "6081e036-98da-4baf-9ade-37c47d167057", "value": "192:ApB21nZm2UC8XreDICSac8aOi5hXYJYCsxI4UWrU0doAz62:A2uyQOMNoAz62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012485, "uuid": "831013ae-6dae-435f-a586-867d8a9d11d7", "value": 2278307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012485, "uuid": "3c1125bc-44a5-4bb8-ab28-3a4d4caf4f8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012485, "uuid": "b0fa5959-dadc-4767-8592-21d83c6f4d3b", "value": "Elenco prodotti, codici HS e EUR1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0ef51f-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015426, "uuid": "10370c31-3ea8-4c28-8acb-d2c2adeed9f3", "comment": "Malware payload (RemcosRAT)", "value": "40935c08f7b7dbc7493e3c0601c5b9a4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015426, "uuid": "77d31f2c-1e99-40a9-b9b9-64b5706442b2", "comment": "Malware payload (RemcosRAT)", "value": "30bb2e3f95802ba961bceb0f553ebe9ea81745fe6c63a49dff9c04727a48535c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015426, "uuid": "2943bec8-c724-4430-a1e2-f25f38538ace", "comment": "Malware payload (RemcosRAT)", "value": "42959ab3ee0eb7ceae32b28937102d9683c203e1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015426, "uuid": "b30ddcae-45c9-4e0a-90dc-63a6cf167641", "comment": "Malware payload (RemcosRAT)", "value": "3a52b23111d24d5e87189dcdfa597e8ffd3953b9b238433e0ff4762824d6616c7b824d4f01aaf1c14b534d9f11098820", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015426, "uuid": "ce71e9fa-dc90-4e2f-8a10-b6d28acc7866", "value": "T13F052398FEA6DF67C0A369F068991585021FFDD5460EC15F3032732FA93979ACAE801D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015426, "uuid": "da014679-f711-44a7-a692-d96e49525e33", "value": "24576:nofwI/77dpVzzjI9nFBD+MLLBX9qMmrIxlZiO:nofwIj73VzzOnFByOX9tmrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015426, "uuid": "a22de18f-9111-4a85-a48c-a70923a3d060", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015426, "uuid": "b8919765-efc1-43f5-b9d5-a519eab98028", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015426, "uuid": "84e38217-e788-4130-8b2f-fb6ff356ea33", "value": "Order Specification Template-20240318.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad3058a-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784022616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022616, "uuid": "d8a841f5-88ef-45ad-9265-def93ee47ee7", "comment": "Malware payload (Mirai)", "value": "f455f84397830145d0c477bf4e149b00", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022616, "uuid": "ae3ea652-dc86-4182-887c-b40a509859bc", "comment": "Malware payload (Mirai)", "value": "30bf2461c42b11a893cc2204e7d7289bfdcce69f897c19217772592cd296882b", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022616, "uuid": "f4c180f4-6659-44ee-96c6-4e7ac59b6472", "comment": "Malware payload (Mirai)", "value": "520bb461edf81376ed38e646c75662f28d0c7758", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022616, "uuid": "0afee617-23e4-4f92-aee4-39b2d3798c63", "comment": "Malware payload (Mirai)", "value": "a92a62157bf25237d630d774f8a8ddb45e922f93365eda3aed6dfdc9dd4472006b7557073ae7c57d56330f13d91fd9d9", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022616, "uuid": "898a2874-c57c-436e-99f5-22c55c74ae72", "value": "T18482D091B3B16C9BDB7216363BB93A2ED2F4EFE41219510AD6912D852C31306CDB5F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022616, "uuid": "70fc70d6-423f-4c1e-91a8-832cb7871b16", "value": "384:/a4VwvizcwMOvZ7xgCCuuoJamdrAZjtoR/2aCNAZwFbe7E4C6FO:i2zcwTZdVLJJrgp826CFbeI4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022616, "uuid": "bfc503e0-4d9c-4bd9-ae31-0e5ae63350d5", "value": 17728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022616, "uuid": "cf99725f-4e7b-41eb-a2c8-352651036848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022616, "uuid": "13c798e4-b8dd-499f-a789-459f0005106e", "value": "30bf2461c42b11a893cc2204e7d7289bfdcce69f897c19217772592cd296882b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d5a9d8-7f75-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784027891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027891, "uuid": "2a522471-273f-4ed8-a663-8d66df3a7e24", "comment": "Malware payload", "value": "814f96db296e0314ec91bf8f79cbe34a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027891, "uuid": "1981a354-62de-485d-be9c-ead52d6927bd", "comment": "Malware payload", "value": "31a0b37a9dd2d6fc2c2da85f5000a32953ee9c1a2ca731752cea006251c9c648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027891, "uuid": "32e234cd-8a1b-41a8-b248-ac359279baa4", "comment": "Malware payload", "value": "fb73c0f1f7a10dfadd5488246502df3eef96e0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027891, "uuid": "cf05a9e4-3fbe-458d-87d3-337524a3d2eb", "comment": "Malware payload", "value": "d31b4e7747328535b723b58f7f68c9a83270e98ad4f4bdbc2ccca15ffd28c485bfc18a5c591b9cbcb3b492a2d4286cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027891, "uuid": "2a86401a-0523-47a9-950c-57f91f85638e", "value": "T148C71256E2BD00E8D47BC0B8C6574A17EBB1345513306BEB66A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027891, "uuid": "a355bc6d-9ed6-4c40-9ab6-75d65f1139e6", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027891, "uuid": "a40780c1-9740-451b-aa5b-321bd215ef2f", "value": "1572864:hIVoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLi8:hIVogVJnhVTMVEDjQKoFeLi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784027891, "uuid": "29818c96-428c-4014-be2e-06cb8cc2ec37", "value": 52787538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784027891, "uuid": "86a1dcd1-b393-4ff1-8c0a-ef2d3a0af343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027891, "uuid": "d60860ec-c63f-4ce4-9e5c-a04b5ef5339e", "value": "31a0b37a9dd2d6fc2c2da85f5000a32953ee9c1a2ca731752cea006251c9c648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bcbd57-7fc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784060759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784060759, "uuid": "33cbfaba-f419-41cf-8c0d-0fa9fcfffd90", "comment": "Malware payload", "value": "2e7448263a0543c408a5f3595ee750b9", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784060759, "uuid": "8470d1ba-f39c-4403-a15f-e4a49bdd5262", "comment": "Malware payload", "value": "31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784060759, "uuid": "bb6e46b1-d323-4847-bf98-9770ef17ef3e", "comment": "Malware payload", "value": "24679b128550bfbafe65dcf6097a695b8b33bd24", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784060759, "uuid": "f1f155c2-6de1-4525-8063-90b0afbc8258", "comment": "Malware payload", "value": "1f91ad111d9b6cced78afb88fec1d6fd6595c5231af64ff0e705e1fe77577eb05c05f4b8be22e6aa58e1a3a678b13f42", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784060759, "uuid": "ae96a316-822e-4af1-b1c6-ab9de67c0380", "value": "T1A8157F29A66801FDD1B6C1B8CA564902F771748703319ACF03E09AA77F2B6F45E7EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784060759, "uuid": "68215346-9af5-469c-bede-c167e31fa8b2", "value": "94efea64d0bfcd91bc8ed25c735f834b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784060759, "uuid": "d13ce906-a20a-4631-9ac7-e37a4bf40622", "value": "12288:frIDaM5mgM2v5BIY+ZltPPBRXI3q6VsZ2cH6/9D0IhVvvTN64E:FuYBVI3ZVsZ2caF4Ihpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784060759, "uuid": "d1658eb0-da0a-4b84-b64b-35aeda2167d5", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784060759, "uuid": "383d0791-66b4-4d7c-b381-e43ec12cbbda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784060759, "uuid": "b61b52b6-ce87-410e-8eaf-f4ca9e9c1c11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a885e159-7fad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784051925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051925, "uuid": "33af2a63-b98b-4225-a711-0ab996c7750d", "comment": "Malware payload (Mirai)", "value": "06c82847168f3fe581fb77ab835d0915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051925, "uuid": "acd76660-58f8-456f-aa04-3a442d904c78", "comment": "Malware payload (Mirai)", "value": "31fa1cdc0530f8105b7f69e2b408fc5971dcdff3815ee6ab7bfbb7f756e0002e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051925, "uuid": "3af8abf7-29d0-4116-8bf2-009ad46513f1", "comment": "Malware payload (Mirai)", "value": "7de1b26c0e21944d7c05f5707ca8b6e31966fdc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051925, "uuid": "c7613fdc-3823-45be-9b7b-e0e3e8a2aef9", "comment": "Malware payload (Mirai)", "value": "3a2e37a02cd088930f0e1dafb2a906b979286a07305eb67d069983cec606d2e20a359f734ed6670570644fe31a899857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051925, "uuid": "76f3530b-215f-41ba-ad98-bc64e3eb3841", "value": "T150F3E816EF602EF7D8EBCC3791B98B0A34DC555A22A42BB57534E424B64B44F46D3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051925, "uuid": "7f1ff0aa-a2d6-42db-b17c-ac460434cbd4", "value": "3072:vaQNOV4EO8b/V7LRazX+wSjWAZYG1UeiTFbBnbfx:iv4Eb/V7a+wSjPYG1UZfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784051925, "uuid": "b6934112-825b-465e-bbf4-c52f4dde2866", "value": 159520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784051925, "uuid": "1fde1063-1801-47f4-9d65-adb8330acd7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051925, "uuid": "3fe82f70-65e4-4635-8a81-fc1cab94e92f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264094f6-7f22-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783992007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992007, "uuid": "bdef82e9-8b56-4c54-8ff2-e65197e400a2", "comment": "Malware payload", "value": "c864ae8a8327f64eb43edfb897839077", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992007, "uuid": "509bf03d-e4a1-43b6-b825-7adf379c62fe", "comment": "Malware payload", "value": "343309939613a1aaaf46375d390e26ba60a91e6026ec2de237fd1e19a2bd267f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992007, "uuid": "1b8c136c-a175-48e0-b4e4-1a75d8d30afa", "comment": "Malware payload", "value": "425bc3b429bc70b9574d53d2ea5f6d2600b8e727", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992007, "uuid": "02459b04-dd73-4307-8cb4-caeb4f34a46d", "comment": "Malware payload", "value": "a79aa5fc91e9271419cf1e96e2fae97345dc6d5e06860ca779bbfee2c51271b0b7163e5feeb7f97888024d94713da384", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992007, "uuid": "18ca07fd-b219-4509-b966-ba577c62d529", "value": "T190236D6516857C24AA98D4371D7E2F0CBDAD43E6320492EE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992007, "uuid": "d2085e6c-aa98-44c1-8d98-047b5d1fe529", "value": "768:HXRWNGxV89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Blxncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783992007, "uuid": "1fbede95-7aaf-4cc3-b84b-fe6e0f8fd3b8", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783992007, "uuid": "d7afcbc2-9aa9-42bc-bfbe-ae7364be372a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992007, "uuid": "03944cdf-e1a9-42fd-95a2-6f80fbb0cf0b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384aba36-7f54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784013512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013512, "uuid": "d38b9b02-f1eb-4728-82c7-ca1770eb5be0", "comment": "Malware payload (Mirai)", "value": "6e8632ab9d27e26458049a5a5e12e3a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013512, "uuid": "4c287779-06a7-4d71-a837-048df10ef797", "comment": "Malware payload (Mirai)", "value": "346a019bbcfc938bae9401e7addbf79ba23105f8981b4b9b361cdbf40e31fe6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013512, "uuid": "75a98d64-6fe2-40da-84b7-64b0cb2c0799", "comment": "Malware payload (Mirai)", "value": "86b0b1b444ffe527d28ca20f6cbf5013198d81c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013512, "uuid": "e89b695a-66ac-4a22-a856-854e8a1e32c6", "comment": "Malware payload (Mirai)", "value": "5f2cb47884493ca857b6bec5f1688a8b7eb626cece0cc3493a11821cbd2428c851a31a0ad04a64d20afce182c993be30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013512, "uuid": "0df8ea29-5ff3-49b2-a32e-62338730e6b9", "value": "T1EDC31989B8929A22C6D316BFFA4F42CD773663E4E3DF7107DD195B21328641B0D6B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013512, "uuid": "f56505c5-9d51-4b71-99a8-a8edd1602db0", "value": "3072:jnREVsW6L1KD5IYciU5I7a5OyZHE7YPASVtcn+V:jnRE9EscioIgRZHgYPAS3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013512, "uuid": "150e04ed-5990-4f72-a245-044b2adead88", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013512, "uuid": "ae6b3140-a3c8-42cc-8ca3-f05103323b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013512, "uuid": "9e210966-83e8-484f-93ec-a8b9b6783f85", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324d2ec6-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022092, "uuid": "520b2305-2634-4d33-95c6-2498b3d10fe7", "comment": "Malware payload (AgentTesla)", "value": "217a01b35777226f65042ef252e030c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022092, "uuid": "ac4d07b6-d4b2-4f20-a712-7239f4ae3a20", "comment": "Malware payload (AgentTesla)", "value": "34edad17891c9f89b8f3ee85e14e4e40ceed562d78563c0597720eb556a0e9c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022092, "uuid": "9854558a-61d2-45ba-a36c-05c75b4fcea8", "comment": "Malware payload (AgentTesla)", "value": "c2a64255bef8126b906b2e673c2e9e03f581a767", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022092, "uuid": "49d5cf53-f70a-41c0-9c21-b7ddfe5e3d1f", "comment": "Malware payload (AgentTesla)", "value": "7d97f32e6b1fd6ded758b7babadc30c58d7aff5177570038a9dc22bd851a9a4e22ee0eb43cfdee6f074820d29aff113d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022092, "uuid": "2f17df75-3e64-412a-8399-d206df79c454", "value": "T1BFF53A41175A9432AB6DD75CD136E930A98E201315CADF2D306ED33C3A10E5B63AEEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022092, "uuid": "b998b667-3f99-4af0-84e6-44170ecaac14", "value": "98304:Rl2ueTEfM5ZXcMWSW/b5NuF/uTH632oSNdaEvVNNXuoYjJzKpOBvFmzCZ3PLRWAi:D/eThKFSG5NuNuTcSz9vBNOzAOBvFBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022092, "uuid": "96224294-fb51-41b2-b466-6365c8f1e4f4", "value": 3456456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022092, "uuid": "6b37c3ca-26d2-4fda-b77a-b0e57b22dc90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022092, "uuid": "4d85abeb-c5d9-4f51-bd55-7bfe6e22ad24", "value": "34edad17891c9f89b8f3ee85e14e4e40ceed562d78563c0597720eb556a0e9c2.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0803bc-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784002779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002779, "uuid": "79b66251-5967-4dff-a7be-ebf1689d1b40", "comment": "Malware payload", "value": "d54ca1c035df6b8abf7e8f481059e800", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002779, "uuid": "ad33158c-a226-425b-a45d-e1a47d9c37a5", "comment": "Malware payload", "value": "36b86fc4dbfabc7de28b5e0293f378b72dbb2b5b5d25351c6ff125bc46e7079a", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002779, "uuid": "5dee378c-3ae5-494e-9311-a3befce92e5f", "comment": "Malware payload", "value": "aa8092ca625ac707b01daaaf521c18a6810baa35", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002779, "uuid": "77f5e8b3-3ec3-4133-9efc-3dd905b97af7", "comment": "Malware payload", "value": "e1cbd24cf326884b42e6731a6b794ddc980468a8360d88565ed8ac7db2007560c702ece3cf3a1855d2a7899b5ca9b3d4", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002779, "uuid": "f67d4140-2067-470c-b4d2-2fbc5e91aa54", "value": "T16511C2251FEF0A00E2F65A34ECB8966129307C0C8A31065D0380182C4CE2A18DC36F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002779, "uuid": "393cab99-55ae-4bae-8ac3-897d08dc4c74", "value": "6:4xtiU5Yzqyzqy/0hkKlFcnlj+SEEgykQLPfBMlpIZe6SaU/k1ARokJxt:8oU19kCikQLhMb2eMf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002779, "uuid": "5f8c9a88-5ddf-4e06-b997-28618a4d3e27", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002779, "uuid": "ce8982c7-d55e-4e32-9dc2-a7df2705bc62", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002779, "uuid": "ac34eaf7-e38f-42af-ad91-6084b9d0517f", "value": "photos-2026c-1106037895593 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666a68b-7f9d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784044969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044969, "uuid": "6a16c465-0108-4ccc-9a45-f378e9641569", "comment": "Malware payload (Mirai)", "value": "b041b74cddc05a51c44292104c6cef69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044969, "uuid": "bf044580-b104-4799-9e24-98c9e240b152", "comment": "Malware payload (Mirai)", "value": "3700e44be4e674477ca36b3dc4012608afcebf7917ca68eeff6b8782694fd768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044969, "uuid": "e99a6410-d3db-470e-a40d-cebe0c78b7d2", "comment": "Malware payload (Mirai)", "value": "7da837500b402731d48d554b1fefc791f39a50b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044969, "uuid": "1c6ba6b6-483c-4f38-9bf1-0a33fa71b5d4", "comment": "Malware payload (Mirai)", "value": "02657215f0dd437f6431fdbf0cd69ce04493b932e1de9d00697ae33d1b02576cf4b08197d64db72cacab6d17fae0e56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044969, "uuid": "a7d57982-5d3a-4d89-b73e-85dd8cd99e9a", "value": "T1A7631A45BD82AA06CAD90377FA1E42CD331173D8E2ED3227DD256F11B7CA52B0E6B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044969, "uuid": "03f78311-a6d7-4c0f-9bd6-ddc9b3807c68", "value": "1536:+6j0x+EXI18HoBsXMcdGj/JLfRwuq6T3OxgITHwbZnU:70EEXuKo4MN/FRw8TOZwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044969, "uuid": "5c1f793a-167c-4a01-97e6-4a345d9b3cb7", "value": 67944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044969, "uuid": "b365b8c7-e916-4696-82a9-47ea2627b547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044969, "uuid": "81d22343-0b85-499f-aec6-bb266c270e46", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e2f8a8-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784023926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023926, "uuid": "a51c3a11-9f6e-43bf-ade0-a5a0032fe81d", "comment": "Malware payload (XWorm)", "value": "6e83e5fcc8783b5a1356fa32c8080110", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023926, "uuid": "c98f34b9-4eeb-40fc-85ba-e9343ce44b67", "comment": "Malware payload (XWorm)", "value": "3738537154bfc5ea1b5af6034602c550f603deb11cbbef3018f668f4907f4d37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023926, "uuid": "d527b7f8-8e10-4324-b3e4-07089e67aedc", "comment": "Malware payload (XWorm)", "value": "bfc2fa85bd7cd25666131629b2755a0b1f9fb2b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023926, "uuid": "24fd66e3-e5b6-4e64-875d-98ace8840839", "comment": "Malware payload (XWorm)", "value": "2b548031dce1d0fd7e8aa14452b4ba5cb0a54b00b00a6ec8a6faf91ad3194efa177a750e5a5344f23ec5db81966bc947", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023926, "uuid": "78fe3756-a4e7-42a5-b138-b414e8a30bae", "value": "T1B5C50960D3286276742DC72CE1366F2C154E70076178EF4C3DAA0264BE59F9B939CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023926, "uuid": "df876fd9-33e9-4b65-8f00-667d9435d0f8", "value": "49152:jFmgZolzyr00dTW6qDmUizjuNvQiCxbtZvHhu+AY4c2pdDYlo7:jFrotyrruNvQiCxbTvHhu+AY4c2pdDYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023926, "uuid": "ff7ee9f5-c593-4527-8da6-120d66db1d3f", "value": 2538183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023926, "uuid": "bd053516-8051-4ba8-aec2-77550c682c47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023926, "uuid": "b81a21dc-66a1-4034-9bbc-4a7a8c8e8c7d", "value": "RFQ form for Materials & Parts.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ae8de3-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784023361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023361, "uuid": "14d2c8e6-cbf9-46b0-b150-389e903f27f7", "comment": "Malware payload (Mirai)", "value": "688c6311320aa416a88cf6eed3d5f8f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023361, "uuid": "c07a6b68-28c7-47b5-8dcf-35c279ada04d", "comment": "Malware payload (Mirai)", "value": "3801a288c16a19c57c7a8a7b0f139cf630d2cd0c4bbcb26876e3593c492ffc5d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023361, "uuid": "cca17413-9f9c-4ff2-9a35-3b39f87292bd", "comment": "Malware payload (Mirai)", "value": "e60491a2e59eb90b797d2db74c8d92bb2b432382", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023361, "uuid": "0cb4be84-38ad-4c4e-b89e-f8df74025141", "comment": "Malware payload (Mirai)", "value": "678469ff3c6dc386fe264804da58957207a5cb7e05e6547044070e585351bce2d8ccc495ae2e44d88d6b312b0d3d6bba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023361, "uuid": "93aefc04-ea63-42c6-be68-e8a978706b95", "value": "T1F4F06298414169D3AF8C9D2F7593515E6352F7C930372BC8FD8666A896847C5F020E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023361, "uuid": "1440ef99-855f-4ffc-ade7-ad0d8e82c554", "value": "12:KhI5W3CtI1/TbNcP/3bQWx1npLOhc526VliAE/5eqlHA:KOQyS1bbiPvbb1npLOSZliA5qlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023361, "uuid": "87b34ae5-ca95-41e3-b24e-f42bf25ee0fd", "value": 541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023361, "uuid": "c6c1b58c-d049-4dbb-8298-95b56bd0e03f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023361, "uuid": "d7ff2468-3430-4403-8e21-76a66c423a60", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d9303d-7fa7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784049319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784049319, "uuid": "4ce2e696-e276-4064-b039-918dd69d4248", "comment": "Malware payload (WannaCry)", "value": "0976a8537c8b28b66c65416ec72c5ffc", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784049319, "uuid": "d2311b7b-68c1-4b57-b446-e08051350c68", "comment": "Malware payload (WannaCry)", "value": "3846e513d6a32765431ef270ccf8ad44f7627d278a2dd1e70855b21aaa6b632a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784049319, "uuid": "33e7e1b9-2ad3-4e60-87d4-654fedb8e758", "comment": "Malware payload (WannaCry)", "value": "985bc107b5dd3026a46f88b33f8c084001a7c5f0", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784049319, "uuid": "33c1e9dc-8257-4a01-986e-198e460a1fe9", "comment": "Malware payload (WannaCry)", "value": "5762b5fe394458d0346f07ff85469843d4ebee469068b7d35f3a3e9b3758f1a0d5fa4b9f4bc244eefc4cb9b394d9ff6c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784049319, "uuid": "5bf08b3e-9aec-4333-b2e9-24dc177a417e", "value": "T1B9362359366C81FDD11B927490F38E21E6B37C862279870F4BD08B671E63790BE78B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784049319, "uuid": "0a360103-1d6c-46ef-bace-d42df8944a4c", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784049319, "uuid": "eec9d222-d33d-4a52-81b4-d13a7b2e8717", "value": "24576:jbLgvbLgddQhfdmMSirYbcMNgef0EgXe4i7ojhsP5Lgrk1TWb4AN5:jnmnAQqMSPbcBVre30jaNf1TWbdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784049319, "uuid": "1e1b2449-a6de-44ac-8ab6-ee4b16453416", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784049319, "uuid": "e6a7f848-27f6-4d56-8a00-c425511a0360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784049319, "uuid": "4b49081e-7a77-4b9e-9bd3-6cbfa03b0ec9", "value": "3846e513d6a32765431ef270ccf8ad44f7627d278a2dd1e70855b21aaa6b632a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c9155b-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (TokyoCore)", "timestamp": 1784035863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035863, "uuid": "0aaf3ac9-da8d-4bc2-99f8-06acf5d31d53", "comment": "Malware payload (TokyoCore)", "value": "d77aa7f5bf7c008232f4cbec127c30db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TokyoCore", "colour": "#74A99E", "exportable": true, "hide_tag": false }, { "name": "TokyoCoreRansomware", "colour": "#5CA6AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035863, "uuid": "3073dd0c-c91f-48d5-8cbf-27b85b491849", "comment": "Malware payload (TokyoCore)", "value": "386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TokyoCore", "colour": "#74A99E", "exportable": true, "hide_tag": false }, { "name": "TokyoCoreRansomware", "colour": "#5CA6AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035863, "uuid": "48f9d075-f6ee-4854-9d1b-54dd147499f8", "comment": "Malware payload (TokyoCore)", "value": "3701617822f99debbf2579602b32eb99034581ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TokyoCore", "colour": "#74A99E", "exportable": true, "hide_tag": false }, { "name": "TokyoCoreRansomware", "colour": "#5CA6AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035863, "uuid": "fcd66265-e4c6-4175-b72f-c9bc406a9f5e", "comment": "Malware payload (TokyoCore)", "value": "e8a24160e1b721c495da375fa4c3a77e03972191b758d3717535711e326e7f3cc6f50ec0bd46238fd72baf9448876c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TokyoCore", "colour": "#74A99E", "exportable": true, "hide_tag": false }, { "name": "TokyoCoreRansomware", "colour": "#5CA6AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035863, "uuid": "38b1099f-48b9-4747-9a7c-26fa81ad4ac9", "value": "T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035863, "uuid": "e2555c30-2b37-4ec4-ae3e-2ad7342fc0b8", "value": "f5200c8f341553e67db607d46a282070", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035863, "uuid": "fda0b687-98d0-45c1-8f0f-b5db129d61f2", "value": "24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035863, "uuid": "f114125b-7ac7-4138-832b-8d503d029150", "value": 3421696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035863, "uuid": "ba58b17f-63a3-41d8-bc09-7bd87d79f2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035863, "uuid": "bfd9bb22-9ac7-4e63-9d1b-c885944d8ea4", "value": "386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48a5122-7f6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784024887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024887, "uuid": "cbd9a20e-91a8-4d35-a2b7-2fe80becf2b6", "comment": "Malware payload (ConnectWise)", "value": "e2da5244179b68d7aeb36e764659132b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024887, "uuid": "624e2471-b4e3-4bd8-a8df-8c6e8f45ddbe", "comment": "Malware payload (ConnectWise)", "value": "39030298332d4ad0b3b3cb987a4bb9501f19d8ba48b393f187cf560db6b60a79", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024887, "uuid": "62fc8ecd-fda7-4098-8ffa-0a4d36e4baa5", "comment": "Malware payload (ConnectWise)", "value": "f58452957de3da4cd434a94a17cbd8ae658b29bf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024887, "uuid": "4aa55b62-bd82-4853-8bbf-bcbdc2981c6c", "comment": "Malware payload (ConnectWise)", "value": "67ebb938660ad433a1935841fde99eaedb58fa356f1d7b96415b14ed105b0ff63ca7d18ac7afa98e20f81a47fd452703", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024887, "uuid": "587c8710-80ec-45f9-8966-da7574fdad2f", "value": "T13AF72330B64ACD36CD9615B08C7DEBAE602DBA790B2490C7B3D82D2D19B15D32736E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024887, "uuid": "06d332a0-3e94-4535-8c34-b5cbbadd6987", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024887, "uuid": "03db99da-a293-4f10-9242-3acc18f9ac08", "value": "1572864:2StBeleEZjJdsMxyv2+uXeTk9mTtxbwS6YESE:2mBele0FJyO+uXe4w5xpESE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024887, "uuid": "5ae249b2-7f4f-4a08-ae71-e2ac00fdc6ed", "value": 76325328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024887, "uuid": "c51ed357-7f7e-477c-8e83-0dcad76b3fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024887, "uuid": "b549b532-0c39-4231-a01e-e88405160ad2", "value": "Installer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4d81da-7f9d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784044870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044870, "uuid": "661109bd-2cc8-4793-a187-28d5affa6727", "comment": "Malware payload", "value": "9ba651a87513795f28b41c62c326814b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044870, "uuid": "6e86327a-9adb-4146-a598-43aa13efe196", "comment": "Malware payload", "value": "393e5aed4cef384221a6f662b7ee9910e2dc299add5d38bb315fa2748f1d7387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044870, "uuid": "93fba671-4799-4596-9a33-e3234e50d334", "comment": "Malware payload", "value": "b18a7b65b51ca73bee9cf4e749e87f92959783c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044870, "uuid": "83089c90-ab6b-4d5a-bf79-ec7ff9d668dc", "comment": "Malware payload", "value": "023fca6f6f73f42d92dbaf62c8c7f3e1ce9acd5d16332a9e0005ab070155b91863cb5bc5e80127d2084cf759d4e42def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044870, "uuid": "e7ff2a1e-4d4f-415e-a68f-b27c2abb42f7", "value": "T121B6334FB1424E9BD58411B098A58BB1223DD404EEE332B2DA99476FFFC71704789EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044870, "uuid": "b92356c7-ae92-4c43-9554-234bf93b477f", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044870, "uuid": "501172a9-2961-4aa9-acd8-a9d164a84d6c", "value": "196608:X9Y5QKtwekD43Go2d2qxgwfGEAroDl6X1OWa/e:t5CKDtDd3xLP/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044870, "uuid": "d04dccab-9004-401e-a2c4-9ac6a42cdeff", "value": 10536448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044870, "uuid": "148ec5bd-21bb-422a-8506-b7f768695622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044870, "uuid": "5ae4a2f8-8c7a-4b03-9b05-ddf890c4656d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3b349a-7f53-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784013331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013331, "uuid": "db09c14a-b4cb-4f54-9117-abeae1aaec9e", "comment": "Malware payload (Mirai)", "value": "32a0761f66efad9e29da758f7cf1bec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013331, "uuid": "24f53fe9-7499-4181-ac4b-b5b81b49bac9", "comment": "Malware payload (Mirai)", "value": "3b10366eeaccf23f6f4bb4dfe35148fe685be8345157b386381db65546396101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013331, "uuid": "70ba0f4c-3786-4198-ad4e-1f2bdb2ba2cf", "comment": "Malware payload (Mirai)", "value": "1766fa2894b876dad5a9f95dbf2b9261dd09b452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013331, "uuid": "b23e54dd-24da-4fd1-bddc-4004dbc8e685", "comment": "Malware payload (Mirai)", "value": "16fb9359afbecc3d501c82221b744f94e9da7b981d1a3b6a9077d3aa1a25df56c07df3963a31b18a6197125e6e363958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013331, "uuid": "dfb5c86e-781c-4285-aeb0-5e81fce3fd89", "value": "T183F3D717AF602EF7E8ABCC3791B9870924DC659B22942BB57534E424B64B44F46D3CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013331, "uuid": "c4a6cca8-d155-461b-b4ea-4eb232bef1f0", "value": "3072:BfVclpUd8m+Q29tGbYdBAtxitKxRfLcn+F:FapUT+Q2rGbY8txituF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013331, "uuid": "717a974b-ecf9-4425-ac51-7151a4be9f87", "value": 159372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013331, "uuid": "2c99d21a-81ab-4166-a0f9-97a73109adeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013331, "uuid": "92bd6096-c688-4b64-9601-f3e17f073798", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba0d43f-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784031878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031878, "uuid": "a04330a4-3192-4449-b2e3-813467d217a3", "comment": "Malware payload (Mirai)", "value": "07e0e39f8e01908cb9d6de7da871ed34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031878, "uuid": "1dd8f43d-e120-49cb-a0df-1adefc320c9a", "comment": "Malware payload (Mirai)", "value": "3b74891f82b973e628b88ebb412be1bf2a8efbefdbc39a95a6084e719e5ab411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031878, "uuid": "05d5da53-f280-4529-83d4-997be180ec4f", "comment": "Malware payload (Mirai)", "value": "a02e33d61e15842a7bd1cf51fd6ce0b2ef0028d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031878, "uuid": "bd4d18fb-92f9-489b-9634-6a1f2ebcf739", "comment": "Malware payload (Mirai)", "value": "3d5acf143836bd8bfb844a65a08b69eda013e4cc63eccf403eccf6217614e68518a0ac6c77e5a643133cddf891b39c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031878, "uuid": "63852768-a9a2-4595-95c9-a3626de31f71", "value": "T141C3198AB8929A22C6D716BFFA5F42CD773663E4E3DF7107CD185B21328742A0D6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031878, "uuid": "3020c768-12a5-47e0-a069-5ab60a6cd2a4", "value": "3072:LJsHJjtCmoNYXsciU5I9+fsU7mfzyIvBnb2:LJsNlXscioIcsOmfXt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031878, "uuid": "a19bb80a-87e7-4cc1-9539-f292a88f8c76", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031878, "uuid": "c2834db0-d4e0-4878-a558-83fbfbac53d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031878, "uuid": "8d9616ce-37e8-4ee9-ae16-7b424816575c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655ccb69-7f32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1783998985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998985, "uuid": "fec13c48-0579-40db-97be-d3ae26fb2efc", "comment": "Malware payload (DarkTortilla)", "value": "34c3f92bf36ced3543c545065cfe6095", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998985, "uuid": "40912fe3-ad92-4cc0-9a8b-06c64bf1f26e", "comment": "Malware payload (DarkTortilla)", "value": "3bce373a6a8b4a35e50d54469fe16ad229267578960589bdc6951195b6de98fb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998985, "uuid": "89720ebb-64a6-4d92-a67e-2d1bbd160a73", "comment": "Malware payload (DarkTortilla)", "value": "c72b9041cad9d401989976bee11a8a08b99153e8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998985, "uuid": "86c0fd67-eaf6-4f4b-89b2-f2dc7dfebc6a", "comment": "Malware payload (DarkTortilla)", "value": "a76bb25d3ad5dd610169e502812dc5a520b4d6618b1a64c746373ac435d1d85e647107127d340a23c0dc9eecad02b412", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998985, "uuid": "83fe963c-173d-4ebe-9bd9-176da20d736e", "value": "T1A745E1259D466635CA3C0A74C0D6749C13F0FEF79296E71A2EE831ECDB727A4A9D3081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998985, "uuid": "5ca1ee56-bd3f-4b4c-baeb-53f8a64bbea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998985, "uuid": "eb4231f0-9408-44b2-b81a-6b44d9d2172c", "value": "12288:GfG5ANoT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yh8G1R12Vg5CkCThajRtvA2pV:GuZ2UxAPqGcv/+Duyx4O0kYa9tvlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783998985, "uuid": "03535378-08ae-4ad5-ac8f-dc2b1e136c15", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783998985, "uuid": "3004d687-8c8a-4f39-945f-aab5a1a0fd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998985, "uuid": "346a5781-aa76-45d8-98cf-9b83691ff437", "value": "PURCHASE_ORDER_202606001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e12c90-7f7b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784030201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030201, "uuid": "a2f34c10-00e1-40c8-9108-bc21333b11a5", "comment": "Malware payload (Mirai)", "value": "94c94673a02ba3cdd820afc2067312ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030201, "uuid": "fc563bcf-5081-4013-b6f8-8697822fc85f", "comment": "Malware payload (Mirai)", "value": "3be15b9c0408cd9f36c4600df51888d4d12babb0f4943b9e69dbcd9d12eccc64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030201, "uuid": "5caa8c45-9908-403f-80df-02047bc3b37b", "comment": "Malware payload (Mirai)", "value": "95a3d1edf55a21a0e4365153e15e2e8db1ebaa2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030201, "uuid": "fe786864-6af9-4528-b9bb-a4013fbbe40d", "comment": "Malware payload (Mirai)", "value": "bb880d1c2b1e09601203a746a7e0c6e3483121240cb1a6a341e3f7e942029c037e9ead4d55b44b7fdde9401a20cff813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030201, "uuid": "66edf56b-863d-45f6-b2f7-945ca3ab16f6", "value": "T15363D70AEF514EFBDC6FDE3305A80A0231CCA54722B53B7A3674D92CB55A54B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030201, "uuid": "17b2a35f-7f7b-44ef-9e68-e3dd415a2bd3", "value": "1536:omVA/o0IXbLelIUpDXlmbmzROhx/3Cw68nbRP:TQoGmUpwL/ddP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030201, "uuid": "3fcea40b-697e-43ae-9431-d67ba1e589fe", "value": 68428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030201, "uuid": "40c1ee4a-51dd-4b42-b0db-6cdbcb9cfc44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030201, "uuid": "fe73b582-c790-4c8c-a104-8b16e4a1e419", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a382c9-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023839, "uuid": "9ac981d7-2b2d-46b2-be4c-b2bfe465cfe6", "comment": "Malware payload", "value": "65ee546918f114a7ef7e59793024a2c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023839, "uuid": "b83e6db0-4894-4022-bf3a-cfb0e4af8810", "comment": "Malware payload", "value": "3c0d58a8c980c269c8f70dc71e41e86e570afe807681f9a711d9a02aa7649697", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023839, "uuid": "be5b815e-6911-42cc-84cb-ed5cafaf29ad", "comment": "Malware payload", "value": "b5f1772ba3d66172d8e4714c0b531d7506ff2469", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023839, "uuid": "6c14cfda-ecad-464e-8f71-943519e7c7db", "comment": "Malware payload", "value": "837d4bb8e17af88567dfa46631bcd0d290ee91cef6342510b117c733a11e316a4bfbd9fae311809fa5728708e227d475", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023839, "uuid": "476294f7-b36e-4a2e-872b-d2191ed9960b", "value": "T1E3E2B673222A613817E19F9673F9475AB2391188A112029C7EBC9CCF598DDD43277EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023839, "uuid": "55d98e78-c702-46ee-8aef-71b8bd5b0271", "value": "768:c54ss/gPA7Z2rP+wurdfWUYmrtYmgBtrnwaW9ma4N:jss/ISeBVnwaW9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023839, "uuid": "e50ec2db-aa14-4afc-99bd-3042c55ccd2c", "value": 32318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023839, "uuid": "f506623d-f11b-4895-bc0a-ca2c9353c52a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023839, "uuid": "e67f823a-5719-4c3f-b344-08e6bf76b3ee", "value": "lil-gui.esm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2a836c-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784015530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015530, "uuid": "7f1de152-3057-4203-92e6-439c5bb2347a", "comment": "Malware payload (Efimer)", "value": "04476cdf1450037de677bd47af342410", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015530, "uuid": "d7e323a2-a8fe-4012-9bf1-77c7abd27cb5", "comment": "Malware payload (Efimer)", "value": "3d37860fe035a6172640cdafc011fffcbf72f3a80674cc9cb4999cdc4da24a2f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015530, "uuid": "254894d6-2b65-48be-ba82-e61e2ed4c466", "comment": "Malware payload (Efimer)", "value": "a468b7bb7e5f2e81da0aeb48ae1f962ce176ae0c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015530, "uuid": "804e66fb-68a2-4212-a7fe-7b2bd88e695d", "comment": "Malware payload (Efimer)", "value": "0d8391ebf0cdc6486c2c1b1176b8304603b13e0405095b5398b3e34ff1479faaa1ab5d88d65d097dec2d522597e78b22", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015530, "uuid": "dac3c25f-38e4-4ad7-912a-37560fe8f49f", "value": "T158E6334CA5D017EDE8731038FAA251D5E5A9706127B1CAEF07A8C7A5AD131E09D3FA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015530, "uuid": "2b075f31-567e-4313-87a3-3d69b3537535", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015530, "uuid": "958c7d94-c0e3-4c56-849b-ebbd8366842c", "value": "393216:XgfkXtCD6iRRVDQ0VtXJXMCHWUjXZcuI3/PGTAI:X/tCDxRdQ0T5XMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015530, "uuid": "a6f286e2-1310-4cc0-8491-c28061a2a356", "value": 14309278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015530, "uuid": "8885757c-e398-4027-bfe9-a935917c184f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015530, "uuid": "f9dbf34c-e62a-4526-926b-ec7618ba4539", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729d8bbd-7f3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784004590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004590, "uuid": "395be7ef-3728-4ec5-8d7f-54ba4b18a4c5", "comment": "Malware payload (Prometei)", "value": "c37e10e743ddd9ffe316fb2c1b5cd719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004590, "uuid": "80afe5ff-7764-4795-b3db-3b8242d8090c", "comment": "Malware payload (Prometei)", "value": "3d49444c7f58ccbd6ba93587fce2420f1e1775cfa8592b259d4a921b38e42533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004590, "uuid": "636bfd71-a43d-48e6-b337-0e63c813f6fe", "comment": "Malware payload (Prometei)", "value": "569ed4f616db2e466c70826224ecb1aa83de8c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004590, "uuid": "025d347a-f15e-425b-8630-c184f638b854", "comment": "Malware payload (Prometei)", "value": "124874f1948919e5d637116ffd027031640e49c08bbc987efd55abcf0b2c825407cf2392ecd4735e1f4f78ae581c4fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004590, "uuid": "4197a849-5c3b-472a-a847-04733f43a102", "value": "T14D34F13628BC2F14D4627335B10B1F3196F99B1F3B7A119DEAFE47B5B1A4A0119230DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004590, "uuid": "f27ec810-7708-4cba-8898-1ad0aa0e6f3e", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004590, "uuid": "2558b2ba-ed73-4953-b578-921dbd03afed", "value": "6144:gMooVQnnOBccnskYPmTpUxrr1XRA7WHxWoN+J0EafCUSYibN6WGj:TQnO/s1mTpG5bUo4bafVibva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784004590, "uuid": "85a172d5-3c6f-4adb-a42d-aeb7d413dc07", "value": 252692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784004590, "uuid": "956efea1-4cd0-467f-a6d8-0b1e06d5b0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004590, "uuid": "cb1df4f9-64d4-4a36-a310-8f663a634efb", "value": "3d49444c7f58ccbd6ba93587fce2420f1e1775cfa8592b259d4a921b38e42533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a96b52-7f26-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783993930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783993930, "uuid": "e0541713-fbc8-4c53-86a1-151984841fd6", "comment": "Malware payload (Efimer)", "value": "349d379be2d0acb13076bf1822cfe0bd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783993930, "uuid": "95f68ec7-2060-458b-9c75-85ba84e5705d", "comment": "Malware payload (Efimer)", "value": "3e4c1ea078d583222246945d10b5c14d4a3f23348c1f03596652def4e71f88a7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783993930, "uuid": "7b25a261-af0f-450c-a447-955048397e3b", "comment": "Malware payload (Efimer)", "value": "3b656f12223e98a6fcaa095d5e568fe64544a673", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783993930, "uuid": "e46b4118-5c0f-43e7-8aef-9ebd23c4c11a", "comment": "Malware payload (Efimer)", "value": "96ee315fb11eae3a66b15a6b1c87a693255c06bc2707e025f96ff3fc82c9be8e36ec1dd925cb834d463ef75bc17d0793", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783993930, "uuid": "5e98d52a-89af-493b-afbf-a68b3317ed6c", "value": "T117E6330999E116EEE9B3513DEFE207A1E085B4B053B1C89F8E58A362BE471D04D7C727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783993930, "uuid": "c5c9ffa7-3dc3-4f7a-ae4b-97a1463ebd03", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783993930, "uuid": "7f6b4753-c656-4c77-b4d2-401f5d81fbf0", "value": "393216:bX7+WGeQ7uCD08NWprTQ0xXMCHWUjXkcuI3/PGTAI:r7fGeQqkBWpndxXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783993930, "uuid": "68edbc47-4cdf-4da6-a521-37addc9ba5ad", "value": 14245679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783993930, "uuid": "bfe92034-7f94-4131-839d-71d2d277f1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783993930, "uuid": "8d2d5f26-70a9-4f1c-a74a-72414f3e7504", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97edfd87-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784023980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023980, "uuid": "8618bfba-4353-4d7a-bf0f-0107de2760b8", "comment": "Malware payload (AsyncRAT)", "value": "98f2a55d8c14ffb4466fe2c1824ed79d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023980, "uuid": "9b2bae36-d1d7-4c43-b085-9e034f3107c5", "comment": "Malware payload (AsyncRAT)", "value": "40612b9531e0c9aba67bcb342c89933474eb886e5fcb09f202202edc62969c75", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023980, "uuid": "f1f09d75-2abd-4f9b-a1c7-b22e387eb926", "comment": "Malware payload (AsyncRAT)", "value": "0f53db21e5cc6a4bc7b3c3ac2b17e09578a90ab7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023980, "uuid": "e751123a-3e4a-45c6-831b-295b178b3407", "comment": "Malware payload (AsyncRAT)", "value": "cbeffc3f471bf897a2bf77d32e0603b41947927507983b68f61eab6ef61c8d36b49567e841cb9149d31de3fe881bec2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023980, "uuid": "8eb318cd-a8ae-49ec-bb58-2c4cf426e8d2", "value": "T125C57B5CD2E68398FB013874ED147504FF687F2F459849B837E027C84A364A95A1BAFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023980, "uuid": "e5b12a5e-7781-4c9f-be43-d68fac8cd60f", "value": "192:igdzJOEaj4QReTFOLCFwtIpXt0Pnt01EXVvvFcgFfv:Zd5CtINt0ft0e9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023980, "uuid": "32705f79-f363-48ab-ab68-3f6cfccba413", "value": 2501484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023980, "uuid": "3f424c27-5ae8-4891-8583-a71f3391f12b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023980, "uuid": "9d8b9f01-2d1c-40f1-84dd-7402c3b73ca7", "value": "DHL_Shipment_Documents_AWB1370659_ME8933092.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d06bf32-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023962, "uuid": "9d8cf9b1-b9c6-493d-a64b-d588b49e315f", "comment": "Malware payload (PhantomStealer)", "value": "4c2daa1eabee92888e05dbf46a52f558", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023962, "uuid": "5f694503-6417-4423-86f3-c3e5847016ac", "comment": "Malware payload (PhantomStealer)", "value": "40c11a3f7fecb89c4f679fa736a25259d189ea5b084c5625bd7181045e1757d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023962, "uuid": "d3b9f05b-39e5-4d4a-acfe-0e0cba10cc1d", "comment": "Malware payload (PhantomStealer)", "value": "d5f6935edce86c55240375083bfc36be70b73354", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023962, "uuid": "876864d8-1c4e-492d-94e6-697c1fa5d67a", "comment": "Malware payload (PhantomStealer)", "value": "67e31ebacbdeff00ed146e64624c60662311f039124cec7564d1bbd2ee3592c4ca8c065284073342f7d9e039089d29c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023962, "uuid": "a0f6e136-bb17-4a79-a4ff-cb4cc115bdf0", "value": "T12C066C1C8366F28294ECD7AAC929BFFC491D941B2D38DE44395F897D890CF46B3046A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023962, "uuid": "d144906d-f46e-4727-8fde-857821bd39ab", "value": "98304:pnQ30td+4cpX0xYiWap+dYdhdxjDFRX8T6G5557DwlbznALhIWwBJvCcg+gckhar:pOymapgYdhdxd1rLph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023962, "uuid": "8551e6d5-4c6e-4d46-ade0-1e6416b7b8b5", "value": 4015630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023962, "uuid": "7ca5f28a-7253-4b23-ac7f-8bb27820498a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023962, "uuid": "5ac6410a-4b7e-401b-ae5c-dbd9f9d07a3a", "value": "NEW P.O 208870.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdc6768-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784035880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035880, "uuid": "62fc560f-54c7-41a7-a2f5-7ca57d00ca86", "comment": "Malware payload (RustyStealer)", "value": "d3f4bd59f93e39f940948edab4ee978f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InteriumRAT", "colour": "#AAA316", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035880, "uuid": "3ce82bac-8d0d-4653-bf53-fa05e373d189", "comment": "Malware payload (RustyStealer)", "value": "4156bba1cedff1d77c924e18d6061c8fa181da9195b1a79aaa6d0a52214a5769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InteriumRAT", "colour": "#AAA316", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035880, "uuid": "a1f60e8a-5525-46f9-a7f8-eccdcaef8dc3", "comment": "Malware payload (RustyStealer)", "value": "d91a856e41cd1ea25121cbf8b4f7a34e7a3d9437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InteriumRAT", "colour": "#AAA316", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035880, "uuid": "a65bbb3d-ae1c-43c9-a18a-c1af15a7f355", "comment": "Malware payload (RustyStealer)", "value": "4e2eb86aa6b9a1521c211f7a283a53a07d5e5ef1888aefd4d6c9dd25b2cbe657693f72536bb48e6e8c8d1820b2df9b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InteriumRAT", "colour": "#AAA316", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035880, "uuid": "9f4b9c34-856a-42b4-8397-341b99083581", "value": "T10A36C027F31448F8E46EC27AC7479977E37278564A6174CF52D8AB821F23B60AF2D604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035880, "uuid": "3e015041-c656-440f-b41f-778d111ff164", "value": "494a77a130c7c1945a4b4b3e97a24049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035880, "uuid": "abb89088-5774-41cb-b32f-5b7113e0fdee", "value": "49152:z+NzoddzfFcmC0yalgjNWGzzNrf9dmv3/6MWoYsF8GZMmq31g11rFYIU6i9:Guj3rQXhjW8KVn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035880, "uuid": "0e608db2-ab52-49a5-9956-b3b708a07b2f", "value": 5241856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035880, "uuid": "09a8dc6a-c552-482e-af38-d8a21dd65320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035880, "uuid": "1accc22a-1704-4a3d-a8da-45e4378352dd", "value": "4156bba1cedff1d77c924e18d6061c8fa181da9195b1a79aaa6d0a52214a5769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ba5b3a-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784023795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023795, "uuid": "f3a2326a-331c-4e05-947b-d92be2fff3a5", "comment": "Malware payload (MassLogger)", "value": "84fdec73b1259073bf7c9d48e1526a1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023795, "uuid": "7ad78fc2-8d07-44fd-9527-2f8c65a6d68f", "comment": "Malware payload (MassLogger)", "value": "42cc73e1e7e21b1b745661933a89f5386988725cd9361799fb2d1a2806c1f25c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023795, "uuid": "3f33679c-e511-4188-8f86-70addfc67da6", "comment": "Malware payload (MassLogger)", "value": "ef1f3238eb371b38787387e8659d5b1b485151a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023795, "uuid": "a30b98b9-bb33-4e2a-a40c-ab4a0d7fd4e6", "comment": "Malware payload (MassLogger)", "value": "149da6f6d0a75de007f1fca4b0f3f082c23e3129ae5c5269608f42c9545a3c9b3137991ac2588f0ac3d165d1e44d00e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023795, "uuid": "f33c21fd-37e1-44d0-b45a-1140c0732ac0", "value": "T17485F1104F846FAE8BAC1A19D07E262EF3E14AC95067BCCAEF63BD456FB670051171B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023795, "uuid": "ecec7bb3-5d2b-4a09-9588-b55831c966b5", "value": "24576:asFZVE7jtwafR8Cc67ktfIo5ZEvQjIU1m8np7/yDelU+Sq2s8:7Zq14IyQonS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023795, "uuid": "71042e49-9239-4034-a11b-116d723f5fd1", "value": 1722654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023795, "uuid": "26bb1f2a-ee00-4673-b8d0-a0e67e7be6de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023795, "uuid": "899f249a-9d43-4c86-9397-95446756b7d0", "value": "POLY MEDICURE LIMITED 25354322 (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef07432f-7f63-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784020261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020261, "uuid": "da5a1582-496d-4643-ac62-5e4c26acfacd", "comment": "Malware payload (Formbook)", "value": "3447d3e2e0bc81e693e5ad4f91f781ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020261, "uuid": "2f29be0a-08d3-4313-8127-e25e5835564a", "comment": "Malware payload (Formbook)", "value": "42cef4aba1a6bb1d35b4c279664e5586b3f3dc85731598f38e659e33f698e509", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020261, "uuid": "d32049ed-fc61-4f96-bf6f-6ab92353598b", "comment": "Malware payload (Formbook)", "value": "39ded315285cb4ce8cc1ce560b5387a1210bc652", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020261, "uuid": "913fbd4b-0279-4ccd-b8e8-0890a5e161a4", "comment": "Malware payload (Formbook)", "value": "742e75bbb05039302cac9880f2b1e73b230eea997c049b56b0a855cd9ae2cc7973a054af7a45dab36c2ebb843dc9ed92", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020261, "uuid": "594912b7-36b2-4731-9765-3de6d3bc12a4", "value": "T1C9752314D9DE97DC4910F1BFBAA5F88462D8138B0D425B1A53FDC3A036E41BCA9A3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020261, "uuid": "49ad560c-dad1-49d2-ace6-c613c26ded22", "value": "24576:hjGmy3w8HW/Zq3InxeHh4X0TmLc1viYGwH4sQ+m4aoq7yBq9lh3vBB1:hi/mZq311aY9ztNypBB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020261, "uuid": "0db415da-6964-460d-9319-3cfea955e968", "value": 1555307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020261, "uuid": "14e9ed1b-0b9e-457a-8177-63d66c8871cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020261, "uuid": "0452a598-c3c3-405f-b3d5-b437e59f2d7b", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1438da4e-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784023759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023759, "uuid": "2448b733-b730-402a-8f6e-1284b4043b72", "comment": "Malware payload (Formbook)", "value": "96242a69670eb463e4340910627e0a83", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023759, "uuid": "cae2c3d3-6018-4bd4-9a94-1bce7b89f4e6", "comment": "Malware payload (Formbook)", "value": "42db32151216db1e67f744c504117de6e133bdbf5619a09544ec198384c9bfa8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023759, "uuid": "8d8eaf8d-c775-4dc2-8772-4e1f3e7c37db", "comment": "Malware payload (Formbook)", "value": "c537c88762a1586845c8fe24235bc4ce9fb71c18", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023759, "uuid": "48ad2808-4068-48c0-9dc7-9767de8b6b64", "comment": "Malware payload (Formbook)", "value": "2b4449c531a97107fe8f593d6c79e445aade74b7cb7643a813d7f803638dfba46a701d29d112e8466c581efe6c21cb3e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023759, "uuid": "4d125b9d-5742-4a8c-8116-d51ebd0a66d2", "value": "T147E53A015758A172732CEB5DD636EE38640EA00325DDCF5D356DE228B62CE47A38CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023759, "uuid": "f6f92059-94de-4f4c-bc9e-a885b8234e9d", "value": "98304:iY1yRC6AfQLfg6SCjn7IAvKRHsNn26Z1HYneRw0NxIZIiXNaRq:h9gguMAiGNn2M14neRWIiXNoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023759, "uuid": "44075424-d639-454a-8ccd-a9cecdaf1890", "value": 3235395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023759, "uuid": "0ada6102-a4bc-47c4-b85b-c3696c02f29b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023759, "uuid": "42b3fadb-64ea-4bc0-a9fd-951d6d30b781", "value": "purchase order 4759519.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6364aa30-7f37-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784001129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001129, "uuid": "1702eda9-0417-4f14-904b-938f1f6aa7b8", "comment": "Malware payload (Efimer)", "value": "ab3a5697a67aa5556c7da45c7d2a3fb9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001129, "uuid": "06220dff-98be-45cb-bbb7-cac5ad718e65", "comment": "Malware payload (Efimer)", "value": "43434387761e5d26286c10c577077e846f65ea6074c87bbdb6dc8149bff96f2b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001129, "uuid": "98b84353-a7d3-4d1e-8211-57e8441644a9", "comment": "Malware payload (Efimer)", "value": "e1845ec8d56b22bb9ce11b71261eb1b848d41c54", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001129, "uuid": "725b7794-3c3a-4036-b9a9-1beefb15e040", "comment": "Malware payload (Efimer)", "value": "27a54dc1b5c9c45d9ca0f46a08669e8ad9482847078e9e09047e40266bf7a4a2c869cfaa55f6e0a2cf9eb3224ac7683a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001129, "uuid": "a14a8997-2698-4936-bda0-397ddad9ebad", "value": "T133E63308A3D001EDE9A34279AEE257D4E075B4670336C6EF9B64933A1D636F0883775A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001129, "uuid": "d6c37aff-56a4-44f0-b2f6-0af2bf364416", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001129, "uuid": "241c9310-1778-41dc-9494-75b574ddb72b", "value": "393216:VmG2GkkHuF9CoooXzYBzW0btXMCHWUjXRcuI3/PGTAI:VmChOFFbX0btXMb8XGH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784001129, "uuid": "3391b84b-62f7-4bb3-bcf6-a91db94ea037", "value": 14302313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784001129, "uuid": "993b7b08-4b79-4447-87db-7a9c5f3d0aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001129, "uuid": "4b448896-afea-4105-b615-3d2f1696e607", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4198c9fe-7f8c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AMOS)", "timestamp": 1784037579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037579, "uuid": "08bee47e-e86e-4740-88fa-49ea8c976766", "comment": "Malware payload (AMOS)", "value": "aad29a9edc86c712461a8efb16f18982", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037579, "uuid": "457bbd7d-9174-4fc4-bdbc-315720522f24", "comment": "Malware payload (AMOS)", "value": "43e4dfdd3c1295e54a2704158c50e1ce5913f8d700790441367cba8abe07195b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037579, "uuid": "1fa1c304-66fb-4897-a34b-cda755cc8a19", "comment": "Malware payload (AMOS)", "value": "19bce5b0c0aa099cbdae36f418db6cfaac89280c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037579, "uuid": "fd542920-89e9-48ec-ae9f-c9a50ea246ea", "comment": "Malware payload (AMOS)", "value": "546575f187fd2f5c746489518d8b2b053c34cc237872a5b84736583f336d0a6d0c5604b2681b2e5b22ffd358bdb60aee", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037579, "uuid": "6e95e99f-fad8-485d-924b-93a51b770903", "value": "T1F6947B0EFDBD6B35C58CC1BCCC674BE29138F989A91027279311B7206D9236065DFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037579, "uuid": "d7b58a48-8b58-4fd7-8c44-15cf7e4e5a52", "value": "6144:8IZrfT08puCPPu5fOH55IVGpg8x7DuAO75KgNfkpP:ZfIydPu5fQ55IktDJOogNfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784037579, "uuid": "bf0cfa9b-af03-4a39-b1e1-3fc867f9fc7f", "value": 431696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784037579, "uuid": "4245f499-03ca-4d27-90d1-4dc7cb1bb537", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037579, "uuid": "509b6e17-524a-4c6b-bf9d-73760234cabc", "value": "mdworker_shared", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6ecb49-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012178, "uuid": "eaba1d76-2d83-42c6-9006-334b334eec76", "comment": "Malware payload (Mirai)", "value": "b469d9307a5a133076c235218a917083", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012178, "uuid": "01623c47-1cc8-45c8-ae93-7c1f9aba142e", "comment": "Malware payload (Mirai)", "value": "43fa4985d8ee6192c1ef4b6e332057419d0d234836f76ebf5566a8e042f8dd63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012178, "uuid": "4f05ec14-9903-492a-aa7b-886ed3be6183", "comment": "Malware payload (Mirai)", "value": "182964913224f225b740464ccb75b23157de7469", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012178, "uuid": "ced35a6b-5941-4862-b2fe-0fdae22b67a0", "comment": "Malware payload (Mirai)", "value": "bce6700719e8db6f0f3ff8965bc182ca60c5e86d8f8cc41698b3a51157574d9fed7e5c50288f62f2cdd488a7e615fae6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012178, "uuid": "2183e8f4-49ae-4403-aa81-6e05e88da787", "value": "T119F2E00BE4D367EAE66F42381F95724F2A5C321FC79C86CCAA5031213A17F7D6D408A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012178, "uuid": "d92cf731-8d95-4fd6-b052-2090a2c8a092", "value": "768:oHYKdVDfOpm9KeQJaMsdUxwyVEoOeO5LKOz976nbcuyD7UGQRj5:oHYKLzOAQeQJaXWxvG0Gb96nouy8Gyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012178, "uuid": "0b2f4a97-c1e6-4c3a-84cb-2af179c3cebb", "value": 37336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012178, "uuid": "1bcf210e-5a0d-448f-9aa9-7fce4a84f394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012178, "uuid": "acf24c5e-17ed-4b79-8621-d83d4da1df11", "value": "zombie.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76591d28-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784033802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033802, "uuid": "366fed11-5e50-49ec-ba52-864d55f571b8", "comment": "Malware payload (Mirai)", "value": "e2ffd5389aca7ed715104fd3a9286786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033802, "uuid": "cbf22e58-b46f-4b2a-9845-6991f2f5f27f", "comment": "Malware payload (Mirai)", "value": "443b4dd8b2b8afdfdc64451905dea73eeba7e5cd7a56d035d2bc23e1bb728861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033802, "uuid": "933d250c-922b-4a12-b741-a2e367bb42e1", "comment": "Malware payload (Mirai)", "value": "beccc0283c7cee531ab0445b07f9c7f1ba7a1d16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033802, "uuid": "75184c7a-b15c-46eb-ac23-eb799fe75e78", "comment": "Malware payload (Mirai)", "value": "d2b2c11fa676410ad0f4650703fc4d0051912a2424a840b5c8c52547a84653d837db268004d3546514ed1db9bacba2bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033802, "uuid": "e143447a-2198-4df3-8756-9f781098deb1", "value": "T1C4C31889B8929A22C6D316BFFA4F42CD773663E4E3DF7107DD195B21328742A0D6B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033802, "uuid": "b74f88bd-2aa4-461c-b7db-faa9178b5037", "value": "3072:7nREVsW6L1KD5GAciU5I5aOt6ZHETYPAS1tBnbV:7nRE9EhAcioIlwZHYYPAifV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033802, "uuid": "e5aea723-102d-495a-912f-87c876401e0c", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033802, "uuid": "667bb084-5d9c-479f-b096-ca29016d1ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033802, "uuid": "54a0ca33-4462-4053-b6a5-337074ea3a5e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b2f6fa-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046577, "uuid": "3b363d33-7fe5-420f-b0fa-c581ac9e0213", "comment": "Malware payload (ConnectWise)", "value": "aa5eaae30652c27a23f084070f12e897", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046577, "uuid": "e0f49322-760e-49a0-81ab-b572ed90c340", "comment": "Malware payload (ConnectWise)", "value": "44b6d6bbd97152d4e7cd25ed49bde0f8a1c5d30c241d99c4a34f66cec3f28e2f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046577, "uuid": "7aaa9603-46d4-4bcc-963f-641dd425b8e6", "comment": "Malware payload (ConnectWise)", "value": "7a26456e44190c848ec4af15a57be6e836db01fa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046577, "uuid": "59ebf4c7-f213-4f4c-82e6-13c974b450b7", "comment": "Malware payload (ConnectWise)", "value": "d0dda105fe92fdb135c371974f7684a76447a518f80b3fc0eb2688cebc404fe81aa09dc1691e83af128ad08e3897a4a3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046577, "uuid": "eca62f5c-8bc0-4e5b-b674-4feddcafc4f6", "value": "T1B7646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046577, "uuid": "facc1dca-0c6a-4a0b-bb60-48d03a348164", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046577, "uuid": "84526662-da48-41df-a8e0-c57a754e19c8", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046577, "uuid": "697dd3e7-b32c-4831-a764-4603217b13eb", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046577, "uuid": "306fc86c-ee03-4167-8e3f-41007abdf0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046577, "uuid": "e515fa0d-4b0d-4480-b562-a6c5af8ec6d9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d684dc80-7f78-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784029239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029239, "uuid": "9ad49814-5c2e-4428-9e3d-8e0d8904b346", "comment": "Malware payload (Mirai)", "value": "20ecf8251172ba7ca0523c407c1f5c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029239, "uuid": "37f3d267-72b9-418e-b51e-7060b9ed7df1", "comment": "Malware payload (Mirai)", "value": "44fb322cb5fd16c5caad33901a4146e1b0de13d797894cf64f1c73a82ebbfb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029239, "uuid": "b33210f5-d351-440d-ad7a-e02e12cb1c41", "comment": "Malware payload (Mirai)", "value": "5df39acd265cfc57faae8072b13f5fd254b13c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029239, "uuid": "7ee48987-0aa5-4439-8e7b-f27934b39ff8", "comment": "Malware payload (Mirai)", "value": "2b02db2a98d67c2f364e4f24d54af78e4b0756ecdcb603e96954fb2349c4ecf52231ff0d9eed3513e3bd690dbf0bfe0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029239, "uuid": "892630f5-9f3b-44de-8a12-f70ca494946a", "value": "T1BAB31899B8D29A22C6D316BFFA4F428D773663E4E3DF7107DD145B21338752A0E6A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029239, "uuid": "56b1b3ae-6ee6-408f-87a7-46d1e0aaae31", "value": "3072:gLLU/lW6pdDDz8eciU5I5a9BPfJMTWLK+BnbV:gLLUA+oecioIOdfJ3KGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784029239, "uuid": "a68e10e2-d371-4273-94de-fbfe2b16ee89", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784029239, "uuid": "3bb9b2af-5e54-4d93-9116-fd4de861bbf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029239, "uuid": "6a825df3-a32c-4a9a-b4b1-90ceb33c07c8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a3d2e4-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023768, "uuid": "1a88bd09-0cb2-493f-bca2-0dc1bb97f855", "comment": "Malware payload (AgentTesla)", "value": "b3acba58a159301a7126cc3bb609a8d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023768, "uuid": "6791a3e6-78d6-43c5-8896-dbc7119b15df", "comment": "Malware payload (AgentTesla)", "value": "46055195777c8088c7800715c4561af2da0b7dd088cb12f5473af5281aec537c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023768, "uuid": "5ba9f635-5ed9-455a-a411-1082031509cc", "comment": "Malware payload (AgentTesla)", "value": "33dd9a8a036bd229cbcafc02613ccf01f7478c2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023768, "uuid": "1d42791e-c605-4a02-86e7-0586d932b7cb", "comment": "Malware payload (AgentTesla)", "value": "8ef29d693cff255f85066577d46a9617ee219eb59113dbc50767e1dfaf8bc2b2c48cfb209ceb5c82816be44a7cb2af7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023768, "uuid": "a9e73b44-5b69-4d75-8217-a7a5a8b53937", "value": "T188E507509764A1727A68E79C5136DE3C580EA0432DEACF58386ED2287D1DE0BD358FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023768, "uuid": "93559294-6822-46c2-97c6-c7932c314c6c", "value": "98304:htRx6bFlhMpi9M8kk0IC7bPQqLOBcrd7srXa+B5O4F7pNMTD4H:/RAbl5juvPFkcrd7s+4F7pNMTcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023768, "uuid": "c37d379d-9c47-44a0-a7c8-6fdbe9f682bc", "value": 3293661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023768, "uuid": "8e5733c6-1ee4-47a4-b5b4-b024ba1fa723", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023768, "uuid": "c8a0b6dc-a260-4508-b6a6-ebe97fdc1466", "value": "info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318f000b-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023808, "uuid": "c1c9e589-fe95-481c-aa2c-323a8ca9099c", "comment": "Malware payload", "value": "16299e4c749b1c5bfbfaacc521ff3c85", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023808, "uuid": "559289d8-991a-48fa-8998-256cdf84e144", "comment": "Malware payload", "value": "46bb4585a2d85b325ebc69245e373262a9de2c7a8eb552835026e2ccef140a21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023808, "uuid": "e6094fd8-d7b2-407b-afad-7938f51020a3", "comment": "Malware payload", "value": "724d1372da7d49589efefcdfc34f96ef557edfb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023808, "uuid": "4786a5a1-07ba-4059-acac-7d668ec154c6", "comment": "Malware payload", "value": "bf00f1f27b6ce0dae918a9da987c96b5fd360066ed87f7c2695ff22d010431fe66d32d0b7a4987a0d24cc85b2de3e775", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023808, "uuid": "96cbab98-26ee-4cfb-86a3-968f17468f64", "value": "T12C23C290957E146B84AE4F7C7D05634A4EFD2AD01893EC562D4E64FDCFB293802BC92B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023808, "uuid": "9916a806-5625-463f-9dc1-7251ef5ec6fa", "value": "768:6my+tP8wMYCbH+GMoInu9rie4KtV0E6gIna//XtrEGkM08ifpnMGQD+aFOc69HwE:6my+hPMYuH+GMoInu9rie4KtV0E6gInv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023808, "uuid": "3ce6ebf4-9bb8-4597-94ba-12c5904d82f0", "value": 46185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023808, "uuid": "6dab45a7-20df-4afd-b8a7-811282142901", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023808, "uuid": "6371b112-62e0-45a6-a7ce-cb5e49c04b19", "value": "Payment_receipt20k$.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2323758-7f63-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784020266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020266, "uuid": "41bcd255-e2b2-4b51-a04b-f4ade26b5fb6", "comment": "Malware payload (PureLogsStealer)", "value": "20cf573f487629d52d83e161695d35bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020266, "uuid": "23ab3468-a0ab-4b14-931f-ddf8ea96b68e", "comment": "Malware payload (PureLogsStealer)", "value": "46c393a3c3be1526f0041ce43f36ff33fc6d2520dbd13747be66c22ed88bb8f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020266, "uuid": "361f96b0-ce68-4437-8a83-28c0fb5cd21c", "comment": "Malware payload (PureLogsStealer)", "value": "646bc3a36f8acc169e75d5bb9413ff3de9a71212", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020266, "uuid": "e7d647d5-102a-4eaf-b106-95996698f7df", "comment": "Malware payload (PureLogsStealer)", "value": "0455a0b5afa335b5642ae1344cf2580c2fc41dd2e8378bcd25f166b3a2d251719a6ac6d3e0526fde4c723944ad7f625b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020266, "uuid": "29fa06ae-b34d-4441-aa18-caa00892fd96", "value": "T184362A5657A462733720EB9D823EEE34A44E904329E9CF1431DED628791CD4BB358BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020266, "uuid": "667d113f-29b4-4d0a-9e1a-1798d262b727", "value": "98304:AUG8ZW1JL3Xzlw7O0Gl0YzGPdMHU8Yy838gdaSGjDC6xlVVDQq59Ae2MFF5Y4DGO:C1J7zlwCr0YzGPdMHU8Yy83vcS6+MjVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020266, "uuid": "f285f066-57e6-45eb-ba65-8769099e9835", "value": 5221511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020266, "uuid": "64c786b9-54c4-4362-bacf-0a4cc55e5e30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020266, "uuid": "08b14cec-62f0-4147-a27f-d332dfdd7f9e", "value": "goodness.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ac226f-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022235, "uuid": "746dd1b3-75ad-4119-a022-f6d07bd4d798", "comment": "Malware payload (AgentTesla)", "value": "7ec887b0b4ababc2c3dfc0384367d303", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022235, "uuid": "a3dd0b67-4148-4d6f-9755-696a368cfe04", "comment": "Malware payload (AgentTesla)", "value": "488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022235, "uuid": "d907d306-1d8d-4342-89be-0adf2d15af78", "comment": "Malware payload (AgentTesla)", "value": "d97cbeb144306bc49610d57e5043d6a779c86588", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022235, "uuid": "9fdc0a7a-df97-47fd-8f82-83cc1d8569d6", "comment": "Malware payload (AgentTesla)", "value": "bf2ebc9d412c48fa779875ae1271f7fb7260030fe7e0f2a0182dbedb15140d210e66f277fcd03d9d65105ba60502b3b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022235, "uuid": "034d4be1-976d-4572-83d2-f80254029434", "value": "T193166C405E9CA782B9FCC718882EBBF10D1EC817A554DF47315D8A9E1A8DF06339C69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022235, "uuid": "7a10bc8c-6069-4e05-a354-9a1cdbc4aeb3", "value": "98304:vzCNYt1llGbxmgeFmBdBiMqJgjuGoUE5gwSP0GNQ8E4gmUq:vzt1lQbx2iyMqdUmglPxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022235, "uuid": "4e2cc3c8-5aa0-443c-8cf1-19387925f741", "value": 4056536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022235, "uuid": "be305cdd-0cde-4f49-9967-5f81d4146461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022235, "uuid": "1fc98ede-ebf2-452a-a25d-ab562dbb163d", "value": "gjawhixj.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc5c16b-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009283, "uuid": "0b43b746-f016-4293-85c4-93eda2bb84cb", "comment": "Malware payload", "value": "3a27b96e0f53c738f8501e758e1d32f6", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009283, "uuid": "8be77d5c-633b-4e96-94a3-1e903b6df7d8", "comment": "Malware payload", "value": "48f453cffecb38b658e1ce1f374b49b1a7cdb56de2e10190c4c1150c947a4bd7", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009283, "uuid": "2ec4d6a8-144e-411e-b233-81f19c72eee6", "comment": "Malware payload", "value": "3207191636d0b5e3fde5f804815d40b717ec20a8", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009283, "uuid": "5f76ea45-5c47-4c14-990f-3eea77c1491c", "comment": "Malware payload", "value": "c39dfff22d1f03f43cf2e6f3c57cfd94b1e72176f8a99c1050cb50e6e06e6aaecc49633c0389702c186ccb628f363f2e", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009283, "uuid": "3a29f3ab-fe85-4c9b-b7ed-65ebf3ff3610", "value": "T160C55C00EDDA95F5E4413A3235A7B26F733A654B5F3F8E5359202D646A3BBA13C33902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009283, "uuid": "41f61657-48d3-42ea-a1aa-1345fe500791", "value": "e8c28134163fa189336ed64a759c7015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009283, "uuid": "0fa606d2-cc7b-4e44-b1e3-79cf3ac096cc", "value": "49152:hINnby75pDFAtrJJ4DjNuUrMNJPS8e+se6DUEEqCXbEbsu0:Wlby75pF8sQpwJFpau0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009283, "uuid": "dfce2628-7359-4223-a252-95abcc230498", "value": 2735392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009283, "uuid": "3348c023-9717-46ff-bca8-22c58a639de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009283, "uuid": "b005ccb3-d820-49b1-bb17-6daa9ffd63bf", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8c47e2-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784031880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031880, "uuid": "44656c1e-de10-4264-8624-ca3b57952642", "comment": "Malware payload (Mirai)", "value": "104ad433915de7e5fc7e55fa16a15036", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031880, "uuid": "5746e183-9110-4bbc-9d14-b1a7001250dc", "comment": "Malware payload (Mirai)", "value": "495b8eb171985c7237bef985691ad171185f7e7c36638053c217b90882cdae5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031880, "uuid": "e267455a-40b6-4b38-86a2-52b1009b8369", "comment": "Malware payload (Mirai)", "value": "7a22ae7b908718fca80ae93443ac0a4d2fe8de2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031880, "uuid": "6a8dbb5d-a96e-44ff-ae33-a14408de40b1", "comment": "Malware payload (Mirai)", "value": "fc99ec595f86213632384264ae8d662f104a0fa7f6a5d07d46bddb3a0590032b033a8487469d584510bacc54ec5304d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031880, "uuid": "c64ca71e-e473-44cc-8491-aa6903e0958b", "value": "T13FF3D62AEF601EF7D8BBCC3791F98B0924DC655A22A43BB57534E424B68B44F45D38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031880, "uuid": "252329ac-7917-482a-a574-1533189947e2", "value": "3072:sXrZ9YhwB8qGnG1jrhPhWn+OdI7piSCZhBnb5:8PYhwnGG1jFPhG+n7pY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031880, "uuid": "1b0768cc-35eb-435b-8b51-8cff5d3c041d", "value": 160372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031880, "uuid": "a89e1d51-2d24-44f1-bb9b-3534b85633af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031880, "uuid": "7e17a62b-bb03-42d5-9137-9faf9e33e12a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeafe940-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784022730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022730, "uuid": "0252d9df-4e90-4fc4-bac5-dab1ab78ea0c", "comment": "Malware payload (Efimer)", "value": "071115ffd93938e9703e32d309dc887a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022730, "uuid": "c72daa1a-2a22-4cfc-992d-80bec0639ed1", "comment": "Malware payload (Efimer)", "value": "49e4ba4a041e13fd07567d4f5be07a4d9b26b356546ae1ba035dff0719c2ee63", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022730, "uuid": "fdd94c84-102b-43ae-8c35-df7eac378ea9", "comment": "Malware payload (Efimer)", "value": "683d65ce0d91e87a2caa9a7591053a34b9745972", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022730, "uuid": "95dc0835-4bfe-4216-9f9c-7a485a462879", "comment": "Malware payload (Efimer)", "value": "20f4cbe93318726fed9756198ae53bb0c9a9916fa2de0512689c74ebc4f824bbb6a98c1a7fe849e2daa45e1e491cce62", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022730, "uuid": "2b358b60-5702-452e-93c3-dddd8309ba78", "value": "T111E63398D6D506FAE9A3513CEDD269A5E8A570720733CD8F135C93B3BE0B0C14A3671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022730, "uuid": "69482a8d-2a40-4497-9bbe-2ead37083ec0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022730, "uuid": "6ab5c6c2-1875-4564-bb61-40605cf9b168", "value": "393216:LgJbKVvx5ecHilgrfvQOdEFXMCHWUjXicuI3/PGTAI:Lg9K97LCyrHQ2EFXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022730, "uuid": "1af054fe-3400-4d9c-8757-d7b12a891efd", "value": 14276180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022730, "uuid": "070d8d6b-b91f-489c-b8aa-d93c5e198819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022730, "uuid": "db8fcec8-f3ee-4631-a722-2b53c842ccc5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc2187d-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "b7667a6d-3aeb-4d54-9bc4-5ea5d847de2e", "comment": "Malware payload (Mirai)", "value": "cd8903c13506b6ba7ff0684e866c0857", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "25b398b2-47a3-4a71-b970-28f870d4fb84", "comment": "Malware payload (Mirai)", "value": "49e589bb03940157f04834964a87650a8f640e7a20d542cbb5d1e2bf5e4fc540", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "1634e572-de89-4b7c-bf0a-10b61bb7cd57", "comment": "Malware payload (Mirai)", "value": "94b89ab2f2b509a58645176c688355ef660b2443", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "acda4dda-4a81-4153-93b2-737269f52713", "comment": "Malware payload (Mirai)", "value": "5e62a5feb59ab8e38956e8a0b920f07e8bb905ed88d643c17c7c9b5adf206e0e5094cd9584bf2d695360d7a7ac5a1e5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "8dcc6e20-2845-4452-932d-1ccffe267d01", "value": "T17B834BD6B440DD7DF41FDABA42260C0AF930A74159930F2B6727FE83AD731A4892BD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "e7de8959-3bc0-46a7-8277-2d177c5a723b", "value": "1536:M+IxRF7Hoaz5fJdUaQfGa/aGZ8jD7Ew4hW8VEFlMTb4Na+vDc:Mx/F7Ho2UUMaG6oW8qFamvDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012179, "uuid": "51679b85-0c7a-4dfc-80e4-c7cb8daecfc4", "value": 88080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012179, "uuid": "65b60956-e120-432b-8022-c1f5f9d2b397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "a3e910c5-1eb6-49f6-ac51-4c332695c19d", "value": "zombie.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf1418b-7fa0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784046351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046351, "uuid": "dbe4bd62-aa21-4a13-bc0b-7dc5cb70ceba", "comment": "Malware payload", "value": "7e42871b165d20d0ec5f391d9d49be60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046351, "uuid": "7b64f9d9-b8bc-4f7b-b688-bac63c9f13e7", "comment": "Malware payload", "value": "4a3d1b9df22e50a9556d7161dc36800eb37833eca26057036d34e5be27f4df6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046351, "uuid": "f7ed224b-9d05-44cb-95e8-35b64cfddebc", "comment": "Malware payload", "value": "eb6bdb5f668bf5e848d27f278e9b5558a716cd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046351, "uuid": "e80dd50c-b1df-4a77-8418-2dbadc2667f6", "comment": "Malware payload", "value": "24b89eb6b63c1fb40248b92c434b7e82d03c25b875e5d658c03f26c1f2bac6f0c52b02b4baca951fffd62c143eb4dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046351, "uuid": "daf4432a-4998-418b-a8cf-2198f60e73a9", "value": "T102D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046351, "uuid": "b7dd27ec-3bf5-408a-8efa-445bf36f59b8", "value": "92576cbf961890053b0276abaa28bb78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046351, "uuid": "9edc46e9-d7be-49e1-8284-bb796bd44079", "value": "12288:yNH+AxETh1IpJWIf9KvvGQJClDeSF6X0j:ykAqTXCJDWg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046351, "uuid": "9991117b-e149-425f-92a0-49e66b7e4340", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046351, "uuid": "b160f662-0db4-434b-bcb0-86f4057f82da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046351, "uuid": "6a3418b9-4290-4540-83fb-3cd96b3f0dc2", "value": "SecuriteInfo.com.FileRepMalware.11498445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7980a611-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012333, "uuid": "07fe855f-35d2-4dd4-92e4-7a526c994b48", "comment": "Malware payload (Mirai)", "value": "172aa4b680025bf775dff2a30e37f868", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012333, "uuid": "c71c4e6a-521c-49b3-be60-523f08745e3a", "comment": "Malware payload (Mirai)", "value": "4b75b5b20eb2d569c5b253b286d94a337053a17c33a7082490e09ea575778f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012333, "uuid": "bfae5d32-b7ea-461e-8ee6-de012b8004b8", "comment": "Malware payload (Mirai)", "value": "1bae7ba1c4b43e1d92ef2cf71575df7674e8d40e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012333, "uuid": "a4443030-3739-4d7e-ad28-536b17478d2d", "comment": "Malware payload (Mirai)", "value": "551ef96280a4c03e7e9f2db744a3ceeef36c5979b16459a5398f834850c71aa0db30d6d09f11141a125ba3c428d42ad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012333, "uuid": "0d0e5743-f643-4e91-add0-2df21fb5c4f6", "value": "T138735CC9E583C4F5ED460CB520B6FB76C5B2E63E2174DE93DBA8A432F912502E1057AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012333, "uuid": "523e99cd-576b-4c98-9768-607437cf3882", "value": "1536:9AQzYlWXitrqUDy+KblBQ4WdESi++dPzHtsE0MSzO:bzYESydbg411RdPbt10lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012333, "uuid": "87d543d6-5727-463a-ab2a-15afa2e0ba2b", "value": 78928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012333, "uuid": "860f2312-f1bc-4051-ae72-bbfcb40e773f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012333, "uuid": "73c9c94b-e557-4541-aebb-619beb41f511", "value": "zombie.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9127d720-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "3f4f0385-4f27-4f27-8212-5023d9444698", "comment": "Malware payload (Mirai)", "value": "2c56f60c9f9b05b0083a5c040a9b437f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "5f11549e-c439-4efe-a4cd-06619df80e6a", "comment": "Malware payload (Mirai)", "value": "4c70fa88fefd0a1e8b1dd37c241ef386b80134acf8ae68deca2fb833b1c66c98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "10e27f23-b519-4a97-b621-604fb345ce8d", "comment": "Malware payload (Mirai)", "value": "1d6bfe062a7d47e01c5c0c1ad0f023560e84350a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011943, "uuid": "a9cb331e-9c49-402b-823c-0072c4d4800d", "comment": "Malware payload (Mirai)", "value": "8df9c12cae8a6bc12141a8e69a5dcd9036e939ba8f027de8fb3d6678aecd74f20a27509b39fb4c04fe6d575beb95ce4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "c54ef71f-b2f7-4ca2-8a20-0249160d15bc", "value": "T16041F0191FD01F27DDA6CD36454B2B5229CC841FB16623526734D8A0BE3F605E7D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "3a0c6148-37ef-4159-8260-183f8710e84d", "value": "48:Ut2MruDu2si6df9ouS8TLGPkuTgKFGX5:UtlruShf9xSYLGLTg5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011943, "uuid": "80c73cc8-7ac5-4f57-903c-ba412f18ecb7", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011943, "uuid": "89ae7bd0-2cd5-44ce-bea4-8217538425a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011943, "uuid": "4b63b4db-2d0a-4925-b239-97d7bc5c1b8f", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99190e36-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784023982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023982, "uuid": "24cc2dce-9f87-4fad-89dc-2555f5b41cd9", "comment": "Malware payload (PureLogsStealer)", "value": "4979845352bb4c1a1e49b064630b3c83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023982, "uuid": "1b69a05d-ecf6-458a-80e2-76ba424a88f4", "comment": "Malware payload (PureLogsStealer)", "value": "4d76c51c3a31ca52cf42783972e168f0804a1b6aef5f068effa69b5701af8d92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023982, "uuid": "6224944d-e928-47e2-8201-d7af2a02556c", "comment": "Malware payload (PureLogsStealer)", "value": "5414acc6aa4d828b031ef0853b2007f26883d0de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023982, "uuid": "59c7bd4e-d4bd-4d58-9d2e-a7a53c9e3a0a", "comment": "Malware payload (PureLogsStealer)", "value": "a334b63be3e1b88664f823e4f4eb2bf5bc2ea6b338f0fa7d93f0045463f2ead8e06af260246a616ea6f7726355a3e071", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023982, "uuid": "92bb72f3-eb23-4351-9abc-9741fdb86d0f", "value": "T17185392C8551E82188B2EF38D4D806CBFA9B2B61733AED4C51E4178DC753549FC9A63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023982, "uuid": "46a693fd-da50-4e69-95a3-569afd8631f7", "value": "12288:o6v8tZqFSSZ1gErXDCq9jfIEvOBKL2l+JP:/v/6DjCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023982, "uuid": "5a591491-d1c7-4a7b-ab27-bec088cc8223", "value": 1801716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023982, "uuid": "2e7ed7ca-caed-4527-9875-7ea2a62d242a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023982, "uuid": "62a7edae-f46c-45ef-9752-fef16a921fc9", "value": "6586004829.988493.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097b07e8-7f90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784039203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039203, "uuid": "9b4eedf1-39f7-476b-8f4d-5da10d347a2f", "comment": "Malware payload (njrat)", "value": "2f577ce224d2311a841d8d76abb63b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039203, "uuid": "9b310876-2ea7-478b-a8d2-4b280ae1a632", "comment": "Malware payload (njrat)", "value": "4e5c8cedafeb1be4d6d1719cc913d5e13666c8b67e23e0c29f94baff0c00ce45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039203, "uuid": "4573a90f-168e-4141-9b22-7988f4e2f11b", "comment": "Malware payload (njrat)", "value": "e8c9bae6dcae34bfb51c0073d89b7f2d944f68c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039203, "uuid": "d7f53569-a919-48ec-8d32-73307dbbc31b", "comment": "Malware payload (njrat)", "value": "c480c31d2601666b29178ad1fa297094ffff9369e94947613d90366ee812bc22f3d71f16bf6c5de0f611850070fbb7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039203, "uuid": "2a4b8742-2c9b-4457-a7cf-a3c060b912dd", "value": "T15EB21A4E3FA98856D5AC1B748AB5965003B4D1470423EE2FCCC464DBAFB36D92D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039203, "uuid": "d19861f7-a3f5-4598-807b-7531d3a906f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039203, "uuid": "84892ad6-9512-420b-b258-a69a6c1ba5f8", "value": "384:o8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZLc:nXcwt3tRpcnun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039203, "uuid": "c0ace472-f7d8-405c-95cb-99a9dab76fc5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039203, "uuid": "5ceb52f2-84bf-48de-99d7-916617b5b05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039203, "uuid": "bdeee525-057a-4be2-9474-e032a041b409", "value": "Meccha Chameleon Auto Painter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d866322a-7f9e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784045563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045563, "uuid": "4b0fe11e-ea8f-4327-8038-9af52eaf7d0d", "comment": "Malware payload (Mirai)", "value": "708a18776922f9f955fc81c0fa4d438c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045563, "uuid": "b6ef67a1-6d83-48d7-acc3-717161af4819", "comment": "Malware payload (Mirai)", "value": "4ec5a94f92dea1d81599c4792c902075ffc2e2afe94e80bb48f40094080c34e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045563, "uuid": "2f6ca0ac-3404-4364-bcff-2403927b6813", "comment": "Malware payload (Mirai)", "value": "7b502ebd503b3480b62c215157cfac0c280eacea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045563, "uuid": "e56df919-86c3-4392-9e93-bb981d87531f", "comment": "Malware payload (Mirai)", "value": "c2d42d2fca15014d4e0f2ccfd354b8b4fb565eab6472fd27b7e3e0b2476109cc5a7d75cb500562a3f1cc0326b4aaad31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045563, "uuid": "9dd5310c-b7dc-43f0-8535-d87e47cdda65", "value": "T16CB31889B8D29A62C6D316BFFA4F428D773663E4E3DF7107DD185B21328651A0E6B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045563, "uuid": "d3454006-ab9b-42f2-b763-fcfbf538b2ee", "value": "3072:OLSGJF7sNvZLuNciU5I1a2UmCK7l3C1y6Bnb7:OmG4hscioIJU5K7Iyq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784045563, "uuid": "5c9630b1-d8b5-43fa-88eb-e79e22c43b69", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784045563, "uuid": "dbf2df76-a698-45dd-a8d3-81f0ce80b189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045563, "uuid": "27588921-9407-4f25-8bc8-bcb69968224d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2216dd2-7f66-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784021555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021555, "uuid": "b4ffa598-0c8d-4fd8-b408-341710532122", "comment": "Malware payload (Gh0stRAT)", "value": "f1a04ffaa889c11b99b33610e4a87dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021555, "uuid": "d5819efd-5546-40ad-8dd9-c126e4f1a7b2", "comment": "Malware payload (Gh0stRAT)", "value": "4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021555, "uuid": "0376125d-5cec-44d1-bd3e-0ffd520c182c", "comment": "Malware payload (Gh0stRAT)", "value": "199af4936e44ed894ea45b84500a84268792dca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021555, "uuid": "fed6ddb5-32ab-490f-8247-bb0f53d148f8", "comment": "Malware payload (Gh0stRAT)", "value": "088d765cca058374c7ffe57c12726b3e2aa2a1f42974119b135643eb7694568bca08dbd369a16b5855a32457f2f92541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021555, "uuid": "22ac6f98-33a6-41b3-bee2-4dc58c41e336", "value": "T122373323B2CF653FF0AB4A3549B3E223547B7A605A224C96D6E448ADDF295D01D3F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021555, "uuid": "cb10864e-2536-46b6-b0a9-f99a6a8ad669", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021555, "uuid": "4ce3e1d5-db51-43e0-951e-0dc2c7974fdf", "value": "393216:7WGgjUOyE/f/v+VuhVguGX5HqzEjd4GFxR+QChJnB+jqAHTp5czl3nDdovwpkvfG:KGne/mIuuGj44CLMvTctUwph//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021555, "uuid": "513a2702-856e-4040-978f-3aca813e0505", "value": 23934585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021555, "uuid": "6f83e308-8d13-4295-bd20-14ea407e7e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021555, "uuid": "bfa3ac2a-7331-46bd-bc85-50e540ea2b55", "value": "Government Project Preventive Measures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100bf820-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022034, "uuid": "d455a66f-a10d-4e41-be13-8594cee1c7d1", "comment": "Malware payload (AgentTesla)", "value": "a4ba482014b7881e331029d59c1fd739", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022034, "uuid": "ea8b8353-242a-403e-9448-eb69be2e1695", "comment": "Malware payload (AgentTesla)", "value": "4f78fc5a1fff341c00583c7276902f0efb6a9edefe1bbd327d72fa1cc7311eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022034, "uuid": "553d107a-e2e5-46b1-aff0-28d7b109ad42", "comment": "Malware payload (AgentTesla)", "value": "87d1fe176708d762d7c4218a71ff2ba8e0098c63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022034, "uuid": "9c5b595f-c7f9-4695-8432-7041ef6073db", "comment": "Malware payload (AgentTesla)", "value": "553859cfce0644de6305583b210a7255cda6b4d680c158ad9fb0e62d5413b854feb581076a74bf71abfaf61f8c429002", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022034, "uuid": "01971913-e800-4296-9b2f-01f7734f21d8", "value": "T16B340F027F88EB15E1A97E3782EF2C2453B2B4C71733C60B6F49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022034, "uuid": "bc975637-ad34-4f4d-83b8-497fea1f4a78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022034, "uuid": "64c1c018-8f0c-409e-a61a-b58a1beb9864", "value": "3072:7YrKayCK3qwf6i+L+5IkGTHo9rG8KaG5jnThQSoufzz:qKayCKaoZBssq8KaWTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022034, "uuid": "1b35d42b-9187-4b24-a106-1a8737c4e320", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022034, "uuid": "662bda39-15f6-4963-aaf3-60815affca2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022034, "uuid": "9e691ecf-71e5-4922-9b3c-a8010520df53", "value": "4f78fc5a1fff341c00583c7276902f0efb6a9edefe1bbd327d72fa1cc7311eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20220925-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "cef8d18c-9c50-4cc0-8b66-8b3c0702263a", "comment": "Malware payload (Mirai)", "value": "05fd825ebe1c26cf3b680b476cc6f97f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "c097e640-4369-43e4-85de-9cad1322d2ab", "comment": "Malware payload (Mirai)", "value": "4f922c20bae3feab0f84a4481568274ddc28c19300937646363b3c47ec709923", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "3aa625e5-9a6b-4891-9f60-836189bd3265", "comment": "Malware payload (Mirai)", "value": "73bcf0d97135d9197e3b899dfc2572a88b008053", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "844ac911-84d1-4319-88bb-99d027c41ae6", "comment": "Malware payload (Mirai)", "value": "9f819ca1cc923da04f95b1698556f37c459061d5418ab7d4f78e475c21d51b952201c359b17695de096aec11a27629b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "cc498c9e-b126-4889-9666-232abf8ad49e", "value": "T146835D31F5792A1BC1E4A07B21B7876AB2F5460F24A44F6D3E350F8EBF61680274B5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "c87e7d71-c86c-4cd7-aa74-60fc5179b91c", "value": "1536:WuJdoF45jBiBWnDmZCFqDbCJ06c0sqAJnkoa3a2QZQDNk53QtbMV:59izO0J0sqAJnkoa3a2QaDNUiMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012183, "uuid": "58746945-63fa-47e5-a4aa-9a978d20761e", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012183, "uuid": "490ee30b-a3a2-4bba-b855-5693aac635d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "7a5e9de4-224c-49c4-9377-c88607621cf5", "value": "zombie.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b5c87a-7f61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784019150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019150, "uuid": "b9f0f8c0-8101-49f5-a2fb-f4ae6e3a2bb8", "comment": "Malware payload (Mirai)", "value": "5840c1b429abf6b343ebb07b93f5f86f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019150, "uuid": "e0cf5544-498a-4e76-b4da-dd8ac16342f2", "comment": "Malware payload (Mirai)", "value": "4ff1bf2128d03a04412f0619e102e2cbc400174c4e7a51f2f7f1d8dcdb089753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019150, "uuid": "e82485c4-055f-43b2-84f1-d3e535128e7c", "comment": "Malware payload (Mirai)", "value": "b136ed8b1bebc78bf43fa37edc13114eb65b6eca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019150, "uuid": "3f0db1d6-9ce0-459e-9d67-12b0d7a35080", "comment": "Malware payload (Mirai)", "value": "ba8668d45d65b15957c86a984053588585b8b4a47cacd16f3b7fed4cc96ccb44cc99b80cc9bc5a78955e99aa58523887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019150, "uuid": "a2ee80da-5920-4bc0-b772-b720dba32c81", "value": "T11AF3D627AF602EF7D8ABCC3781F9870924CC655A22A43BB57574E424B64B54F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019150, "uuid": "7852d771-3511-4d99-a770-41dca558609d", "value": "3072:RvVdB5Ud8ROeRHVX4N8Adx0uxhf7Bnbe:F55UUOeRHVX49dx0ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784019150, "uuid": "5bfb2925-13ca-401f-b856-277b651fab60", "value": 159356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784019150, "uuid": "773ec506-cef4-4e31-b494-b1d5c6141d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019150, "uuid": "17e31f22-4948-49fd-b62a-7d59e69efce5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee35617d-7f1a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783988906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988906, "uuid": "2817dbf8-17b4-421b-942c-0bb657b068af", "comment": "Malware payload (Mirai)", "value": "0d53656eb44d807a69b41c6c1becbe65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988906, "uuid": "4178d52a-996d-4bf5-bb40-0db451dee4cc", "comment": "Malware payload (Mirai)", "value": "50bbda75075dc0030f4bb96ede4c874e21812dac690c2d0ed0ceb7474e967a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988906, "uuid": "30b25e69-455b-491e-91b8-4bec932af7a3", "comment": "Malware payload (Mirai)", "value": "2bab912b8c816b8099af80cdda78cb5d4c0c665f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988906, "uuid": "1c7fdfb0-dc06-410d-8ae3-cdeaa67ac16b", "comment": "Malware payload (Mirai)", "value": "bbb3c1a020a3a0a280137ba69ef79960eb5d61346338ff1c982163f9a7bdd5abe9b33d782eb8388d9729580030bc1a3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988906, "uuid": "a15eb3ad-6e17-4267-8c8b-cd9791c276bc", "value": "T1BB849FA2A41159CFCE4089BA736C4F3563822C70C21B1FBD5E568519A28F8DFF1D6BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988906, "uuid": "187a98a9-d61d-486d-a8a6-d04156fc0969", "value": "6144:kFolo7L7T5Xk5B5jVF9tQy3rWVdkYGvXZX:hS7L/5XkV9t536VdavX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783988906, "uuid": "98fbf588-6089-4e88-ba86-c32df04d1cce", "value": 375636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783988906, "uuid": "72015803-e4c4-4224-8176-0d99b78d95af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988906, "uuid": "43c8c246-4dd2-4b67-b044-26cb4d72a206", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd2ce7b-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "9bb1e9c2-f961-41bb-b83e-b80fa1f40478", "comment": "Malware payload (Mirai)", "value": "c83272295fe8b5f6d3d95e3c86c81c51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "ed753dc4-d348-4e5c-bbe9-3fa1d84e8089", "comment": "Malware payload (Mirai)", "value": "50e82cefaa3b85b174035edddf504c03a35f6c9ab5582cd08cecc9d10446ede6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "9c79823b-0aaf-48cb-bdfa-14af3932a84c", "comment": "Malware payload (Mirai)", "value": "c16145fe14abab142205d5f9df6802d31bd6d7f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "57ca6463-2658-488c-8572-a2d85f14c331", "comment": "Malware payload (Mirai)", "value": "09705eb17fe7604138fde42a2a91919f5b57868fc9de4d55cd321930c21b8beaa257237072d38243b61555a2a84deb31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "9e2753f6-4ab2-41c1-81a6-23f41a7843d1", "value": "T1F1C2E1328955F8A0C6202136D67887DBF309113EE1FB21B6365E4BD9E20905F347656F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "0ff894ad-9e1e-48d9-ae05-772e05ea0c08", "value": "384:4fVYab63jx8ILVoeAMm7y+prbRl3VGx+HxRQC3Ze/nE5+273LxWVOhymdGUop5hy:4l2mILErpPRl3Qx+X93Z0YhW0s3UozrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012176, "uuid": "380267c6-90de-4abb-9720-fdab2d72afc9", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012176, "uuid": "78720bb8-6901-4e19-b127-1dd5adf50c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "4d831bdd-260c-4bd5-b253-60d7cee3d545", "value": "zombie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f58648-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "2ac3351f-e9fe-41aa-91c3-57d46b1d9299", "comment": "Malware payload (Mirai)", "value": "57b2748922b86acf0ae633a729b48940", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "38e3e508-a832-4e3a-9743-632d71d34a7e", "comment": "Malware payload (Mirai)", "value": "5273a654e9c48983a72da42834c3452030558e09d6243d43fcf2ee92fa9a48b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "e0eb3997-f3d8-4c63-8885-55f891ca2883", "comment": "Malware payload (Mirai)", "value": "03f9d7f041d3d8c96741e56c01cb7461ae540d8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "66611f77-d97e-48b2-99f4-30342713a61d", "comment": "Malware payload (Mirai)", "value": "e04d063dd5a16eef2367915637f57ef1ee3e5aae17c64f3467f873ed408ffd0f1439b010812dceb77b5a7fd51b2fce74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "064f5699-c095-4132-b27c-7f47225cc396", "value": "T16104891E6E228F6DF668873147B74925A76C23DA27E1D644D2ACC1106F2039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "e77fcf8b-5b1b-4f6f-8dba-3f7ab96f5e09", "value": "1536:lP8BxDrpL3srHMqGQe6ZUa29gHh2iv22UgLGyN9ek6DTbw6SsVTBPow0rhrUTLZW:KfpLbbfgHciO2UgLbNR6DTlv10rhgRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011953, "uuid": "bdbd8fa8-eeb4-4f5d-ba12-e0752feefa5d", "value": 173752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011953, "uuid": "1cc674ce-f4a6-45d8-9986-0994fc5d1854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "72ccbb82-2f50-49c3-bb4e-863cd6897ccb", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0a0393-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784012523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012523, "uuid": "4523b99f-fe54-4649-928b-6c6c854fd667", "comment": "Malware payload (PureLogsStealer)", "value": "edb98286a8925e56c38464eed10f6718", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012523, "uuid": "8135ec3d-42b4-4b1f-8a74-942573ecfab2", "comment": "Malware payload (PureLogsStealer)", "value": "527e5cd765d07b7364e94e4f5a407b3c4198e5a185fa47a29d9c7cfdebc299a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012523, "uuid": "4d3232a8-d660-44ad-bf88-925e8098c9cc", "comment": "Malware payload (PureLogsStealer)", "value": "a7cd1d422e65c0b5a12538bf7742534d44084335", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012523, "uuid": "612d6819-4928-4e8b-b4c8-1ef9dbd7b36d", "comment": "Malware payload (PureLogsStealer)", "value": "705eec2b54ea5ffd0eb78a4faf7449b89469674bc37fe5a479a82e564f50350cf623de28ab733aad9427d42727390baf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012523, "uuid": "a0dbd5d6-0620-4669-8162-b01a94ff9060", "value": "T12D463A4267A9A2737351DBDD873ADE34940E900329DACF1072AED628791CD4BE3587E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012523, "uuid": "36dfcfa7-6f97-4bcd-bb6c-dbb4d7c61589", "value": "98304:eQjrlC3FzHVgLWxtXdeWZ2gez8YwWA5iCB7R43EoiuHAlU3OA5olytB/WJqQbQls:V0NHVgy7teWcgeIvWA5iCB7R43EoiuHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012523, "uuid": "998e56cd-f832-44a3-9392-7aec3fd6d098", "value": 5363511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012523, "uuid": "c77094f8-6e5b-4396-998c-aa5391153e6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012523, "uuid": "29949f29-8ae0-4cc8-8399-86f646f2182f", "value": "uneedbestthingsfrobetterplacescomingforme.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd9c357-7fc6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784062433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062433, "uuid": "203535d3-1455-4268-b14a-4dca014cfcc6", "comment": "Malware payload (Mirai)", "value": "06c1decd0701baba3c3b11a4c98b4106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062433, "uuid": "2089ea1e-11f5-4187-820c-0d6c564a1a37", "comment": "Malware payload (Mirai)", "value": "52829b64caa9ef53e8f600b1e286bd06d24ab70eeb284d8289f41b73d58f28dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062433, "uuid": "2f4c7688-8863-47bb-b364-15db8f67c775", "comment": "Malware payload (Mirai)", "value": "4f9168d28b58ecdeeb6df90436ebcd25bcb2809d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062433, "uuid": "5c275523-e2a1-49f3-89e1-b855aaefb151", "comment": "Malware payload (Mirai)", "value": "d2fee5e896b9d9fe42ce1ca8c75962a350aac6a88db237d90eda73a575291750e7a91e47a22171fa8d86b9084a655ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062433, "uuid": "e1bb3b8a-51f4-4d6e-988b-535328780afd", "value": "T179C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062433, "uuid": "7fa51bc7-39ec-4808-87d9-27e53ac8fde6", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiymw:VoRNjmj1VGFVrRiyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062433, "uuid": "47370d09-2972-49e1-b709-ab56d9ce5c7d", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062433, "uuid": "acea6f6f-e99e-4f42-b457-0eff0fb2c868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062433, "uuid": "388367e6-6f9b-46f4-86f9-ec22b62e2e5e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f304eba-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "93898d2d-95e2-4461-9589-77330b42a068", "comment": "Malware payload (Mirai)", "value": "6a6ac7cfe7c0c21fbe85a7852dae9f84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "6ba39f2e-2db9-4271-8ae7-d7a3e453431a", "comment": "Malware payload (Mirai)", "value": "536dac76f23d5839c61c8838f1cb129e443bfe4778de2b6512784e660e6e3d8b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "63a5d384-4102-4ddf-bfa2-58f4d39179c7", "comment": "Malware payload (Mirai)", "value": "0ca022169e4dc27a1eb8f4a82b724084b8ac1145", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "88867833-6565-4793-8aaf-bf4712f3f1dc", "comment": "Malware payload (Mirai)", "value": "5f0941f12aa3ba7ec1a33679d5232902c1ff4d54d03673060369628293f9c56570d904bda93d651cac845d9b4feaa062", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "5eb3158d-df63-4825-b26a-67b065922524", "value": "T1E9F2F14EF4B10EA5DE6ABEB0CEE4C5D17BD45EAD3711C1433224AF920293616E2A1ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "cb5f4276-077f-42d7-a4f3-b52abc599452", "value": "768:gYKLs0ReC7f7z40hZr1aphETmOUOZBa24uVcqgw09v:XKLs0gC7f7zbaITmOUOZBa24u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012181, "uuid": "913fc38e-33d6-412a-a55b-5a993e054388", "value": 36024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012181, "uuid": "14b6c101-a19d-43b9-839a-f0f641ca3ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "03e0c196-863e-416a-a899-48d0a2a9b1f7", "value": "zombie.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c502a0-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784023676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023676, "uuid": "fad75ad3-2630-4d64-8ceb-6a6b67fbbeb2", "comment": "Malware payload (RemcosRAT)", "value": "27393af24a8ac28eeb0e63ffd5be2651", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023676, "uuid": "f4067ffd-1a03-43b3-bd9e-799a44f4605e", "comment": "Malware payload (RemcosRAT)", "value": "55504df33a0196066494d26d6f8c0533391b220630a9c800c7f1eb0cbc776ce2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023676, "uuid": "71d08732-ca32-44ac-8f48-2ba328e79a53", "comment": "Malware payload (RemcosRAT)", "value": "56ea1ae3e6db4a35cd8e12caf878c73c492f305b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023676, "uuid": "3f2274e0-2254-402e-865b-5e0feb32be33", "comment": "Malware payload (RemcosRAT)", "value": "aab67e87b00a453afd42486ca05b0c9d1e7c68b7140dc01d87fd72f0ba69fb499b60701bf9b3abbee85f27e3c5ad48d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023676, "uuid": "fecf3426-8565-4193-ad87-5c95e9276da7", "value": "T146262A525768A2337760D7AD823ADE74944E600329E9CF5431EED228791CE4BE35CBE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023676, "uuid": "d341daed-d9c2-4da3-aadc-42fd430deb37", "value": "98304:hlkfvCKfmd1ybA/1Hl4kN1VHqz5rKMUUjbO+GyNjl1Q4RK/uyavdVxXSzztfmfS7:DBjyU/1Hl4kN1VHqw2jPJK/uTvfFeztv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023676, "uuid": "e1352057-77d6-4685-802d-930b727871d1", "value": 4700869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023676, "uuid": "75fc56db-ebda-4437-81c7-e92eba0ecb6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023676, "uuid": "862f77ed-4da8-4d43-9fcb-1199b2fe350d", "value": "ORDER_SPECIFICATION_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb677e2a-7fac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784051528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051528, "uuid": "2709abd8-76be-4048-b1e9-adea96e82d8f", "comment": "Malware payload (Efimer)", "value": "8bd2afd623eec679db9a9f9a1aed7fa5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051528, "uuid": "631db6be-2b25-44bc-a128-98850ecae554", "comment": "Malware payload (Efimer)", "value": "55aac3a0ab90b91703fa5b60f8b60f25c94993c8d1ab380298ebf6e1db2dff44", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051528, "uuid": "9f0ae275-b0a9-4c44-8e16-ab7d265df42c", "comment": "Malware payload (Efimer)", "value": "4ef4f1dbc809dfa6029b9c4919e6b49c5be263a8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051528, "uuid": "71b43805-afd8-4abe-aed6-5b925129884d", "comment": "Malware payload (Efimer)", "value": "b8223f12417fc47c760711abae870c3c71ac370fb49f68ff743dba721c1b46d893ab272bfceb5c2e002dd248b2c167a2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051528, "uuid": "6c417617-a21b-40b2-b347-1b0917801d2c", "value": "T1D3E633885AD012EEE8B38238EEC15596F525F4B637B2C6DF0B6453A16C531D04E3EB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051528, "uuid": "4655f0fe-6455-4b2e-84b7-1da31a5bdf13", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051528, "uuid": "efb567f2-0c37-4fc1-b806-c565074cff47", "value": "393216:vcj+UDM4arXuncJUW63HeXMCHWUjXScuI3/PGTAI:v+jDM4arXu6XMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784051528, "uuid": "8c4a1a82-1d4c-4414-916e-258079ccaa58", "value": 14313547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784051528, "uuid": "e0e89a76-2793-44c5-a9c3-edd4ab84d413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051528, "uuid": "79cec619-5fd7-4926-a0ec-9d6604536412", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3072fc1b-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784023807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023807, "uuid": "68aeb793-90e2-468c-b5c0-4c0934055db9", "comment": "Malware payload (Formbook)", "value": "977fb32fa4a15d7f5de7f4b016ddc40d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023807, "uuid": "a4f3f282-4ab0-48ae-aee2-19b8ec603b0f", "comment": "Malware payload (Formbook)", "value": "55b9b8d561e6c1a4c099ceb064a97a43bdc222797f732562a1f7afef5d6cfbdb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023807, "uuid": "f01b6217-4f62-420c-a480-29c2d312f497", "comment": "Malware payload (Formbook)", "value": "406ea177a07898067ad08b8c65bbd24cc4da8fb3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023807, "uuid": "2c7db078-487b-4607-9b4d-4a0802d2e23f", "comment": "Malware payload (Formbook)", "value": "6115ee26adc70ceb798dfafe3b9dea0c9a456b6ed9023e2ebf42bd7642bcf4506118af890a9738d0fd00c3be7e243dbe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023807, "uuid": "fe4865dd-df7a-4b78-9902-522cec54a31c", "value": "T1B9A5F1105F882FAE87AD0A19D07E1A1EF3E14A851467BCCAEF737D096FAB70055171B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023807, "uuid": "c9327d5f-8bf8-4fb9-966a-bbaddf6c2d59", "value": "24576:ugbo0XJDm8fzc+/m7xfrDniQcoGdgaEUxZcV+UeEd19m7o69WMnzacZjy9SErxhc:ugU0ZDU0iPzjAEyFJ87tgSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023807, "uuid": "d4cb4a15-33e4-4930-9774-acb858b33cd9", "value": 2132346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023807, "uuid": "3c333dc1-af21-4aaa-b3b1-92b209c06618", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023807, "uuid": "605fde7e-56fb-477b-9325-8ff50da1d1be", "value": "shipping documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98520ab-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784015447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015447, "uuid": "35d7b409-aaca-4843-bfc9-9251064f30fd", "comment": "Malware payload (Formbook)", "value": "6550fc3346216b8cda870d4448e8076e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015447, "uuid": "31ba539f-6a7f-4cad-9a88-4ccbc0c7e094", "comment": "Malware payload (Formbook)", "value": "55ca939df21d1486628a2801ea28d0b8e1eb63e624218dbb42348e36cbadfbfd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015447, "uuid": "7a8fa773-baf2-4f45-a483-113088504b16", "comment": "Malware payload (Formbook)", "value": "02eec00f841f82f09f71ddc4b34e6e90e276c565", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015447, "uuid": "03fad159-030e-4854-b5c7-222f871d861f", "comment": "Malware payload (Formbook)", "value": "93c71f32e81abc3ec6b4e33997a10f3ce76dc968e4371160f4be62e967459d1ca30879f74873a15ff79cfde5b0ca6530", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015447, "uuid": "966ca4b6-e629-4ff5-b56e-eea422590180", "value": "T1B8A53341AC227E13C10E0037899983AC5FF19D7C6360BEDF787A57DADCE61D52EA4898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015447, "uuid": "dbbc835f-1c8b-498b-88fb-cb1aaba3fe0c", "value": "49152:1hQ9WTXmL4immucWAI+attvbQSmjgRn6kFAF+FRqwd3zohCRFf46cbT:DTXmci/ucNI+aDMv8q+XqwdMcRFfgbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015447, "uuid": "899a9c81-75cc-48db-8292-8d44fe393ebb", "value": 2204377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015447, "uuid": "d44740a0-1c48-40ce-9366-12cfaa63eee0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015447, "uuid": "5c8e7647-da4f-4521-b52c-1b1262b0f394", "value": "002744-2026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4370f7-7f7b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784030403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030403, "uuid": "bcc3fc04-7a41-47d6-8f99-b3351e1f86fc", "comment": "Malware payload (XWorm)", "value": "21736edc68277667cd708a794ff799f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030403, "uuid": "87d71796-8dee-4bff-b317-b84741b0d340", "comment": "Malware payload (XWorm)", "value": "55ea3e4e1cded44b00566cd5894720d01e1191fcfa17a28e25bf928093cdc425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030403, "uuid": "e8f9f56c-7c08-4f4e-a7d0-beb2623040f7", "comment": "Malware payload (XWorm)", "value": "43751c13e31ca21cb63a7526ef1d68a985d25b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030403, "uuid": "f7fcb10c-5e98-47dc-b5fc-9b896b043b29", "comment": "Malware payload (XWorm)", "value": "d4b4aba7b2da8bf3f60fca0989a09e9853ee98d19c63ca594aa2cdb13bc691e65e7f07923372427b7c84e67babf7d38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030403, "uuid": "749a9c21-9ff9-478d-8c40-32b68b38e709", "value": "T1A175A9E78B7C8842DE209A7A6F0F4AA4E675161E9CC610DF7466D5CC7F303E18A50E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030403, "uuid": "0a659a8e-7155-4950-a877-ea5adee98c87", "value": "1536:MYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYQ:N/2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030403, "uuid": "78564a31-35fb-4b19-b5f5-7e67b797ca55", "value": 1661532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030403, "uuid": "ad5330ae-b16a-462c-9eea-476df5fbb11a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030403, "uuid": "44755bf2-a61d-4a75-a60d-37be7ef59cc1", "value": "documento escaneado.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17a15a9-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015406, "uuid": "95b8272d-8eb0-40e0-8449-e8298e2a884b", "comment": "Malware payload", "value": "53f818b54eaf1540e6a5fb08235ebe0d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015406, "uuid": "4488e71a-e181-4f91-adda-28a3abd0d735", "comment": "Malware payload", "value": "55f54b93f171f91bd65b238cb823540bc6a9f193b54c4dd131899c055e80a3a1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015406, "uuid": "2781347c-d019-405c-8b75-1efa6a88013c", "comment": "Malware payload", "value": "301e049a8f95d7ae3340dfb99b7b5281446d38ab", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015406, "uuid": "60d2cb59-d6e9-4305-bf24-f1e70f02e798", "comment": "Malware payload", "value": "081fef2602c25b96d6ef3f85a091e41b35b9f25d3793bf02c22b02ec8815812829b78085d2a38c9b01b24df3dc06b139", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015406, "uuid": "55a4172e-accf-4802-9a67-22d520dc20c3", "value": "T1D3052349FEDADB33C08358B4ACE8A646025EFCE2C71B940B3175B32EA53137AC695435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015406, "uuid": "b332e146-87f3-4508-a5d2-c763685ce925", "value": "24576:IofwI/77dg9nFaGRkN/tXMNHPZQJhO4qvO:IofwIj7MnFaGRkpuZQBqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015406, "uuid": "3ee6d382-9d36-4496-91de-1eeb8c086ab7", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015406, "uuid": "83e00356-70e3-44b2-9d63-f7fa073210c1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015406, "uuid": "71856c08-7666-482a-9a8b-a1fb10164aed", "value": "new order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17abdfef-7fa2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784046958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046958, "uuid": "ee11778f-f79c-43bc-a548-ebecfc57540a", "comment": "Malware payload", "value": "bdee3f3e4c5c5792121f2513dcd324c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046958, "uuid": "9392b4b8-d3b3-4cee-8afa-50341a44e24d", "comment": "Malware payload", "value": "5607a94195a263ef620cebbc3c4e64930d631f0582d0452131c694556e623e50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046958, "uuid": "0af5260a-ce6b-47cc-b01f-198a954c5642", "comment": "Malware payload", "value": "5b4b2dab62f12a1ccff231b532131482a9332b62", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046958, "uuid": "5e09cdfd-c7c8-4dff-9dda-b5cba42a0dbe", "comment": "Malware payload", "value": "a5b5ddd949e25b76466a61a937eb17d1b3fc08183f17c8e05d3f27bf1c39b0b9428cd94aaf6ff3e86f261f340124974d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046958, "uuid": "c72205f4-8db8-45cc-a2cb-5a3a4a0c026c", "value": "T142B13F91E947455681F746AB7F12A104F0C1013FCA0A6C06F2EC66963FB835E86F2F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046958, "uuid": "80aff0cf-b6c1-440a-985f-c6da3b2e2fb9", "value": "96:Mh9rxdxtxTxkhqMLeLyDbSGxPv54HGT5uuPCk0Y2jYUzzr7V956/4S:8Tj9+L7bSGxPB4mT5tPCk0Y25zDV/6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046958, "uuid": "690d8a04-fa84-490a-b5ae-445b0b5b9551", "value": 5143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046958, "uuid": "a23c5004-d311-46bf-be31-7cc25e0cb5a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046958, "uuid": "18ef14d8-1a0e-4b3d-980b-3cb4635da009", "value": "dab.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298f294b-7f34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1783999743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999743, "uuid": "963be288-eb48-4151-9717-19e5de4c773f", "comment": "Malware payload (GuLoader)", "value": "5ad46a612d77078adb84e4c3b59113b8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999743, "uuid": "50b3c9bb-75f0-4f20-81d0-d0f405f0c966", "comment": "Malware payload (GuLoader)", "value": "56e7837e2855d749d9848d20ffb2e682f2288b7f10156597abd2fdee543e79c6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999743, "uuid": "8a164a46-b34e-4980-b4cb-9bd9f0215edc", "comment": "Malware payload (GuLoader)", "value": "b02c41d732c05efc3c1b48b59bc0c23c3e586908", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999743, "uuid": "f6f43d3e-6efa-4d05-8b17-7461e180cdda", "comment": "Malware payload (GuLoader)", "value": "3f9cf927a6ebb20005703cb01e415dd001014b8f36939a8930bc5e80c678b821e5a8a00e031b1ed6a4bf0af0eff4d24e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999743, "uuid": "93641416-2725-46ef-9545-f19445d59e2f", "value": "T152B229A27F9409578D8F21A7993C4F6AC9149995C8713CA8BCBDFB0DE844B1C36AC41E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999743, "uuid": "f6f5bd37-8c72-481e-814c-3c6f5c8eb218", "value": "768:fW6bdxnzBW/LwLaYxCqer6s5/cSCkibE0+6yqvWmhxMjF0MiNi+08J:j5wH5r3/cSab1dyqvWIOjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783999743, "uuid": "ab8298c0-be39-4681-bc6b-f6a047119b6c", "value": 25651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783999743, "uuid": "d992f265-db85-45c6-a949-732ae7550dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999743, "uuid": "70df7376-51a8-49c5-8dca-8fbf6691d4ad", "value": "RFQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e814a8a-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022059, "uuid": "36d69cfb-962b-4928-a195-bcb2d88fb47a", "comment": "Malware payload (AgentTesla)", "value": "a85f8ef34cc5ab90e0aa6c9b1a5b289d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022059, "uuid": "1a2cdb53-c587-4b89-acdd-2978fc977125", "comment": "Malware payload (AgentTesla)", "value": "56e83469b37785a3ff4a82395e014c95da9643b58733d3a085944821dd1fd653", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022059, "uuid": "081f42ba-2c9f-4b15-8391-e22568b4ba6f", "comment": "Malware payload (AgentTesla)", "value": "ae187e52be3f84d92e9994c62de1edab36c339b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022059, "uuid": "6785d676-7a9a-449e-9811-70737a17cc9b", "comment": "Malware payload (AgentTesla)", "value": "41dd6a45955a2ae68520c3f7797764a7fa42550954946939033f1b5318646d2abe0d747d505bc92035ea915dbc04cd23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022059, "uuid": "9a925e2a-32e1-4365-a5de-2a67fbe734ba", "value": "T1BF3400037F88EB15E1A97E3782EF2C2453B2B4C71633C60BAF49AB5524516426C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022059, "uuid": "78d1cfc2-b7e6-4761-bdc4-6eb5ac243aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022059, "uuid": "f5b3af24-86d6-44ab-acad-a98c22e83fe9", "value": "3072:h91CK6iyJKOikl82q2Vg0THo9rG8KaG5jnTh9qoufzz:tCK6iygmfBsq8KaWTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022059, "uuid": "3b14eb9d-69bf-4ad5-868b-da3aabd762b7", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022059, "uuid": "5f942f3c-520b-45b4-b530-70f4afd7b944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022059, "uuid": "b5b6e4c2-e4b3-4820-a1fb-c788f10db0f8", "value": "56e83469b37785a3ff4a82395e014c95da9643b58733d3a085944821dd1fd653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d94619-7f7f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784032263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032263, "uuid": "f84beea4-39d5-4b7e-af7a-70e2523f3a6a", "comment": "Malware payload (AgentTesla)", "value": "4e66a24816e0adf05955b3c9e54b763a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032263, "uuid": "a54be22e-60bc-4208-bb16-405f0625df5a", "comment": "Malware payload (AgentTesla)", "value": "58274a188cad3b137585a3135b5d7044b84996c6e2d656fb533a14d229777959", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032263, "uuid": "1bef389c-5a2c-4fa3-a0bb-d592a289557c", "comment": "Malware payload (AgentTesla)", "value": "5e344b46788a6f56ae8484bbca7f3777d2907de2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032263, "uuid": "dbd3632c-b332-4e89-a124-e24c9d344977", "comment": "Malware payload (AgentTesla)", "value": "cbbd8e99b0c1c82351b11fdc4cb4445960435531115890564405f76b98d7bd1dfd2a6bf5940c31eb678a9f45fbf8014d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032263, "uuid": "06cd8acf-93e3-4628-b8c0-aec4d4e11004", "value": "T1F9F52A6157A46133B361E79D923BEE3C980E644324DACF09349ED224791CE4BD398BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032263, "uuid": "388afe69-7893-4298-97db-8a8bc67c2423", "value": "98304:iGnIHAPdo/nInD3Y9VnAUvQppM9YRDZB4SSlfsbTHPYWBQEWSF0vAfRJk5R:bnAAPWQ89lfUDdfbDwU6M0+JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784032263, "uuid": "c8b8e168-7689-462d-a93d-ce5a188090b4", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784032263, "uuid": "8f3c3d4e-4843-40d1-8799-a602ec0a4d6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032263, "uuid": "205876b9-4de8-4e31-9240-0053dbaf4f0b", "value": "Please find our attached quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30256a75-7fd5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784068903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068903, "uuid": "1c2c893a-2aca-40e5-a6c1-05fc300eb3f6", "comment": "Malware payload (Mirai)", "value": "82b84e74215809b1ac155be27a531ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068903, "uuid": "db5d1faf-1d5e-43ef-b287-72941fb133fb", "comment": "Malware payload (Mirai)", "value": "5850b6e589ea496b093b3c162dab126789ea118276bc3c23ff4cf75c6c19c8d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068903, "uuid": "07f4a4d4-b51a-4b3f-81aa-4b079bef4b76", "comment": "Malware payload (Mirai)", "value": "4dcc04911ac4fb393a5f90b1fdc79f25b4201dbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068903, "uuid": "3f58a201-c8e6-41dd-9368-28ad3528a1ca", "comment": "Malware payload (Mirai)", "value": "538369879c0fb3bae8626042697b37a85f8f511ec260ea3248587e05a8e90c24d333de9f5f8aede5ed31d4f34d20c398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068903, "uuid": "fdfb4f2a-0f8b-4b93-8e76-643d09129bbb", "value": "T16F146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068903, "uuid": "5a7d180e-5171-4c4c-a193-46a99904d066", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtF:BZAyFzQSdS7II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784068903, "uuid": "cb215a31-7271-4b80-befd-3ad9cb3e3cd4", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784068903, "uuid": "ab152148-c862-45bb-83db-d1cb28fafa58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068903, "uuid": "82095511-752b-4a2a-9a95-fba4627cc0ce", "value": "5850b6e589ea496b093b3c162dab126789ea118276bc3c23ff4cf75c6c19c8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53900481-7f6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784024725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024725, "uuid": "7baa82f0-4373-491b-b474-d6380597ae58", "comment": "Malware payload (AgentTesla)", "value": "a4b5f79672daea3431f95be13cf8aa2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024725, "uuid": "cda1a234-2617-4e81-831a-f4fe82490bdd", "comment": "Malware payload (AgentTesla)", "value": "58a54ec5f73f0c32963ff751050dc2ccb3148a27d8b9c7f1bfe1bf03d1cda13d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024725, "uuid": "dd62e73d-057d-4144-a89c-b6ce28e75b22", "comment": "Malware payload (AgentTesla)", "value": "03cbedc6cd37620e24a668fe92131a7633a2d01f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024725, "uuid": "ed86c653-1ce1-487b-a6af-e23d50643bde", "comment": "Malware payload (AgentTesla)", "value": "8de19981dc9771f419d995a46674c4c6e0195f66a7e6ba92dfd1a6027ef0ff7dc05619b0a28bc97270b438f64f38d932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024725, "uuid": "a02983a8-1bb0-4d1b-97d3-c8ca01a1950a", "value": "T1F7E508115764A233B3A0D79D523ADF38940E900369E9CF1A345ED6287A1CD4BE39CBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024725, "uuid": "cd888e95-f730-485d-babd-353941f13ba6", "value": "98304:jcpD30Lgluf44Okx63b3CM8v8ryGOMDlm8K/Ae8Y:Yp0T63CM8vsOKpVel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024725, "uuid": "56c3c546-f39e-4d23-8112-45182c825b49", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024725, "uuid": "efcf1fab-bd90-4dac-8bc1-54502bbf8af0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024725, "uuid": "0d7ac12f-80f9-44f2-96f6-e106a68b48fa", "value": "PO-1180.7726.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf21024-7fb5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MacSync)", "timestamp": 1784055369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055369, "uuid": "bff2532d-64cf-4f30-b89c-cf669e500516", "comment": "Malware payload (MacSync)", "value": "f10ac306b4c2c12e69c7c778cca6592e", "object_relation": "md5", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055369, "uuid": "01b51893-d95a-44cd-911b-850d99307508", "comment": "Malware payload (MacSync)", "value": "593c2d77f1bf98f5beff03fc094b950e4e4d1c8a306397a7db1f18bda9b5c695", "object_relation": "sha256", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055369, "uuid": "3a17ec5c-365e-4253-a1af-89cb3e76a5bc", "comment": "Malware payload (MacSync)", "value": "057802730116d65724c1c40522a63224fcde0693", "object_relation": "sha1", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055369, "uuid": "81deae44-5cbd-4641-ba29-92e22f981218", "comment": "Malware payload (MacSync)", "value": "56aaf42872eb64b608d5212e76d3ff745e0df77cb2fced398f85e9199eeb24d4c0a39665ddb1cd4564513dafd22f845a", "object_relation": "sha3-384", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055369, "uuid": "b274ddbf-cae2-47c9-9f51-9d2ab7bb067a", "value": "T15D139307695502AE93F4C976A15182B5830FC34F4293E429B2ECC37E2F1ABD5A1F26F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055369, "uuid": "60f9834b-5910-4804-9b63-a303862b8e24", "value": "384:ZrXlXhRcpxrSFy7o9DITnw/uzlF60sLHMNo+uMiPSrXVO:Blq+Fy7o9DFdKXVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784055369, "uuid": "aa6142ca-f218-4fff-a660-e2303f6ccb56", "value": 42537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784055369, "uuid": "53164bbb-c204-4c9a-aa18-3b8bdb68dfff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055369, "uuid": "05f65625-04e4-48bc-bd83-d74dbf65ae26", "value": "macsync.applescript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13072fbb-7f5e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784017744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017744, "uuid": "b1535a0e-6362-4fa0-a87b-359179ca5cf8", "comment": "Malware payload", "value": "485a0e28bd1918832b03aec1658c30d8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017744, "uuid": "8c5ae76e-d834-4ee5-937e-fd62f4487d03", "comment": "Malware payload", "value": "59a9f0ea064ac5e8ebcdd1dc92ff9bfff50d9a96528bb4029c7e0ff85aa5d238", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017744, "uuid": "fd635373-28d6-4af3-bcd7-e8e95b70960f", "comment": "Malware payload", "value": "4d659c1f8d85de9b64f8d3d9dd6145e5c93177a7", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017744, "uuid": "ac7ebabc-83b5-4764-9692-c1b2c087a431", "comment": "Malware payload", "value": "2a6463e66638c1031cab7c6948b73d85ac095751eddc4aa9b506d654a26dcd660d6cacbcb9d40d993723f5bb066681a3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017744, "uuid": "3fb73dba-58dc-4f08-afa3-5af60b3971cb", "value": "T1A0C5495E80589378F7A5C4E9950E6A9031F937BC8CF384E8211B4AB157A17E18FD3B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017744, "uuid": "48f436fc-1738-42cb-9b2f-f267d9acd2c5", "value": "d5e06a59911a6066c481b51ae7ba157e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017744, "uuid": "38604f4f-749f-4b1b-93ea-fe7ffee47762", "value": "49152:PSvF6QA3Sjs0ltt9N0lqA5ARSgQqH8gkHYjPd1fU:MFdj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784017744, "uuid": "8257b3eb-eb60-48d1-8377-d021ca2a89d2", "value": 2586624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784017744, "uuid": "0220e008-0749-43b5-8144-e466c4467f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017744, "uuid": "4bee1608-c1ee-435a-b286-653d48955f8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4857bdb4-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023847, "uuid": "ae9e0bbc-76f8-4f2c-a426-43727b6a2241", "comment": "Malware payload", "value": "fb493b163eb8218d0fa0f27d0e9ac50e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023847, "uuid": "a576644e-55ce-4ac7-b302-9c5eee337163", "comment": "Malware payload", "value": "5a44a9e86a2a0fb11933eed69bc2cd33c76a496854c1aed6ed776efa87d7b064", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023847, "uuid": "3eb0f41f-eb9d-45da-b83e-d3ddc087634d", "comment": "Malware payload", "value": "79091732811153c8b90a15aa6015e34081281234", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023847, "uuid": "92edb897-ddc1-4c98-84e9-48300ba77f96", "comment": "Malware payload", "value": "e2ad71b7cadcfca5352953c983609d08de33e617253a5139a268507830f5abc7aefef5182ced625a4a5072ee5206853f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023847, "uuid": "4e32dbbc-3551-42fe-85fb-2d46d09e1a73", "value": "T1BCD23148239E35AE01BA734C467C41E5723D40B36502A4BBBE9DCE9958E203A477FF79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023847, "uuid": "a2b5592b-5483-4072-9697-94255578e96e", "value": "384:vGzLfCP5o2cMJKEFw1q89nKOilDY/l0JNNQJPExjTGTETqT3TgT/dl5Aqx6e0XTC:vGHw5otMKB/eNaJsNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023847, "uuid": "7cb0f100-24dd-48e9-8a4f-fd50468445ad", "value": 29868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023847, "uuid": "47ad6d82-dbe1-4ead-aa74-8f9dd0882a93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023847, "uuid": "fd6e42c6-8a31-4794-a08d-eecb660c2ef5", "value": "OrbitControls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ba803a-7f80-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784032488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032488, "uuid": "5df6c0f2-71eb-4f12-bc78-6e7af38560ce", "comment": "Malware payload", "value": "6ca8de86bd66518b616808e116f81d50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032488, "uuid": "908e2158-305f-4992-b8be-5427fc5d531f", "comment": "Malware payload", "value": "5a7992cb4e5df6152f2f20e6076fc7f2085a1a106edcb6e46f5da5a40a158882", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032488, "uuid": "0051dd80-bb0e-4727-8e26-d816d89ffe9b", "comment": "Malware payload", "value": "9b5a9edcd02baad3a3ebeb391eee9c219a9853c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032488, "uuid": "6ab5d765-e8ea-47f7-bb6e-543c29b66d65", "comment": "Malware payload", "value": "ad89ce09cae0ca1731aa5b1b066f03dbe71e05cae72332b34e8dd39d7847bb22b312b6bd53184eedcf27a26037d15acf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032488, "uuid": "591e6792-a671-4d75-9371-2da3bcc9efc3", "value": "T13D137D6566953C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032488, "uuid": "2b0fa4c8-1c58-408c-9495-574ffa062ad3", "value": "768:KXRWNGxVLF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:2lxIcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784032488, "uuid": "848d0c5a-3d3b-4b8e-a0a9-073d74790166", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784032488, "uuid": "83eb6a10-666e-45c0-afed-a7901c7d2aa2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032488, "uuid": "3eca86e5-b588-404a-9ec0-6b85682c098f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e3b194-7f20-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783991169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783991169, "uuid": "ce0aa900-34e2-4d45-abd9-a6bed3d4a8a9", "comment": "Malware payload (Mirai)", "value": "51087b22397006bce91c8b32f1fd2c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783991169, "uuid": "bf5eea5c-2079-4591-ac84-e5b48c0427f7", "comment": "Malware payload (Mirai)", "value": "5aa92ab04d89876d4cbf86d39bf1858bb7ff77c8acc40301965309387f09eb88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783991169, "uuid": "91bf4c1b-372f-41ac-9fe3-f1506df02908", "comment": "Malware payload (Mirai)", "value": "a7333b545833e2be5990fb5d3211819c00c7bfc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783991169, "uuid": "b300f683-5653-4548-a31f-f08d72893019", "comment": "Malware payload (Mirai)", "value": "723a30a996f9c1502edb9b41d25347a8585c87103c715d7fa7788439a77bf55d34d8c39f92c7fc0c8b0afd821b6d0341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783991169, "uuid": "50cdfaee-c962-460b-8bd8-a911d7f4cd77", "value": "T12094221E6233C99AD344A57F4973C0192FBDAA053AA2F218F479DC403F1C2ED9694BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783991169, "uuid": "7efc8ea3-b404-44bb-a99a-05356de747b2", "value": "6144:6cCEm/L4tRN7icJHR/KBYwWHRZLXRWGeNfhoBPvH07QOgY9yl8khlTwZJlqnECga:6nEm/cl7ic3/9r7RWyRH0TvkIDlqfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783991169, "uuid": "6f70a55f-168f-488c-bbcb-e14735080c65", "value": 430948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783991169, "uuid": "08b3566a-90bb-4bb2-bfdd-0ae0cd694b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783991169, "uuid": "10f9d896-dc9b-46c2-9e3e-1a13cb228405", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f89266-7fc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784062363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062363, "uuid": "d40ad1c0-6c35-431a-85e9-be21a61c7abb", "comment": "Malware payload (Mirai)", "value": "96009412ff151e92cfd2ab186eac3988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062363, "uuid": "fd1d0506-a395-4119-8356-599cb33ce541", "comment": "Malware payload (Mirai)", "value": "5b7b9a6449dcf0b779dd72210926d4567453aa40f16b473343a3aa4372798884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062363, "uuid": "ded46bd2-b40c-43d6-8977-6bd4a5a8d42f", "comment": "Malware payload (Mirai)", "value": "6bf184a41eebcb8b344be3d25d458716dfd2a884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062363, "uuid": "f3cf77ab-befd-4bc7-abfa-cb41439c94f6", "comment": "Malware payload (Mirai)", "value": "21634f5944e94eb8dd3b0b8d40397078e2125a5a842a01c8e1a3044eea6195f6dbd592557b64dadb5fe04be5001edf88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062363, "uuid": "8bd89651-2cec-4806-a385-593f82646aa8", "value": "T1776302CF6E702B66C18CE1B1743815DACC3A9C8AE353C69D87E1AB96073853654C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062363, "uuid": "7d3db16e-d973-4506-aaea-f26a5a23aeed", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMGjKWhtNk:1axZLmYKX+t08jmeJhYTG6tNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062363, "uuid": "83b387a5-1de0-4e69-ac07-639fb1d55e0c", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062363, "uuid": "79a7a482-9749-40da-919f-fed0ce8db90d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062363, "uuid": "11969e76-cbcc-4acb-b2e0-4a31d6e14919", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69636181-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784022614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022614, "uuid": "d7b53fbe-cadc-4b89-ab4a-5b9244581f4e", "comment": "Malware payload (Mirai)", "value": "9902d1bb83abc0a96ccb82c1a7dd6971", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022614, "uuid": "cd0ecebc-f84f-4268-b733-58cfb1269048", "comment": "Malware payload (Mirai)", "value": "5bba6b0aace22ebf6a4db17b572d3ea1aef0f97b3e9caa660bfff422a096d595", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022614, "uuid": "cb986c13-7768-44f8-abb7-ba062659ec1c", "comment": "Malware payload (Mirai)", "value": "4207784dcf2d4b12a6c1ca076c08c36d140a359c", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022614, "uuid": "cc847fdd-052e-42ba-8ead-5cb1fe350f2a", "comment": "Malware payload (Mirai)", "value": "29219419205597a010057814d4a7a82bdc10c919108859924a207b9eeafcd3c61cb8ea2e9af6c6442e9138b7ce1a3f08", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022614, "uuid": "0df29f55-ef92-4e40-ae1a-f9db93236621", "value": "T14112BF8A7B716D9BD7B326312F687B1DF2B1ABCA41A4614B57C00ED21D30740EC69F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022614, "uuid": "c9a13b7c-7f46-46a2-8446-edd0119a0b73", "value": "192:/a4V93WvizSYcwYvOFRbGq7xgeZhEwI/ATOl29UkSFB4agNvQBsd/DAD3MxP:/a4VwvizcwMOvZ7xgCCuuoJamdrAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022614, "uuid": "38b472c8-975e-4211-ac9f-434ac8f06f2d", "value": 9600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022614, "uuid": "dec84e65-8e77-4c19-ba3e-84139f234db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022614, "uuid": "6c4a4c5a-f26e-4a38-ae61-9f4cb8e65fd7", "value": "5bba6b0aace22ebf6a4db17b572d3ea1aef0f97b3e9caa660bfff422a096d595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c3dfbf-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023834, "uuid": "e14a7387-bb94-4f50-beef-5a9f6d61668f", "comment": "Malware payload", "value": "69c1b9d191b6adb3df2267dee3eabc29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023834, "uuid": "2bd4b580-769c-4f9c-9609-b49dfc68c2fc", "comment": "Malware payload", "value": "5ca67ee89d9d8aac95662c722a47379b59c23328109d87c2efdf41fb2c0e1961", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023834, "uuid": "2b0a9c36-f8be-4127-aea0-92af93be7bc2", "comment": "Malware payload", "value": "24af5075ae0d086fa4c3dd308cff25b5f8569be3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023834, "uuid": "3c06a8e0-7230-4e6a-902e-28581876f821", "comment": "Malware payload", "value": "3efb94ee8520d76ffb592a33f47a15f055b1929320324c0e8817fbfea8c3a74cc60c1aceadcb62a8cb9761341d54e1aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023834, "uuid": "555656c6-ed47-4f73-bbe0-cdd1b0161b92", "value": "T127F49EAEDCA2552D718DCF036723DCFEE2231983676C31A21632BA321D58FDA51172C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023834, "uuid": "3098f65e-c4e9-4d16-bba6-693d9dc8a076", "value": "12288:ISnZHGQcKrCWRpklYB+SbGQp8vus9HUVQotvvsqP1v91I0xEGWktdfyKRK+ZrpFo:PZHzcFLlYB0vWWN2DpwGWkHfb1ZNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023834, "uuid": "ed78895c-01a2-4408-948a-146a3c931f9d", "value": 754573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023834, "uuid": "314db719-461d-4ea6-a6cb-7562e061ce58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023834, "uuid": "4079e9d2-fa55-47db-a1a1-e2533d2b845f", "value": "Product Details Spec and Materials Need.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caee4fe-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012177, "uuid": "ce4814dc-d56a-4501-aa86-4e6bed976363", "comment": "Malware payload (Mirai)", "value": "097c636b74f1110bbaebc768ceb22575", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012177, "uuid": "0ed88a04-01ca-44a6-8678-fa7ca2eee8e5", "comment": "Malware payload (Mirai)", "value": "5dce6e7b4299b6d294a53c5f292729466036b108973a02c72b049471a8af9702", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012177, "uuid": "e549676a-9932-4d4f-bd11-c3f13854e217", "comment": "Malware payload (Mirai)", "value": "575bde96b2e682252dd2ac4c2b9e04d4babec47f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012177, "uuid": "024ef1e5-48a1-4fa7-9a5a-b4582f334053", "comment": "Malware payload (Mirai)", "value": "c5cc108aae42681ff7d07dc0db5a9c013556de3e23dc75c3a82e6f7399586d5521365114dba6aca1ba9ce56faa54ff2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012177, "uuid": "c6c24f34-a1a1-47be-b898-1e42783bea70", "value": "T1FF53023A6D58B20BF160CC7FC4494CCA8C61737E75B5F2860505567CA0F2016A6FB68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012177, "uuid": "071806ed-f1cc-43d2-af7a-8120d788b28b", "value": "1536:eLW0dVuotxKkKKgboEYUVPRLLZmvQEBmRJT9:a/BAoKxL0o/3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012177, "uuid": "d148596c-797f-4ff9-a39e-f591703726ff", "value": 63380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012177, "uuid": "91dcb954-0a53-4a32-8931-84fb0f9be1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012177, "uuid": "808a0ea2-1e8c-44bc-93a1-af07f4626f9b", "value": "zombie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b60070-7fad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784051924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051924, "uuid": "6fa33a21-53e3-434e-b8d5-732f42d65c72", "comment": "Malware payload (Mirai)", "value": "8dd5cc2b63c8a3cd42ba2826a0602851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051924, "uuid": "bdb231f2-d9a3-4a71-bf9d-e41dd10b41b5", "comment": "Malware payload (Mirai)", "value": "5df3574a5aacfd5eb8cabbef5a9153d7dffc854289639acffd1ed0f21bbf887a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051924, "uuid": "7551b6e8-5922-4c64-a524-6f540ca81263", "comment": "Malware payload (Mirai)", "value": "4bcb76e8aeedb972f7b4784bf13a4e1aebf948e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051924, "uuid": "a07290cd-f664-4d9c-9784-f37624fe012d", "comment": "Malware payload (Mirai)", "value": "5cda89a4536879682ebb13642c1bb77e7014edc9699d0d251521ea5e6d8096387d36f1d1d7ad4342abf86ddb2f8a0deb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051924, "uuid": "8e09e4a5-baee-4ccc-a6c6-828a8d154346", "value": "T14AC32889B8929A62C6D716BFFA4F42CD773663E4E3DF7107DD185B21328641B0E6B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051924, "uuid": "05415ab3-51ad-460d-9022-0a0670bf05f5", "value": "3072:0U7FYPZ7NIe0QdciU5I1aK5y4S6FlYBnb2:V5Ys4dcioIlU4SqE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784051924, "uuid": "22e3cebf-81c6-4a25-a11b-cf0844883125", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784051924, "uuid": "e09fcdd4-bfeb-4b0b-8ae2-85ca0313c5ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051924, "uuid": "59810432-39a6-4ac0-8c5b-13a23fcb8eb4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2863f99-7f94-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784041205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041205, "uuid": "d5bf6b11-11ea-49c2-ac15-51c4f3f2d4ae", "comment": "Malware payload (XWorm)", "value": "aecbad9bc246f34850ea7eb99a879985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041205, "uuid": "f527cfc2-250c-43af-9de3-e9aff97cc02c", "comment": "Malware payload (XWorm)", "value": "5df3d8d157cea2c1e957202eaea1c2dc27279e992828cfd8be931d48f9458d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041205, "uuid": "53255a98-b6b3-4668-8762-02e4fae1f6d9", "comment": "Malware payload (XWorm)", "value": "59a4d0464a5bc0d3b588aee5192e40003841abd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041205, "uuid": "b9abacc7-b45c-43be-9ede-d72152ebb2c0", "comment": "Malware payload (XWorm)", "value": "07ccd91c2ce3d1f462bcefdbe2a26c8a70e017fa28760c014c7836f7ee76f4904e0ca5e1fab41761bc5467493e43f429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041205, "uuid": "690abee9-7209-4f4a-b6fc-3fd473aa0050", "value": "T1840512742756D71BCA9127B92A70F27413BE6DEDA411D3279FD8BEDF7822F408900292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041205, "uuid": "e8a8b008-b8ce-4306-8f6a-f919bfcd32b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041205, "uuid": "54dbb2e7-10e4-4e34-ac6b-c76537ba2cdd", "value": "24576:Wro6pVcCheppxe9as7y8UyoikNmDcQp5OrbRfnL6iH8:gDcCheppxeB6h09p5OtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784041205, "uuid": "a318448d-03df-4bd3-8618-fb6ea61e465a", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784041205, "uuid": "1d11bf4c-8381-44fa-82bf-c1954a78d811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041205, "uuid": "63cd71be-5563-4997-b6cd-b7e42aa4819c", "value": "rRFQOURREFRET-402-14365.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e67ba0d-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784023481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023481, "uuid": "6c0b145a-cfc4-44dc-a3d5-0d4e0417ae06", "comment": "Malware payload (RemusStealer)", "value": "6145fff517e81b6afc77d6d5149b73da", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023481, "uuid": "8a309a00-ac34-4786-ad66-1ef8fea503d0", "comment": "Malware payload (RemusStealer)", "value": "5e5f0122c172b364cb32ddefc79b381113a04ed48bf194a6a975cc7f564fa07b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023481, "uuid": "da6a2123-db3b-461f-9222-d256141dc247", "comment": "Malware payload (RemusStealer)", "value": "cfc94a406e187b8cba207c605374c398ce80a036", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023481, "uuid": "c07cfc91-87c4-484e-872c-e8f7ff4c2513", "comment": "Malware payload (RemusStealer)", "value": "f623b67f186c27fd882fc29703ac6b40209bb5cbe4b3cae143d5e6dc7b08f09652100594d212423b257846af9698dea9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023481, "uuid": "6c21346e-9f0e-4ebf-9348-8de9641d4734", "value": "T1DFA55B077CD109EAD8AA973189B652927B70BC490F3263D72E90B7782F727E09D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023481, "uuid": "c3e6c8c1-ccdc-48d6-a282-8de5d1cd31cf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023481, "uuid": "6484ebd4-e853-4e3c-afde-e37e8f32a275", "value": "24576:tLg6NybdkopgCTHMTTyFsLKw2u2XP/gx1TgbQsLfsOtkJBele5r9DY70r1Q5:tLtMbdrgqHMTT/X92gx1TXsroKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023481, "uuid": "4928bc3f-9db6-4ef0-adba-2cc2aa3b095f", "value": 2204520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023481, "uuid": "c67f6b09-8b5d-43d8-b36a-74079bf840c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023481, "uuid": "614e09d7-9054-4364-a973-4a8817d7971a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65333850-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022177, "uuid": "443c667b-0880-4bf7-84cc-9c177ddec021", "comment": "Malware payload (AgentTesla)", "value": "51f33357faa562f71f606b4729bbfd5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022177, "uuid": "6689282b-e58f-4a11-8c08-2594d88257dd", "comment": "Malware payload (AgentTesla)", "value": "5f91b0a99f27f406b41c026b58eabb40d6131c0fd5dd3fc132093866bd3e9ad7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022177, "uuid": "76d66695-8d1b-4c58-9022-860c15f0f3ad", "comment": "Malware payload (AgentTesla)", "value": "309a56ac368d449fb211981206b57611ac271b5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022177, "uuid": "42d11fc8-8a4c-4d63-9c40-7009a04916ae", "comment": "Malware payload (AgentTesla)", "value": "8a00cac8116154d4f50346bec04c1884beb99af02392cfb617d2cc64a621f09fd553bc5e422b5c5fbc92381e2eee9bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022177, "uuid": "8813c95d-e7fb-4b6f-bd15-dc3cac10bceb", "value": "T11B95333E733489D141A911B30228DC46BAD5DD83BBF873FD9BDBB689939412C588F852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022177, "uuid": "ef2e5b38-aaa6-409b-b46c-74ef0f2710c8", "value": "49152:jKPvE32UgsIN8ZhFpVPXqIZYeIgwePzA+O6Rvx:mXEhINIhTVSIGeIVeum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022177, "uuid": "73677fb6-63f8-45ad-a44b-5aa6f3c31e39", "value": 1917916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022177, "uuid": "35ed7358-e8ef-4b98-8041-4fa1801d79a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022177, "uuid": "a2dd2cc7-a35c-4c41-8e95-7db71f5bcbca", "value": "5f91b0a99f27f406b41c026b58eabb40d6131c0fd5dd3fc132093866bd3e9ad7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72324531-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012321, "uuid": "c5ff9ee5-0476-410b-a422-5179ede0b858", "comment": "Malware payload (Mirai)", "value": "4f0c7fc6f28bf4b8907be5912dad099e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012321, "uuid": "2b9e4f75-0e6a-433e-b554-2e1d6538075e", "comment": "Malware payload (Mirai)", "value": "5f9a81923b447a2b76933b85274ac637a396266a4277a81e3520fbd57ab4b4f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012321, "uuid": "ccf3e320-bcd4-49dd-a6a1-29fab0f22236", "comment": "Malware payload (Mirai)", "value": "67d5be372c1b40a9ba79f376a5be47e51d6a1983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012321, "uuid": "7edcebbd-e68a-4d51-832f-a180d4849a5a", "comment": "Malware payload (Mirai)", "value": "d29f1b7486b6c7f4a99448c284a6a06a4ae8e2c82c02b16740dadfad274ff0a1c1a213352814a783529b225cc37bdc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012321, "uuid": "a450f113-d219-41ef-80fd-717fb1d6cd03", "value": "T117834A85FE8785F6E90B4C3051A7F23FD730D9690070AB69DF6DAF71CA73A01611628A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012321, "uuid": "80108918-c707-4203-b8bf-0d4bb1e69a03", "value": "1536:pHNWy3X1l0iGlkdr7WFff5f8+dkUJGWcC+RZPNi1asXk4vWWWWWWWWWWWWWWWd:pf3X1l0iGlkdr7ut8+yYP+RZPs1n04v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012321, "uuid": "ef4ddd64-b43a-4b8b-ba21-48527a662dac", "value": 87120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012321, "uuid": "0ca9eeda-a03e-47b2-9618-7de3cf31d0d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012321, "uuid": "c06e5efb-fb2c-4d66-9118-e0f12e7e6a84", "value": "zombie.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1c6ee4-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015422, "uuid": "8b12b541-9b65-4f71-b388-56779b731876", "comment": "Malware payload", "value": "6bf6dc1ef2b701940c783ba1a0d36f28", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015422, "uuid": "d39f2e15-bd80-4f13-bbaa-e63c2209c5b3", "comment": "Malware payload", "value": "61957349a7c9b309e9fdde65f304dda1a645f22036f063455f229fcb11da541c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015422, "uuid": "e2156b6c-0913-484c-a244-cf3817132ba1", "comment": "Malware payload", "value": "502c1d543294e1e46040e382b80e377eb1b51b1c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015422, "uuid": "a4f6885c-4e8d-4e31-8b05-71d6b63ab1da", "comment": "Malware payload", "value": "e4b312619df7c9337d02faa3c6d6ce2885a45bfced73a31afab1008b08a8e2413f893ffd06e571e51504de35a1856a97", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015422, "uuid": "d861460e-9478-4274-ae95-046b6d8e35de", "value": "T154052364BBA7DA23C6E3AEF498A915CD021EFCE59706851B3035F33DA6333729076125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015422, "uuid": "b4cafda7-57bb-4ef4-a4dd-78b8b0b64ed4", "value": "24576:YofwI/77dsy4u9nFaG+dCOOnJ8sUgWOZg3Cny:YofwIj7KpQnFaGfhnigWOGCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015422, "uuid": "b46943f8-7201-4f3c-b98f-fbeea2573e10", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015422, "uuid": "706e139b-7a64-41ee-894e-809ecbbe70e9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015422, "uuid": "097318f5-2c1d-407a-b4e8-32f8fc58baec", "value": "PO6273007142026_ Speficiation_Product_List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f935606-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012182, "uuid": "673ba8f2-f4a1-4e36-a9d7-557f5b9e3097", "comment": "Malware payload (Mirai)", "value": "c56ba81d43c36275cd49eddda235d965", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012182, "uuid": "da4e059f-7445-4747-8edc-5b29a082e85d", "comment": "Malware payload (Mirai)", "value": "61a1d7b2308b6d7809797d5ef860898cfdee7a1ca63afb92bebf430e1be8e6be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012182, "uuid": "acf6d157-87a8-41af-b612-e290a141f6d2", "comment": "Malware payload (Mirai)", "value": "053a291d7db8f65552037c6d8b7e00c906bf61e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012182, "uuid": "0db24465-8a56-429a-88c5-ec046218e3ce", "comment": "Malware payload (Mirai)", "value": "be347852aa7b9f8f0a7cd09fd0e7e0cbb79137399b7181d9cf61690cc366fd434ec9503bdbf336f18fd98a33b9b4dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012182, "uuid": "7808cac3-741a-4796-8037-5019841ee52b", "value": "T12E739E22D4696DE8C2884BB071ACCE386313E80162577FF6A51EC6BD6057EECF5097B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012182, "uuid": "ec995e38-5f6c-42bf-b585-620b08a27ad9", "value": "1536:X5Sgl+EKjja4QBRTfjWrho53/oKXaJgbg0eCDOqoKC:pJlHK/ZQnTfjWtY3/PXJg0eqoKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012182, "uuid": "fe0af67a-f2ef-45f0-b258-630e11ced055", "value": 76088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012182, "uuid": "7230fcb7-5acf-44ac-8472-c5f26e553ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012182, "uuid": "30a37b7f-79c4-4fbc-a8e3-05375b5f87db", "value": "zombie.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4680a296-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023844, "uuid": "ce4896ad-ea2a-4c89-8d58-c62a71f1e0e5", "comment": "Malware payload", "value": "a448372749873d4767e09273d1933bc3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023844, "uuid": "f6eb17ff-12de-4c85-a3a4-58db5a32be8c", "comment": "Malware payload", "value": "620d159595bf1c5423943374485886d0232effbf68d075978b882cda28f28137", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023844, "uuid": "c199678d-f608-4568-ab83-efabb05b4062", "comment": "Malware payload", "value": "639c6103bc00af856c0b049b7d74e29da710366c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023844, "uuid": "1b9f6e6a-1bc8-4da7-b640-a6bfb6967fab", "comment": "Malware payload", "value": "07bbb05286445bb30775218abfcf20b1b38240d27833f3fc38010aa5bf8be444d97e67bfade1436fb561e13801f5894b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023844, "uuid": "38811d8a-c1f6-41c1-aeb1-cba7211c1551", "value": "T128F1837D10BF0406B5E3F45E8F4B6241AA61B403364ADA647E1DF3849FEC3664296BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023844, "uuid": "31bf7985-2f70-4b4a-8ba9-2abc6d4ce4f6", "value": "192:odEGpWF0YGnYGIhuFGsfcG0SneJ+AKJJEeQOyNG2G1cz:o/kITisv4eJEY/Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023844, "uuid": "40cc57fc-66ec-45f9-bf88-ffc718b2226f", "value": 8094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023844, "uuid": "8eddb0c1-b7a7-4434-816f-ccdd03e90728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023844, "uuid": "cb89482b-2528-4c9e-b30d-2f538f9095ef", "value": "camera.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7d5b42-7f46-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784007667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007667, "uuid": "425368f8-fc75-4453-8d42-f19a7c8fb2ce", "comment": "Malware payload", "value": "04224150f15babb184cab117fc6b3db2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007667, "uuid": "5d6246a2-9539-4668-8108-b002f197eebd", "comment": "Malware payload", "value": "6248c0be6226170c5d4bd96e3be581705d8d79831066090a8d19506409f12b01", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007667, "uuid": "37f260a1-0ef3-483e-8a16-5a4de476a3f3", "comment": "Malware payload", "value": "1f1318061e0d85ca263a4944e01ef42878e4e4fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007667, "uuid": "9a6d64ee-dcd4-4d36-b97b-4521d12987cb", "comment": "Malware payload", "value": "969dcad49f2cfa1d507189576662c87f9bb253c3e23c9ad9e5ca9374e53fe25ce95b4abad9670a57005336fa30bc6f8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007667, "uuid": "3d54103e-173e-495b-bab3-2626c1a06e08", "value": "T172C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007667, "uuid": "3de2d4e1-0e78-4113-a5ba-e65b9c4fa1ef", "value": "768:78vCB+25j6es8REC9FYpMSUpi+20qUpi+20YQX:78l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784007667, "uuid": "827d883e-de47-4729-b014-84cf90974e04", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784007667, "uuid": "65b1e7b4-d43a-43ab-ba79-c6376deefeea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007667, "uuid": "92e6f4a0-36f2-491b-bc49-185b528354ef", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9320b1-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012313, "uuid": "994e6e9f-7a91-46e0-a0e5-0da7a1bb4b10", "comment": "Malware payload (Mirai)", "value": "c0ebeca6f065b54b47bd275ed6083130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012313, "uuid": "0d07a7c5-3cee-4828-9cc1-4a37792f3603", "comment": "Malware payload (Mirai)", "value": "62bd3cc780e119e321a9a99f64376de8ace225d30a1c186e04beb32697b180c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012313, "uuid": "2eada854-8014-4fea-9b3f-e999e37c296d", "comment": "Malware payload (Mirai)", "value": "1c405c8b873bbe5bd5c462457a61ca3f30c884da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012313, "uuid": "a09facba-fc7e-4c07-ab68-8d46def405f2", "comment": "Malware payload (Mirai)", "value": "cc37667dc7cc2b8897973ee5aa61178cc5f02e9cb177734d9e501fbc54d2775d892dbe8b81e72646d37167aff1f71f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012313, "uuid": "1936c75d-a780-4b5a-bdf1-f808e064c99c", "value": "T1E9532947FCD1C91AC6C0537AAB7E658E335273A9C1EE7213CD155B2226C6A0F0EBB640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012313, "uuid": "74e448ce-ef8a-472e-8272-b10277d15f8f", "value": "768:iJ2JUrAkOVWoIWUpo/7NAQlpKCrFifzWYY6ft6ILuG35H5zPQ8QIODC/BNY9aoO:ijAkWpmQTKCJoH6ICaVPQzIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012313, "uuid": "2293ba73-e8eb-40c2-af40-26bd53f42d9d", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012313, "uuid": "7f642faa-ab14-4014-9d67-40f25e646f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012313, "uuid": "603c3413-4c44-4ca5-beea-30ae312e9139", "value": "zombie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b045436-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015395, "uuid": "cd10fda7-aac7-47b2-b59d-86156db53778", "comment": "Malware payload", "value": "8fbc1e181a52d06f7df3305760d9a0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015395, "uuid": "399689e3-138b-46ef-9460-669ebb855b35", "comment": "Malware payload", "value": "63a926f2f999372a15ee189c947bdb0aef96abe5243115526f7d2b928fdf3e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015395, "uuid": "24a43441-7964-411d-9b3e-c72a04c27f57", "comment": "Malware payload", "value": "dcecbdcbc1e7874e50c932981228ba4d44cc67a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015395, "uuid": "d42804f3-81d7-4087-ac21-68794ceee29a", "comment": "Malware payload", "value": "26eb753b0bb409dd491dd8f041f50ec413d8d8ff4fd0daf58852608dc49185ef9020952c40551e04e6faa0a0e7e8d557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015395, "uuid": "58fbbd28-5943-4259-bb8e-4fa88481a406", "value": "T1DA11AB2F97489DF3F8AC23B80E9F8400366C25B03382C5D34CC8A56536547D97EB7809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015395, "uuid": "4a596926-d1df-4654-8b48-acffde4c192f", "value": "6:idqmVg3F+X32sXoPW6aqFR164TdVB4hAtQKEv/ISuEXW+d7x/FlAEWQf+:eNGSGdW6aq/1hdz4WXUnjWM7bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015395, "uuid": "d2450dc3-0f72-4f82-89d1-2f2158d09d7d", "value": 1089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015395, "uuid": "f12a26c2-0a83-49af-9e49-c9c980230423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015395, "uuid": "ce54b205-d776-494a-ad27-98f6a0b6802e", "value": "8fbc1e181a52d06f7df3305760d9a0bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7db34d5-7fb7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784056300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056300, "uuid": "f1202b18-6b83-4a73-aebb-b90ac0778751", "comment": "Malware payload", "value": "c00be06ef63935446cc2ec5b865d6ef5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056300, "uuid": "2c46f3dd-cc39-424c-bfec-b4b2f9ad7cb2", "comment": "Malware payload", "value": "641b5af758b9636aaab679f428033b44961a96516b8287b8b3ea828a42e8e028", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056300, "uuid": "63f37f1e-d611-42eb-ba71-b8cc4b761595", "comment": "Malware payload", "value": "eeea1e4098adebda09ba1e32ad411e546bebb103", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056300, "uuid": "98c7bc6d-8ac7-4afa-a230-4be623743015", "comment": "Malware payload", "value": "319eb33d8137d210bbfe574cb93333c381ed4bc5466aa5b64412e9adf5e6e3f57ee0a09ceaac7883c471a22d1a348a1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056300, "uuid": "9ee2a469-a831-4d5b-9668-aad27b03ac67", "value": "T18DC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224D42AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056300, "uuid": "a6fa9b75-b4a6-452a-a65b-dd615dbad3ef", "value": "768:P8vCB+25j6es8Rm9FYpMSUpi+20qUpi+20YQX:P8l25JQd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784056300, "uuid": "2dcc4e8f-fe38-43c8-812b-293d058162da", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784056300, "uuid": "ad38935f-33c8-4c1a-b50b-9eb0bb0797f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056300, "uuid": "7d680fbe-6a0f-442b-9670-077f2ee0a534", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a1827-7fbd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784058728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058728, "uuid": "6b1bce47-5785-4765-8b3d-e843db328e7c", "comment": "Malware payload (Efimer)", "value": "9733360ab9f50521b202b203e938e042", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058728, "uuid": "bc13fefd-4059-4d1a-9409-e9ea2db1f697", "comment": "Malware payload (Efimer)", "value": "6589805ec9895c732a4a42ab270862fd9495a6bfcb5270e087ccb20e5dffab58", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058728, "uuid": "df966a29-f32e-4e47-943b-9284b0fc3301", "comment": "Malware payload (Efimer)", "value": "ea8723d17e26e977eed71cfa5148b85023060363", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784058728, "uuid": "d55981b7-b501-4438-aa77-464e4a6c17e8", "comment": "Malware payload (Efimer)", "value": "074b7329950d9c855171c62fd3e450125a22a741e251bfeefe9c285e5cb7a73ee25284542ce5b7644ca78b9f3d650773", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058728, "uuid": "47d82e52-cc9a-4bf9-9872-b28ef23ad024", "value": "T110E633287BE441FEE163803CECF790F2D669786A17B2C6CF4B909661AE571F04839617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058728, "uuid": "074ec01f-b146-4fc2-b3d1-7a848201d062", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058728, "uuid": "8ddd8d30-ab25-4a04-a901-876a945559c1", "value": "393216:iUkp1Bhv+hYhzUDMQmyOXMCHWUjXGcuI3/PGTAI:id1BhuYhzKpqXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784058728, "uuid": "a0c5fb07-3f9d-4e0b-890d-9353b16aca22", "value": 14314613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784058728, "uuid": "c993c3e0-f70d-428c-b9fb-77230eb4546f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784058728, "uuid": "d4a3c12c-f0c2-443e-b80d-09c9f1b2ef01", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b6560e-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784012145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012145, "uuid": "8d758c9e-5497-43b9-aa98-1db4b9a046cb", "comment": "Malware payload (RemcosRAT)", "value": "9eda3f02b5641e2bd0efdc6220ed6d2e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012145, "uuid": "7ea05209-1c82-4e41-8a1c-57e4cc0084e4", "comment": "Malware payload (RemcosRAT)", "value": "65b85387dc62465bec84ce49dc546921f8ab2665b18065fc77706705c470d45e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012145, "uuid": "96347d26-4590-4763-a8fa-8cb0572b3fb4", "comment": "Malware payload (RemcosRAT)", "value": "6660d7caedca289bcf2f28d7d3578ed2626f0b2c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012145, "uuid": "c6566a86-3315-4658-a40b-3ee5893e7f6a", "comment": "Malware payload (RemcosRAT)", "value": "102969c413f54e22a9ecc651b5411fc5976ba730392a37986ae1cd545f869b520b4e49775703611a8db078445e194832", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012145, "uuid": "9223e87e-d303-46a1-9ca8-0a7ea8135b81", "value": "T1BBB52359895D76DF4901F1FBB316B9883289C38B8986432743ACC6B131F68E4DA77C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012145, "uuid": "7c34cbb8-7a7d-4b3e-b068-27425166cfa7", "value": "24576:vqd8JmrZsQINii9yKuLQLMm+03V5x38IAl5eYuUIrrd+MiMFCbQdlTDTRxsAscav:cPIRKQYm/7DPrgMi+5XTDlq8d6aaog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012145, "uuid": "161e681c-4d89-4b64-93d4-1b1ae18600d2", "value": 2374455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012145, "uuid": "5b1579fd-af3f-4245-989e-aa2dacb0a60c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012145, "uuid": "2545b4c4-84cc-4305-976f-5069f4a513fa", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4bf20b-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784035876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035876, "uuid": "f72380ca-7874-4e6d-a2fc-77e5bd3441d5", "comment": "Malware payload (RustyStealer)", "value": "7263d0a05b38f329d32c73fd1492827c", "object_relation": "md5", "Tag": [ { "name": "EstivStealer", "colour": "#69B37D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035876, "uuid": "8b3ad3f3-2c5d-4a81-9b0c-7665f71ec125", "comment": "Malware payload (RustyStealer)", "value": "66aa355bbe91a7fdf756e69fb9649cc5b6cc46f61f69ac2650b9842e3545256f", "object_relation": "sha256", "Tag": [ { "name": "EstivStealer", "colour": "#69B37D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035876, "uuid": "2705a0d1-73ea-417a-a0e5-50744cbaf0e5", "comment": "Malware payload (RustyStealer)", "value": "db0a976ca10fecdb75d2713b536155feacaddb96", "object_relation": "sha1", "Tag": [ { "name": "EstivStealer", "colour": "#69B37D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035876, "uuid": "5b9b1119-3490-428c-a309-893cd1bd4a3d", "comment": "Malware payload (RustyStealer)", "value": "44ffb5bc86027008318be1083eac06b46034db1a6dc686209326aac44325a8d39d048c299ab5828fd3703f05b2666bf9", "object_relation": "sha3-384", "Tag": [ { "name": "EstivStealer", "colour": "#69B37D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035876, "uuid": "a3c41671-70fd-44b3-b8c5-ba745370c432", "value": "T15DE59D43FBA981E9C09EC17CC7165227EB72B88D5620B79B27E40A213F57B625F8D344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035876, "uuid": "f8e6a4b0-d32c-41cb-82f0-121f8f8c0291", "value": "3a7b38c4e1e4c2f82a93ffd6e94cadd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035876, "uuid": "5bda07cf-bf0c-43f8-b0e0-2131a523881d", "value": "49152:aIiIYhXChOEdMV8hlmLzjYMU4SU7g4SCwGim4oOXr/NxOzfQvv2Y4tRBc:aIRsYjfpoMYQn2YIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035876, "uuid": "34feaa3e-5fa6-42a5-a274-508599a0df20", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035876, "uuid": "f96ea8e2-0220-461d-a521-ea2497aaabfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035876, "uuid": "77613346-51fd-4eaa-87d7-eddd44c632dd", "value": "66aa355bbe91a7fdf756e69fb9649cc5b6cc46f61f69ac2650b9842e3545256f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97619b10-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "441fbc67-14a5-4f35-a1e8-8b160323eb56", "comment": "Malware payload (Mirai)", "value": "e4e7c72b242181709f7b3c30313b7c73", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "54d2f031-9963-4b8c-ae62-3780c29eb7ce", "comment": "Malware payload (Mirai)", "value": "670ab8d941f7b6bc4a0d0def872adcd976c4ea84910fbe1c251f4ab37bed45b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "414ff58c-4be0-41ce-a9fa-59176c8b59a6", "comment": "Malware payload (Mirai)", "value": "5a3f876df2c75a9daa3163981b3d63f9c5a6f227", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011953, "uuid": "f238eded-069c-45c4-a9e3-b0945819ed9d", "comment": "Malware payload (Mirai)", "value": "286eb3242552e9a76cc79d387a7157619aa7481ac4a4c79c7d6b7891501f692e793a898ae4fa3dd167332c88aeb3d89a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "4136cd56-f07b-4851-bf54-e91f91f3b19f", "value": "T1D704C706AB910FFBDCAFDD3746E9070139CC651B22A93B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "03ad6c6f-7dd8-4c56-bb62-8c4c3b422c67", "value": "1536:jKlPT/yQntb7N07AsuAzPk/eDsydc5TcSuVWCb5pUQHVcZnaOu4cAgED/TmhrGxn:uxpnD08suWOeDFdp1cHtgEDShynxxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011953, "uuid": "9d87372c-9a7a-4171-9d41-bcafc2ab9138", "value": 177848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011953, "uuid": "8d76677d-79d3-44e0-b6fd-b18fc4976ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011953, "uuid": "a77cc10e-8fe6-44fb-9e1e-636813eacf80", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5c56ec-7f32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783999052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999052, "uuid": "4f7b1ffa-e472-4cb2-952e-64ad838fdf0d", "comment": "Malware payload (AsyncRAT)", "value": "00ac5aa32e0cb96c1f2034deb5604094", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999052, "uuid": "b84a95c3-e1ac-4f05-b63e-f7135aa7af2a", "comment": "Malware payload (AsyncRAT)", "value": "6773709e7c85e57a2ed16ac1f162b02bb35a7c516927b99d483c72dfbf88664a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999052, "uuid": "74ac5364-a311-4e2d-bb10-d27df2d355dd", "comment": "Malware payload (AsyncRAT)", "value": "765b077c6c0bb51c987af9644d31cfcbae93d36b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999052, "uuid": "5b9695d0-bb84-42f3-9443-10bf5f87ba8f", "comment": "Malware payload (AsyncRAT)", "value": "56762d68507b6bd03486593d4c2a506f5a498188e747c5ffea9373a609c2c952c7450828388b217e2afe44c6e0f5245c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999052, "uuid": "294bc5df-7ee7-4ceb-b1e5-0706d615fd17", "value": "T1D2C22B0833E4C576D2FD4ABE8C33E6008B75A55B9913D75A6FC490AD29237CD8A14FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999052, "uuid": "11f6875c-76f8-4003-8202-3e2c706e7932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999052, "uuid": "b8febfc8-5f28-4aed-afea-a53f6c34a7af", "value": "384:cgSVEEMiNPWmvHtZARPn9jaH9qbuUs/bQxnCJfJBndnjJ6Kb6:cgSVXFdt+kIb7BiBnLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783999052, "uuid": "42f9b21f-9e7d-4ba3-aa6b-1529319b5908", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783999052, "uuid": "970e6c16-61d3-4189-9c29-61417c1cf9fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999052, "uuid": "93150f73-6d63-4903-bcfe-7d3f16d0c6c4", "value": "NEW88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4d1d08-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "98be1648-6269-4e5d-b7b9-49410c08c1e2", "comment": "Malware payload (Mirai)", "value": "bdc786d37824bea9df5666019c4a6f29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "29218c62-0c99-44f9-ac81-ff56efe08c40", "comment": "Malware payload (Mirai)", "value": "68056425530a9d4b1f75c40f793b0effc8fb538b02c4bb514effcce17c53e07c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "f26ad077-af43-468d-8be4-954204d0fb6f", "comment": "Malware payload (Mirai)", "value": "6b1de5c52d34cb814ea0cb0eac2af03f878a756d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011940, "uuid": "2e959d5b-53a4-4954-a6ce-a4d24bb3ae89", "comment": "Malware payload (Mirai)", "value": "cb9e7f5d54efb21d3f3ce7fb2a8e5d0baea9e8bc8b2958387c30661c3f5c3a0fe59cf44a637c6756b5372c72516944e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "1d4028fe-056d-474f-ac83-fe8059f497bf", "value": "T1AB21CE6657E35D16CC540277DCEF3710E362AE44859EF453E32106910C3F31A1F2305A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "0e20dcca-8e57-4192-b09e-ad01da756aa7", "value": "24:J/GgP9qD0at6EoWGIrUlFSs0VzLCkIdhUg0RGIZ8mNf6:J/PFqDPthrkFSsCzL8IZDNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011940, "uuid": "72c6fcb5-62fd-4694-ae29-24a52d9bcc2e", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011940, "uuid": "512d322f-8db0-4576-94d4-5aa9fb4a5e3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011940, "uuid": "a8baf16d-89af-491c-b495-2a08dda9dda1", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c3c96-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784009368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009368, "uuid": "6058791f-c3c4-4882-93c3-196488fa7f21", "comment": "Malware payload (PureRAT)", "value": "96643dad566ec23b8917bd08cd0bb575", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009368, "uuid": "554a600f-7897-410b-abf5-7a6b57e422f4", "comment": "Malware payload (PureRAT)", "value": "68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009368, "uuid": "0a198593-7f2b-4d0f-87a7-dd4ee663c547", "comment": "Malware payload (PureRAT)", "value": "097e7d7db52c47e763663991962b99f4920a3a5b", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009368, "uuid": "9fa9eb5a-1e97-462e-a2d2-f1c249f39279", "comment": "Malware payload (PureRAT)", "value": "054454f71e3d97d214a075434db4d58fbf149ef512de3e186e3a107371cb4830f5c79ac67c6aa0168ec5813a970106a1", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009368, "uuid": "c252a871-bb3d-4086-8ccc-526b362f12a1", "value": "T17C067C74D351B064D1A7C430CEDA4EF464A1303B52366D1F1BC5E81A25FBE61ABAE3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009368, "uuid": "5773f2dc-5822-4934-aad3-71ba1fbfd857", "value": "97694f39fe306148caaada69136cf645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009368, "uuid": "9a314a77-72fa-4d4b-a36a-35b7805a2792", "value": "49152:y78S36AtvIjjgt/rnOkHvdYMthulU3bBuYM1ZH2d6dqD3npkVclmyXu2F+QGt01S:uX1fhTk+T+k+p1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009368, "uuid": "e6641056-2cb8-48ce-bdf4-7a0e7fbb7e9e", "value": 3736064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009368, "uuid": "f2cf0ef6-30f2-4848-9db7-459b737bc41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009368, "uuid": "55b9c172-381d-4140-b5f0-3fc76c6bf66e", "value": "psl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2bd477-7f85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034884, "uuid": "c70e7089-bdb5-4f5c-9554-9c1bba8973b9", "comment": "Malware payload (Mirai)", "value": "482ad9987d5e93ab0dfaeadef4197b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034884, "uuid": "0f7a67ab-bb69-4dda-b47f-70d33a650d4e", "comment": "Malware payload (Mirai)", "value": "6936b7e1bacd7edc3383f72c44dbb2763dd06eb3c71425e9658aa582b8d7e7cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034884, "uuid": "21bd07c6-dc29-4e94-8ed6-49d07494aaa8", "comment": "Malware payload (Mirai)", "value": "1119371b3a52e7d98ae5065afa3e3a9919614427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034884, "uuid": "4abc4c6c-4483-43a7-bc92-4c541c375210", "comment": "Malware payload (Mirai)", "value": "fd1000f5986d1ab0bf9f927b43f9033fb572fe24fca01de75a01bbcda5f3842b24297095337752b930d16d81494ad017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034884, "uuid": "84d9de35-a10e-46d2-a4fa-518aac75cf89", "value": "T1343422C4AB85B91B1CB366FD0E1E097A2DE66AF84EC506D14318339C623525225F35FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034884, "uuid": "c539eb4e-e944-4e79-a16d-eec53c9323da", "value": "6144:xJquIlmsq7/xIuCZ8QbLOBYGc4uMbwrEvC21blvkx:xcmrsZNLOvc4uMbwoq2Lkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034884, "uuid": "fe7753c0-1ab1-4dcf-8987-0eb6906b705d", "value": 243764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034884, "uuid": "d38f7c67-1d14-4682-a1c6-08cd2cc2a1ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034884, "uuid": "b71f14ae-35a5-430c-87de-6993a5e38149", "value": "abzutimdw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47988e4-7fd6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784069528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784069528, "uuid": "bd67c9e4-7899-4d92-8401-b0b190c6ebe3", "comment": "Malware payload", "value": "a79ab903483c62586664b52b32923e37", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784069528, "uuid": "48f62513-b0a6-4c55-8970-f9fa550eaa68", "comment": "Malware payload", "value": "69a2951532eb07aca5543f9e726cc9c1bb0ce7f5551c6eff336f508c7a0e7a38", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784069528, "uuid": "42d757a1-c7f2-4751-bcbd-b52da62a3e11", "comment": "Malware payload", "value": "6e46132425df7b18c2c6192a9711516f1b6d626e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784069528, "uuid": "715053ea-7355-4778-9f8e-480e68e2710b", "comment": "Malware payload", "value": "f821bb5f4d1e46f7fd6a20e8552bc6dbc6809b20d3883039fcd0168a73dd1bed0a3902a230349b5df09844b47ae9f04e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784069528, "uuid": "5cc6950d-0119-444a-986d-3fe728aededc", "value": "T117E6331C79D101FEEEB3013DEEE21669E4A470A04732C99F539487A25E172E28D3B767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784069528, "uuid": "f7edc1d3-4f24-42a2-af02-b585be09668a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784069528, "uuid": "2a17b0be-1740-4c9d-889b-4e28be548feb", "value": "393216:UJ+SbiLpd08zB1Sb38aVXMCHWUjX8cuI3/PGTAI:UJ+TddZzBQr8aVXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784069528, "uuid": "63d63820-a78d-43b2-832f-50fabc87343d", "value": 14287034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784069528, "uuid": "601162ca-6ae3-4c5e-ae48-6e9d90dec698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784069528, "uuid": "2d97bf9c-70de-4b4b-8d9b-814240679f1b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66969bf6-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784022609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022609, "uuid": "ce8c1002-6c87-4d8f-80e2-4055da70ed4a", "comment": "Malware payload (Mirai)", "value": "0465f80f87500e6f6329e6de8dc3c7a6", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022609, "uuid": "0e24a3a6-7800-4d3a-9690-23c2c6fd7be1", "comment": "Malware payload (Mirai)", "value": "69c2daed1f72e42a9bd524011c3b3a7c4c209539b51d807a4196a3c458713c97", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022609, "uuid": "f94cc31d-f505-4d8b-8a57-c329573ee096", "comment": "Malware payload (Mirai)", "value": "1c96151d588d07c2c15fabbd0145b8caa3090f94", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022609, "uuid": "426041b3-748c-4a66-8378-4fa854f7ac64", "comment": "Malware payload (Mirai)", "value": "881638817d778c2eea6fb460ccbb7739e446418d04e5ef61103bf143f89e55a629db8cc9edcbe2c13ad601d106a1c42a", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022609, "uuid": "d97672be-e7d7-421b-9f52-dede9b69e4d2", "value": "T18A72D091F3717CC7E77116363EB53A2FC2F0DEE45265950AA6821AC52831302CCB1F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022609, "uuid": "44b16bc5-e885-477d-b9d7-e5b3ad533e52", "value": "384:/a4VwvizcwMOvZ7xgCCuuoJamdrAZjtoR/2aCNAZwFbe7E4P:i2zcwTZdVLJJrgp826CFbeI4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022609, "uuid": "bd3f63af-719d-4182-a41f-aedca061f49f", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022609, "uuid": "ace8228a-14b5-401a-bf25-1c0f740fa807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022609, "uuid": "fd03076e-8306-41de-a193-d1289d9db754", "value": "69c2daed1f72e42a9bd524011c3b3a7c4c209539b51d807a4196a3c458713c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3213dc3-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023999, "uuid": "7cd5d409-b6ac-4ea0-9a6c-2526ce634f15", "comment": "Malware payload (AgentTesla)", "value": "829f091dcbbb51588990a238c87b94d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023999, "uuid": "a0321f0b-676e-43da-b510-4eb70b065761", "comment": "Malware payload (AgentTesla)", "value": "6be55e959aff450d4778e873773ca17ce470e5f1434c75aa1e8603f32fbfa058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023999, "uuid": "efbcba33-38df-41a0-a572-b05e1d642963", "comment": "Malware payload (AgentTesla)", "value": "5883d0cf52f4c52c43add27c144fb85e6c4fb12f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023999, "uuid": "3cd89781-717d-4f83-932e-f459e113bfd0", "comment": "Malware payload (AgentTesla)", "value": "fa0424a60645fe0c962cd4af22bddac1584ede62293dad7c91744480df6c209ebfdbff7af8a4acdb54997a0dda336b42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023999, "uuid": "8b30f6f2-ad84-4b19-8323-187391961276", "value": "T155F5F9959768A173B720D79D913AEE38A40E600329DDDF04345ED228792DE8BD34CBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023999, "uuid": "ef92c6bc-2cf6-4b8c-a8fe-21f360bfe1de", "value": "98304:FZ/RwjcbxT7IZ3UMLp/7fqu2jm9FPpeWz/NJ3J8xZ3xg6HygD6SieH9:j/RwcFIZ33RaqPp7z/NA3xg6Hh6v29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023999, "uuid": "5bcaa00e-4f01-42ac-9e59-8767cb2c3b3a", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023999, "uuid": "fa678cce-cb5e-4ae7-8597-f6a2124db207", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023999, "uuid": "5876cbd3-a661-422a-ba0d-6ee70bb48822", "value": "DOCUMENTO DI BORDO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08caeeb5-7f9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784043497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043497, "uuid": "2af50c20-7fce-411e-ac25-e26beb901014", "comment": "Malware payload", "value": "fd1fd029078c67aa0649192e1d1f0e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043497, "uuid": "dd2a2045-cb3f-4fa9-84e5-746e0405d15f", "comment": "Malware payload", "value": "6c4410c4a65762d91109c5ded9e432689f6e274229551fc1cc66059342864477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043497, "uuid": "a8698a74-e7b6-400a-a1e5-762999fc4f31", "comment": "Malware payload", "value": "15f04cf072f7654bc9133f78bed4e3cf23c9672f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043497, "uuid": "6a71d978-22f5-4617-80d5-a4387e5a8405", "comment": "Malware payload", "value": "32848355c1fbc4ccb871ee292ce4f8815e8a1bd4b1f3c6c29810d8e1e68772b028c12d358c9afd47306292fd90513efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043497, "uuid": "b5a963e0-be4a-4804-8c96-29508a962280", "value": "T136D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043497, "uuid": "92bb2264-3ce7-4343-a1ee-9b25c402a320", "value": "92576cbf961890053b0276abaa28bb78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043497, "uuid": "a984ce78-a81a-4270-a126-375cd8115aaf", "value": "12288:7NH+AxETh1IpJWIf9KvvGQJClDeSF6Xlj:7kAqTXCJDWg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784043497, "uuid": "96b83c83-0de8-40a4-842f-2c39dbf226a2", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784043497, "uuid": "fa2c811e-19f4-449a-bff6-46398910f3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043497, "uuid": "e8f99141-dcfa-41a7-a2a7-7bef4e5307e2", "value": "SecuriteInfo.com.FileRepMalware.52226741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7392abe3-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784023919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023919, "uuid": "2ca6fae8-cbbf-4bd2-82c6-95cacc02d143", "comment": "Malware payload (RemcosRAT)", "value": "1e2c67bf2df60d0da4308925fac7d5e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023919, "uuid": "ad384d89-5a8d-4cec-99ed-f5f4b1530bc6", "comment": "Malware payload (RemcosRAT)", "value": "6cd42e6eb75c0bb98e9846b9faf9bdf66856658bae7209106ed8041d54f6cc2e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023919, "uuid": "1cea4821-1683-4567-a523-7a1873f9fd55", "comment": "Malware payload (RemcosRAT)", "value": "20d0af818b46839cf4d846c09a9992607de12eb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023919, "uuid": "93ce6f8a-6bf7-4074-8b6b-1fcc660995d2", "comment": "Malware payload (RemcosRAT)", "value": "d3538e3879b33008d179a9c335ecccac2427681bf7c1444e8a9cdb66c966b58e9a889d3b4e34696874e848ca65038b0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023919, "uuid": "85bb5cd2-1aa2-4900-a869-95cb8954cc61", "value": "T16CE6050D92DBA3A3CF10963CB5F3189BAB1DDE0B841F5DAE8D49EC1C5B6940CF098569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023919, "uuid": "f86cf254-b331-40df-8e9c-9295b6561ab9", "value": "3072:zj7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7b:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023919, "uuid": "2c64d680-5330-44f1-a6bc-2b87ec00bebd", "value": 14951732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023919, "uuid": "9e491629-df22-4c48-86e3-08794ae3b08d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023919, "uuid": "6472b5c0-94dc-4bd4-897c-e2b35e87b6a8", "value": "873238334074_FedEx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2847775-7f7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784030924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030924, "uuid": "64bd3c0a-dd6e-424d-800e-63893ef5430c", "comment": "Malware payload", "value": "6d1dc3ceb2077ec5bffd42bdbff2ebd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030924, "uuid": "68c2cff0-b2d9-4f42-a02c-e665e9c32446", "comment": "Malware payload", "value": "6ce99b03b6abf6a62caefde01e944aa57812e7572f24f186aba33a0d33501873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030924, "uuid": "81160981-025b-4da4-a3e9-398b35b1dc8d", "comment": "Malware payload", "value": "058494c8a32d5c0814d062758b084714e583de33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030924, "uuid": "8c5d6a2c-41e6-4855-9995-e49f2f609cdf", "comment": "Malware payload", "value": "a80f54a39fa73cfbae6fe1e831e2f26701246ced4df5e7ab3ecf85cd22a5f4486584b03e27a7735e38de06ac25bb4176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030924, "uuid": "58e0f9bb-aae8-4d6d-81ff-727a1af38517", "value": "T1C8332A95FC029A13C6C555BBFF0F828D772613A8E2EE73039A25AB2137878560E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030924, "uuid": "2cc2442a-7a04-4bb6-832d-fb6a0bc022d4", "value": "768:BZ7Dw5Zk9m8dQDvnSyblZM5SEwHlej+OO5wbNWCoqVvMP3HlJm3tzngREI:TRivvc5SjeaOOO4CPC0dDgRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030924, "uuid": "61b60d2a-7da9-4ca6-a725-71019816b10d", "value": 53172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030924, "uuid": "c29d8704-c0f0-499f-9e6c-7b96196b1764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030924, "uuid": "c695a376-c0d6-47bb-a75b-b46db0982dab", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0f6823-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022053, "uuid": "2c57ebfe-1a98-47a2-bb84-94d70b269642", "comment": "Malware payload (AgentTesla)", "value": "a985c254ed2d791688736f83ee2befde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022053, "uuid": "c06e8107-7f55-4d46-80b1-6a07400ddf9c", "comment": "Malware payload (AgentTesla)", "value": "6e00f52072b251d58ce01eecd95aa6022db7ba161e7d68d2c224091392f6c832", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022053, "uuid": "7ec09407-9494-47f6-999d-5a7e76240ed8", "comment": "Malware payload (AgentTesla)", "value": "397819924ee78628c50f09b86a88b10ce6eb4299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022053, "uuid": "4c9e50fe-8202-4422-b51f-4cf729323fdf", "comment": "Malware payload (AgentTesla)", "value": "b4e6bba06d655317a4e91350a5603095b9f4b591f843ae1ed7e23b8120eaf662c0b57c9754594dcacbee58e3db0c7140", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022053, "uuid": "3e9d54b7-9358-4470-9ab1-6fdfe1582c3a", "value": "T13F340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022053, "uuid": "620eceda-bf3a-4b04-a798-fb76c479acd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022053, "uuid": "6b73e086-003b-4a78-a609-562e61877717", "value": "3072:LPLdNyKayCB+FI18Gy4gETHo9rG8KaG5jnThSqwufzz:LDPyKayC0+C+sq8KaWTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022053, "uuid": "b3017d45-330e-49cf-812d-7ab16045d40f", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022053, "uuid": "763195d7-d4c0-41d3-93da-51b2589617be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022053, "uuid": "8fab079f-edf4-44b3-8ddf-abec65002a1d", "value": "6e00f52072b251d58ce01eecd95aa6022db7ba161e7d68d2c224091392f6c832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717227d8-7f3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784004588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004588, "uuid": "289b2b52-1957-44fb-b331-80b5e1f1561b", "comment": "Malware payload", "value": "dd92a87e40f664748255dcffddc8b238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004588, "uuid": "39002bdf-55c5-4685-b476-72e9d739ec54", "comment": "Malware payload", "value": "6e09d15e9ccadd14880f71f19273b3ccd440ed9cc2cc9d40bf4184e2dc647f64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004588, "uuid": "fb3b6892-c546-4c9d-a77d-9dff1756a124", "comment": "Malware payload", "value": "0b33330e8fe64d2b427584e1c3bf1ce86584d5c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004588, "uuid": "c7e5cfaf-f9f7-424a-9230-06a9886fbc7a", "comment": "Malware payload", "value": "83614d615aba9e21bf1f282673ac8ab0804d3b28f0ccada6ad45ae90291534977ddef6e11bed496d68a5277c0f374d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004588, "uuid": "b0d2f987-6ed5-4be7-b46c-5498a34b95ea", "value": "T1D27533BF80476AF9F185BC58B72E3F62644554E12ACF38048EDEE231467FAD46972243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004588, "uuid": "7a592d3a-f407-4870-8791-4fd5af608fe0", "value": "49152:QlDQ8OpPd89+78vgpa5wym7/8cpVe445kOlp/:iDIp8+7MAfTAk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784004588, "uuid": "a9f167de-c41c-4219-9fbd-4117a8c4aaf1", "value": 1680000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784004588, "uuid": "7a1e5388-05f6-4134-a630-0bfe0daeec0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004588, "uuid": "15e38271-ef52-4eac-be5a-2994de6cfeae", "value": "6e09d15e9ccadd14880f71f19273b3ccd440ed9cc2cc9d40bf4184e2dc647f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f906fe35-7f9b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784044329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044329, "uuid": "992aed95-ff1a-49a9-be35-60099253676c", "comment": "Malware payload (Efimer)", "value": "0478fbc916f64dd814a4ff330eaccb66", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044329, "uuid": "28d13070-9a49-4854-ac29-29c56d934692", "comment": "Malware payload (Efimer)", "value": "6e7516a816c34eb1f9e2b1399ead4ed9a64e2132ecbb9c5e86bd249ae9fe304a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044329, "uuid": "9643d2eb-6a70-41bb-a4df-2a5373d73052", "comment": "Malware payload (Efimer)", "value": "e3de68dd96f13ff80c1c309d3ae620fd6521239b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044329, "uuid": "f50a2dcc-b048-4fff-807f-1ce5beaee8a0", "comment": "Malware payload (Efimer)", "value": "7b2d6fdd01291e029c1c5a5a4815234fe6c4f935f6aa271123aa3ec6b32cee219e60f0940fd310aca3037f825c4c70d9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044329, "uuid": "0ca33fd2-6990-4baa-8d01-425c491a4ef8", "value": "T1F5E63318A9C601EEF9F3513DEDE06684CAE9B4A50779DADF03A883A16D171D0DC3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044329, "uuid": "d3758017-2e05-45ac-bd90-84d2a12e4caa", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044329, "uuid": "6e2d7827-ff3b-409f-bc9a-2bfb9a5e56b4", "value": "393216:xg8xCGGtmtSuUaCseeqD5XMCHWUjX+cuI3/PGTAI:xgGCG6mt/UaY5XMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044329, "uuid": "27f4e80f-1dfe-4f3e-8660-9b513891c12b", "value": 14296293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044329, "uuid": "2753d2a0-b9d4-432f-998f-f59a0d85e8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044329, "uuid": "8719c50b-c7c2-49b0-b7f8-e554d88e1b13", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6156d1aa-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022171, "uuid": "2d3d5734-aaff-44f5-9bcf-c5102f527725", "comment": "Malware payload (AgentTesla)", "value": "3be06997915d38099ba249d344596419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022171, "uuid": "cee3afdc-ff55-4e58-af89-076b82ceb21b", "comment": "Malware payload (AgentTesla)", "value": "6eef6eaca090292e580440cca598a1d0005e901fec4a462ec1ba6bd419130600", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022171, "uuid": "bd3cbff0-af62-4fc2-b410-8ea48425d48b", "comment": "Malware payload (AgentTesla)", "value": "bf6281fdbcb17b4e64a5827465d4bb865306b9da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022171, "uuid": "d510d06b-d537-43bc-8c86-8d0ad10e5c04", "comment": "Malware payload (AgentTesla)", "value": "ac6ddcab9810510290c847bc7682a8595d58c4374748e677789c51a7191609006fd89988c61c95f12f7e4206ed2b18a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022171, "uuid": "a6ceaf2b-154c-4f63-810c-29ae07198cff", "value": "T1887533D5DB881DC8E31D90303730452E2BFBD2CC258886B44D46AEB899BF67B45A797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022171, "uuid": "23ba3be0-9c7a-442d-967c-c5f34529c338", "value": "49152:gm3razkI3iuAYRFIS6W4SLTnK+e7Wum6Dz3mj7U:jrazkI3i0FIjksCuL3m3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022171, "uuid": "f4bc15e9-3c5b-45d4-a114-464007d8fee6", "value": 1622224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022171, "uuid": "e33cca0a-d593-4498-b3e6-a6a93410963e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022171, "uuid": "f060f245-45ea-42e6-b548-2ccea8e4d857", "value": "6eef6eaca090292e580440cca598a1d0005e901fec4a462ec1ba6bd419130600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ecfb3d-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046574, "uuid": "4b5a5552-1321-4065-b011-0650cc21bb31", "comment": "Malware payload (ConnectWise)", "value": "e29f64a18e8b2a5f4e8ef07d5ff70d84", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046574, "uuid": "b25b8e03-e65f-4496-836b-2923216deae0", "comment": "Malware payload (ConnectWise)", "value": "6f2139d68bc0222b441fadeb6f484650ee7192aceea86c5399749b279898abd0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046574, "uuid": "c62b5159-b39a-438f-97c2-726344753f6d", "comment": "Malware payload (ConnectWise)", "value": "6a77c9d084298edb321ac95c28a94eb2eb8a0c9f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046574, "uuid": "35aecd9d-7577-4c19-bac8-f76be5d5bcc6", "comment": "Malware payload (ConnectWise)", "value": "f38b74800e24a2789bca2c81a6bd65f8238348ce1b83523638e69c1438ff4c92161dd8a468de792c1adac883239875ef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046574, "uuid": "5615bff2-e5ce-4553-8fbb-35928710e07b", "value": "T180646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046574, "uuid": "10b90cd8-f91c-4cd1-8b7f-26aad9e2d670", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046574, "uuid": "bb519155-d7cb-4de3-934b-ea27f82229bd", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9+:51iw7gryNkSV1hy1Z1u2JLu9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046574, "uuid": "6ed7951f-eebd-4e4c-9842-b8fff2af42e5", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046574, "uuid": "37feb6d5-5e17-4581-ae8b-84ed55e6c9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046574, "uuid": "06bb44b7-1c82-49a1-8301-544b27b3146a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52346c08-7f34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783999811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999811, "uuid": "28f52e7b-f862-478e-9aa3-6b78736166b0", "comment": "Malware payload (Mirai)", "value": "88baea9de0c8539fce1d3e117ed5665b", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999811, "uuid": "e4151e9e-e827-44db-b5f2-4bfb6bb6e632", "comment": "Malware payload (Mirai)", "value": "708bebf7661a2646921dea4f826e4d6a2a5a35087c72c0e00bd2cd0c9b894316", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999811, "uuid": "526d7870-3bcd-49a9-b574-cc3885101ff4", "comment": "Malware payload (Mirai)", "value": "99dd7ed1925461448de4a94f6569966803334a52", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783999811, "uuid": "0316c31e-6c88-4db0-8639-4dec679c4367", "comment": "Malware payload (Mirai)", "value": "cf7253317ca9287efd0efa182075eeca2d9717d17c83bce1166bbcd17841eb4251c43ebff7198b229c6f0e588f699663", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999811, "uuid": "3eb28bb7-54d5-4986-9a24-8bc5867b6e03", "value": "T13C118CC404644AEEEE838E40F77741C8CA4D41E7FD83BA5AD559049AE55CA28F2DE6C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999811, "uuid": "c85438c6-ba94-4275-ac51-a574989c1697", "value": "12:MC20Wg0W2zWDNWOWKW4oWQW7WDfKTWeNIymWAAa:H2/g/BDkRd4Tb6zKyeNIUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783999811, "uuid": "75f98cde-471e-4dd5-8095-cbb6bdf6d704", "value": 1021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783999811, "uuid": "7134ddb3-e3d3-4434-8586-963a7b05790b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783999811, "uuid": "378f40f0-23fb-4670-abde-69426176d6c3", "value": "708bebf7661a2646921dea4f826e4d6a2a5a35087c72c0e00bd2cd0c9b894316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dddad7-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011944, "uuid": "f2ea4a84-f00c-489c-b1e9-8a2c36be5735", "comment": "Malware payload (Mirai)", "value": "69e3cea4845de70de3a905fcf453656a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011944, "uuid": "afae4b57-f9dc-4122-9171-c78aadf2530d", "comment": "Malware payload (Mirai)", "value": "72151890675dabda31e5ccadd47c523e1eda32bf56d3c0cd9b3a76570d3fa19f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011944, "uuid": "3f2eb1b5-e039-4fb4-980d-9680cc412eca", "comment": "Malware payload (Mirai)", "value": "733633a012f697e4eb622b86e7c2393020c60ea0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011944, "uuid": "b33aa225-c70f-4a20-b3da-7606223d7442", "comment": "Malware payload (Mirai)", "value": "11cb09b20f9cec2fc73c97df7372b6511fa9916636e3a6bcfdc3613bee474305273ce8c8c41620b5cc6772c1a1a13c6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011944, "uuid": "bcc8ead5-110e-4c2f-ab30-99616959b901", "value": "T17621C100F21D1453E6E13EB473372B9147AA8F03172945089EAFE6D9E8B8C345A8E49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011944, "uuid": "2b9da8cb-ef50-4e11-8359-5a4c519e67f2", "value": "24:3LpWS9nSWZ6S4/KSwISBd6oTKP5tAFlLZe2zkt9Kovy56YaaTo0YW8O6pr1:wgZVbXGAh3z29Kovy5plBPa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011944, "uuid": "63473dab-cfd0-4b92-8a3d-24f3bad1eafb", "value": 1416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011944, "uuid": "6e74e260-0502-4355-adc3-fe25ad9b0f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011944, "uuid": "76bbc2d3-d844-4f2b-a5cf-b2733afa4313", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0164a699-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784012131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012131, "uuid": "d1e1c490-4afc-432c-be1c-d4ed36494332", "comment": "Malware payload (RemcosRAT)", "value": "397f316c86b746558651a8bbf73fcf75", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012131, "uuid": "9131c849-144b-4e34-bc57-5fd2deba71f0", "comment": "Malware payload (RemcosRAT)", "value": "732aabf0f9dd726846429601b021d01163a0f6a8bce9a5e05c9605f8af9778f2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012131, "uuid": "d86aaa96-3be4-4b2b-aea6-8aab5de8005f", "comment": "Malware payload (RemcosRAT)", "value": "0b1b1bf82603acac05a5ace6493e0de66ad1a0be", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012131, "uuid": "9b17b67c-24a7-4a50-a03b-d48b8901f4dd", "comment": "Malware payload (RemcosRAT)", "value": "44d318de0fcce8bae24c309ee0dd2ed2eb55b9d2b1bbd916b79699b9c38698a0bfe0eee545cc25db7886b28e2513d735", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012131, "uuid": "96765852-e3d0-4eea-8c3c-d4b2b724f94f", "value": "T12CB523B8A15B26EF0D11F3F5F422F94571CD67D609C2862703BDC6B076F90A48E639A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012131, "uuid": "323bbf08-09e5-4189-99cc-8aa81d50e31e", "value": "49152:5vRB2l96NZp9On/roIIUh9C8HmpzZ1fQhTBg:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012131, "uuid": "dd9d585e-e61d-4837-8e1f-fb5713a566d6", "value": 2374303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012131, "uuid": "d6adcd23-ab88-4c59-8524-cb7311403e55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012131, "uuid": "afafcf77-33f4-4c34-9615-c92c127d9c4d", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40562b6e-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "67065a03-28b6-4992-a90f-19f6226699ba", "comment": "Malware payload (ConnectWise)", "value": "0b7c8886fecd8f44cd53fd423caa3d68", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "d8af9562-7206-418c-949e-38b4960128fa", "comment": "Malware payload (ConnectWise)", "value": "732dfed9c6d0fbdfd29addfb4d3981dd4f50bbb1417bd397ad42787a21b7558a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "bce3c4dc-5af6-4ea2-ada7-40af3a74e975", "comment": "Malware payload (ConnectWise)", "value": "fc414f6d56efac6c248b597ef62dc956ff8bedd8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "dc610a0b-0afd-4562-b368-80d5322f3d76", "comment": "Malware payload (ConnectWise)", "value": "a5a836fef47fa2e6f4a6f1a7db5ba190dedef99edee6bba80c14b9e5fda24b9c0462f49f7505d922baf08797a1ed1bc9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "d0b5af84-47fa-42a5-b1af-a57de23518a1", "value": "T138646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "3323d85b-daef-49cc-8455-433bc0977991", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "df464a23-71b1-4ee4-9eec-ebf0af269cec", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9c:41iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046597, "uuid": "7c9d82bd-3678-41ae-8a21-fa4c8f0161d6", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046597, "uuid": "089c018c-9462-40d7-8143-61cb452095ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "8376eea6-5a8a-4456-9ab3-081f0a7eba3d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2327f9-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "7cf95c11-6c67-43d4-92e9-d561317f0bf5", "comment": "Malware payload (Mirai)", "value": "840bf28af3782c40248a0e387839d870", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "64735e7e-91f2-4c0e-9a0e-62be124538c3", "comment": "Malware payload (Mirai)", "value": "738863f54af6daadefa25be0af34812df59c46f6d53f4787efa90e948c32fc4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "14eb820b-4151-4055-95d8-96b6a8c9b6f6", "comment": "Malware payload (Mirai)", "value": "cd1ae8c9c349e839f9c4e07beb59cbe1d46ab838", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012179, "uuid": "57e7b223-a406-4b3d-899f-22aa1870440f", "comment": "Malware payload (Mirai)", "value": "775e5ea42da5d41e1f771b16689af5151ce6e957a972dd6c0754d1996555075dd1d4cc78936ed708999a5525618d6998", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "79613bda-a320-461a-a953-02b46ab1dc8a", "value": "T17803E0E943021D98C46AC5B587763B202F722EC2E1C7ED661A71DB1739C12A47E83FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "f9f4abae-e9fe-48bb-853e-ade3f99eb077", "value": "768:8nqjKWDfISnDoHAe6Ee/BMrG+ih0iKDTfj83XjyY8U1gekOtJgGlzDpbuR1JZ7:o5EAEDiAe6Ee5D+JLDfoG+gekOHVJuv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012179, "uuid": "fdad2b74-2e9f-42b9-91b2-bc866fd5e9fe", "value": 38864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012179, "uuid": "e1645cd8-ab96-4f1d-bce1-a88bd01744f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012179, "uuid": "6c053152-6352-4381-bb4b-d90ce6ed2ac2", "value": "zombie.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b06a909-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023959, "uuid": "b8a18245-eb8d-4c08-9f32-d09411ef7338", "comment": "Malware payload (AgentTesla)", "value": "d33549bca72a7c04bd6c670cd0cec0f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023959, "uuid": "1a7a44ec-bfd7-403a-a1cd-49b996ae267b", "comment": "Malware payload (AgentTesla)", "value": "7388727a3ff77ec25b2b858b7b357032dc543061b6cf8367ca4aa6e77bc3c8d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023959, "uuid": "542acae9-451f-4c0a-ab65-340351fd5d67", "comment": "Malware payload (AgentTesla)", "value": "c43d22c3b4f9df0a84c81dd26c5fa8e393aed233", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023959, "uuid": "e8144093-8965-48c9-85ae-1611560ed1e7", "comment": "Malware payload (AgentTesla)", "value": "3c68d4876acef9faee6851c10767dc9267d0cccfe1a735fea44a4d3d10600a7f54441bc5ca40dc001ffd81f27ad3984c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023959, "uuid": "6f989f19-2b1b-41f4-9826-c54099bf6ab1", "value": "T154D49EFBF7FBDF1FEB440C5F740091B10ED9A058765199E4AD260C25A0EA3E68A24F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023959, "uuid": "195fbead-a23e-475b-b55b-c8bcd287cb6b", "value": "12288:OAX/TVqeETA8/3zgNb4W8YhnNs1LNz4NeiuUnyH2ewfGrtD3qS7Yswy9ooic/:OAPTVqeETAg3Uty4nNs1LNz4Neiu4yHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023959, "uuid": "65548d81-c480-4687-945a-ab67ec4e5ed9", "value": 648080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023959, "uuid": "bf293231-ad87-4068-acde-8a511a29fd11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023959, "uuid": "6d41f66c-3523-42f8-b612-5ff43324abac", "value": "Vadesi Ge\u00e7mi\u015f Faturalar....js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab02783c-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784024012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024012, "uuid": "a50d97b8-15e5-4426-af07-bda25515441f", "comment": "Malware payload (PhantomStealer)", "value": "e90f5451ee637457ba2d589303de4881", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024012, "uuid": "59f34ab2-086f-43b4-9ca1-e5a44f98ac75", "comment": "Malware payload (PhantomStealer)", "value": "73b497529654631f692fc80b0237367bf610467f6c790fb78bdf63d1e58c51c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024012, "uuid": "a524281e-4455-4653-b897-50621d1dd2b2", "comment": "Malware payload (PhantomStealer)", "value": "30fa6b31c11da95edd0d79bcb38ae23a96e7653a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024012, "uuid": "cdc84336-5c58-413d-90c0-2e497494c5e5", "comment": "Malware payload (PhantomStealer)", "value": "bb4aa033cd08c392f77265a32441254242ec989b18d767b65a9a9a544141679f4dcebad032857fc2474e6d90e104d591", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024012, "uuid": "7dfe2e4a-f853-4614-839d-6989763e1e49", "value": "T12526F2144F886F6F86AC1A18D0BF165EB3E107894467BCCAEF737D4A5FAA70051271E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024012, "uuid": "750c33fd-05d7-4f4b-8130-8a0ea45ba41e", "value": "49152:DUNN62iaBDUl1gUXUdY2h06JUjNH5gOcowh7EalTpo3ih3QhMP9tn68P:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024012, "uuid": "95a7f746-7577-4115-8c81-4d2d303a3565", "value": 4538573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024012, "uuid": "fee6739d-5a77-4784-9ed4-2421ae078a17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024012, "uuid": "8780fbe4-2e53-4baf-8139-8e161ca73988", "value": "PHGF976456789000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb89fba-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "18d02690-bd0b-4166-9dfe-cba3a6b9d8f9", "comment": "Malware payload", "value": "bbc7a889785533aa201f3e17078132ba", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "d01f6790-e643-4449-946a-3ee23c730d93", "comment": "Malware payload", "value": "73dc4fd52eb951dd05fd46a476852d6f0195e13d29f8497587700e53596aa1be", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "bdd3e713-fe6a-4889-abed-c3116750a286", "comment": "Malware payload", "value": "f549f85e6f9e0671a2141aac522f45e9b1091a13", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "53d3627d-9c71-47f4-9cf2-9fac6320f756", "comment": "Malware payload", "value": "1a463ee6c03e470a3746e1fe01881b2804d88c38cc3526b923ec192fc800971a82db7dd7b7e66b6a63225cba872a03ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "7aa20dc3-dd85-4a54-a114-738596a00fc7", "value": "T15BC22A927F860053298F29A6997C0F278494CB918535BCB8FCBD7B0FDC45A8CB5E891D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "2fc2c8b7-836b-40bd-8e7f-483831be80e0", "value": "768:G0yl3WT2zxLLO+jAYYfl/O2+LnorO/xjFWFfYOzwFp1:0mi9mSDYfl22+LorO/xjFEfYOEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023908, "uuid": "2a5bb385-2d34-4c46-8fbd-08efa261bf9e", "value": 26020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023908, "uuid": "e1eff81c-3ed0-4362-8627-c8cb6f05e9e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "88852f89-2091-456b-82b7-9306ac3be7d5", "value": "EGPL-476-2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c50b03e-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023504, "uuid": "b1434ed1-78bc-4cd0-8778-042f80ec8e3e", "comment": "Malware payload", "value": "b153009b1d6c0a6b5a951c2ec0534248", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023504, "uuid": "43db2f83-f950-4359-99e7-57da72a1f11d", "comment": "Malware payload", "value": "752894233bc3d36b1638d8bcc66eb31f1ca240bf7b2e7390b63f360b3ccdf4d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023504, "uuid": "bdd3911c-0ba7-4b44-a659-485967325663", "comment": "Malware payload", "value": "5f07676a1ba5eb798ee0d0048bffcbbe2920ac80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023504, "uuid": "861a725f-7e3b-4b29-8041-ff056bfe803f", "comment": "Malware payload", "value": "177fb0353d4bffeb498090630eb2b79da2da2b118847ba354b272839bd995b38ece06e82a02ca117c8b603fcc5c802e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023504, "uuid": "032d1fe4-f14f-4d52-bd57-7938a1ec8639", "value": "T199E026A2B2C055B12C4ACD321A4B64F7825B89520EE35FE0B0C91934620CBFAF44985A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023504, "uuid": "bfed16aa-4ff9-470f-932b-07ba0404edf4", "value": "6:h4wCW6VwNrX0rZG1fa0NLGwWmDe9+einysDfC0RX6un4Gonwgf+mVmq:s6lLyABDa0Aunhgf+m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023504, "uuid": "73d14e0a-185c-4c82-84a1-f3f6ea11b683", "value": 357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023504, "uuid": "4e6a3bad-ff7a-4898-9d35-75894167f658", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023504, "uuid": "4a80d6f1-8b7b-4b42-838e-87fe938f31ca", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dd3727-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784003014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784003014, "uuid": "6f6b8510-35ff-45ef-8db8-4f91e55d8667", "comment": "Malware payload (RemcosRAT)", "value": "4553b0bc22871012fceedd02241449d2", "object_relation": "md5", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784003014, "uuid": "6a1b9791-4a8f-4378-9cb2-2b94e4126149", "comment": "Malware payload (RemcosRAT)", "value": "7550b52651ebd31c33a77f798b07c7365827ca759adfe8092de83683b27ef198", "object_relation": "sha256", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784003014, "uuid": "814bf942-8d7f-4f08-bbaf-82ce8463bbd4", "comment": "Malware payload (RemcosRAT)", "value": "786bf7010d1c06cfb20b2b8ec9dc4b091b6cc761", "object_relation": "sha1", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784003014, "uuid": "eaea9fc0-7a83-44d2-b3f5-18cd6a6e4e0f", "comment": "Malware payload (RemcosRAT)", "value": "1253844631b02f45d313fe38c905758d1c1acef2d0e24b11cfe61330ce076fc468fd578ac03af373ebd54fa22f50c3ad", "object_relation": "sha3-384", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784003014, "uuid": "50fdf2a3-a295-4b64-a62a-63f2386b99a8", "value": "T12E75C01DE3CC12E9D227C134CBA66232E3B5B4560761BADF1699D2152FB39D02F7A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784003014, "uuid": "ace6204a-511e-4200-8998-0b312527d9fb", "value": "f765367f0a88e2dcf14edcaad7ab658b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784003014, "uuid": "86fc1f1b-864a-4b48-9403-47e63f5d288a", "value": "24576:FS9jVBUaZP732a4Cd9rfG8GcbGz2wdgVlNVZnApYfnOVUFJ8rMG6VOtUC4UPSOKD:FS9ZGKd9rfG8GcW2wdgVnAp6nZSrWu5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784003014, "uuid": "0c5964fd-230f-458a-820c-5f0614a34c79", "value": 1562624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784003014, "uuid": "11933168-7d6f-41da-b0f1-4db47d667099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784003014, "uuid": "d32b344d-9bde-4e9a-b4f5-7077fad570ae", "value": "Bonifico n.1101252230290313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dffb5c-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "7d87e973-6169-4494-8667-a20123e3ef74", "comment": "Malware payload (Mirai)", "value": "5e398d058bd961c3c421e93e13f6fb12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "6ed72282-f23c-43b4-9cbd-3e7d5d01683e", "comment": "Malware payload (Mirai)", "value": "761718584664218d3f7b6428a9588de61f3f9658c40ff1ca70fcaa0cd6afb8e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "c34249de-fcbc-45b8-94d1-ab0f4e8c13a9", "comment": "Malware payload (Mirai)", "value": "df9e725f56fa3fc7adfc19ce8827b50d25042f25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011360, "uuid": "acb69e3a-988a-499f-9b84-511b8dc614bf", "comment": "Malware payload (Mirai)", "value": "bb4cf34711756eae76a2042bd15e714f230c61490b78e163354ce2f56599c748274e74bdf9fa4df189e8dd6f333107e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "ff8c5fc4-2e32-4e3a-aef3-b9d4207a4b37", "value": "T1DEA32916B15369BEC1CBC03047AFE422AB7170E493336B2BAE5053353D62F685F2AD59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "a70f36ed-7363-4bf9-a786-2d31042c47e2", "value": "1536:Q3B+1AAN8buvcPdV6xcRsALVLvOaPW/gkIs20kjVrnPgNUIO5Z:Q386buERRsALVLvPHY20sVjgGICZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011360, "uuid": "797b3960-5c5e-4c07-b49c-d664988224ae", "value": 104968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011360, "uuid": "68974329-c38e-444d-abeb-e9c2b8d94fd4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011360, "uuid": "f76a3a14-e46c-409d-8ede-b1eed02cd80c", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e6cfd0-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784024036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024036, "uuid": "6e784339-21b4-42ff-a527-ccf7f41f4c22", "comment": "Malware payload (RemcosRAT)", "value": "45dfa35e302c2de9c5cbbc2301ebfbea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024036, "uuid": "bb8e8996-3e4b-4ce8-9862-a50e5f5b80a8", "comment": "Malware payload (RemcosRAT)", "value": "76aae8a3bf9207f51b4b0cadb7133e0fddd50306cf7030614c383040e9513721", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024036, "uuid": "0c2411ad-24c3-44e7-b8a9-3083ee44ec4b", "comment": "Malware payload (RemcosRAT)", "value": "a19c52137b00767f8c43b5c470fd11844512ac54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024036, "uuid": "6c019f20-7f25-4930-9913-c10767fa712b", "comment": "Malware payload (RemcosRAT)", "value": "2400b9932eb6a3cc6aaf3def993e7c052fc49436b416a39bc0c06d4682849253e51909d626a77ba332867da3a5a2575a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024036, "uuid": "076c3002-dde3-4e2c-b584-f7329f259fe2", "value": "T15A243970DA2001B74F87AB98FCB94661C66DD315853705B0FAC98B0D900E9ECF7BD66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024036, "uuid": "895d504b-d098-4428-acf3-e5a005ea366c", "value": "6144:iEzw6DVJ0/sEpgVpUn4u/HzrXP5ZSDiq9h4ghJroompK3WwIo:iwBZU4u//5k9hdLkor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024036, "uuid": "9a637d9a-f642-4ee4-a2f8-e924837d60d5", "value": 226133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024036, "uuid": "4582da19-f47e-4451-b191-4725b03f991e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024036, "uuid": "d60bb2ca-0e97-4b2a-a075-f3111f8e2a8e", "value": "PO-00222.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e7277a-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021933, "uuid": "56353eb4-8b2a-4c36-a88f-a6f50b558e51", "comment": "Malware payload (AgentTesla)", "value": "e8ee7636e1c33345eaf7364544971856", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021933, "uuid": "a11229ff-e8db-4923-b229-dd589cc09708", "comment": "Malware payload (AgentTesla)", "value": "781a08faa0e5eaab23307b1e2dbd0ce702e17a0c3479678e1e6f50048c50add5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021933, "uuid": "376f4cba-0f28-45ab-af0f-239cbfceff55", "comment": "Malware payload (AgentTesla)", "value": "681bca9ca2533855f0672f9ba9ad0fad3e4ff05d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021933, "uuid": "deaebc54-7c4c-49a0-9e37-10b82fa3e2ce", "comment": "Malware payload (AgentTesla)", "value": "d32d8158f5e0391c09f67395092e04c47ac6bcc41d0d8f350c6f73c374acc724d188d736cf8654a1867766777ba557a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021933, "uuid": "e8dfcc33-8fb4-4169-8768-02f909be636e", "value": "T1515533C4E2C2795D75E8C2070AA40A899E4A73B253D4CB65BED038DE1DF273938766F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021933, "uuid": "f6b1e6ef-f0f5-43d6-8a53-b04ccdaf20ef", "value": "24576:a731G2MSDuACWoECfzU8l+d0AtqpwezDklIEGXrQBTQYbY7yrp/1ZGv:a7leSDutWoE47l+RtKwODUItXPkrp/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021933, "uuid": "47f05375-d28a-4ccc-966a-399b3b3034a9", "value": 1357978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021933, "uuid": "5f732fc1-3a0a-410b-9870-7c204fdc873e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021933, "uuid": "e1f5459c-c9fb-4624-9136-81fdc3d1ff0d", "value": "july and augst NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a436fc3-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784023823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023823, "uuid": "833bdaa6-e584-4ba8-8dd3-bfa6afbe1eff", "comment": "Malware payload", "value": "a80ab294f96c30b15929be8c25335c5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023823, "uuid": "dc1df2c9-1d83-421e-825b-c5c1abe79427", "comment": "Malware payload", "value": "7820b5d94f72bdf0f6d13eaf7f7772e483b3cc8b5cf15e321a72d949ba3a4baf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023823, "uuid": "64c8a6a7-8982-4033-8454-1e76a1f6870e", "comment": "Malware payload", "value": "88b02462e149b8ac3e4e336e94fcaaab1d8c82d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023823, "uuid": "24c74c08-4d98-4f07-beb4-597dbbc117d3", "comment": "Malware payload", "value": "6c30a497d24e5744212499f6cf0d8a8f2175178506746c60e88a3a47a7e6b51097ad031404e78460bb0b050d4bf7c631", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023823, "uuid": "9c39fc37-50be-4435-8638-08a7bd5565f7", "value": "T1B152EB7C991AF38449409F4F78BFA4A547ECC00CC5E2FDF7F29752AA397A104A163625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023823, "uuid": "97ecdacf-df33-47ef-9232-d3066e5a4d4c", "value": "384:vB8xDW/jz3/mgA/3f0wVz/T5PUUKYnyY1na:vB8lW/jz3/mgA/3f0wVzVUUKQyYpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023823, "uuid": "b6ffb21e-9031-4051-9af3-67be64652c03", "value": 14029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023823, "uuid": "3437d7ca-c96e-4279-ae69-7221051de002", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023823, "uuid": "65e656b3-2e25-45f7-aaf0-f0a670c7a0b7", "value": "KMUTT 8578\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33648070-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046575, "uuid": "2db6e7f3-6abe-46a3-9949-d1682df773b6", "comment": "Malware payload (ConnectWise)", "value": "8fc15ab0c75c547f66c9cd8ad85c136b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046575, "uuid": "69cf0bf3-5e60-4301-a6d0-f41bea3c7e87", "comment": "Malware payload (ConnectWise)", "value": "783d41b84f4de36b14e48e2c3f18f5ede44e97348e03cfc9396f77f42fdf0689", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046575, "uuid": "75acad49-2290-4817-90d1-aa492cb24323", "comment": "Malware payload (ConnectWise)", "value": "fb9664a2dc8d3b88f5e17312677dcfcd29bd23ad", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046575, "uuid": "6d980b00-9957-4791-a552-08544421b0d9", "comment": "Malware payload (ConnectWise)", "value": "1204e25e19aeaab80f66e0e17b47463952cb2969d4028e89717ada30f2720260f79a61d4ba53f4fb76f2dead558861eb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046575, "uuid": "0ceed010-2995-4bd2-980e-1db9add7a184", "value": "T19646E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046575, "uuid": "d438ed2c-3025-4f6c-9782-8d3dd5556f03", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046575, "uuid": "e9de4e06-de69-46c7-948f-096c7559f184", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ahfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046575, "uuid": "b57fe039-ddf1-4887-8c6d-8cde02bea29f", "value": 5641512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046575, "uuid": "24222050-a3fe-4830-9341-315a6d843bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046575, "uuid": "6919899c-9420-4889-ab35-90a734772e22", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a7cbf-7f90-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784039483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039483, "uuid": "6b9011d8-961b-43a8-871b-ef1328dcfc8e", "comment": "Malware payload", "value": "c25c63322362c85911da207dbd609fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039483, "uuid": "f4ea6cae-b05a-4bc4-85b2-3c0faee20d40", "comment": "Malware payload", "value": "7887d7daa90165ba41ad8275e46c6457b6e16a1bb8118ae804204002e22ab78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039483, "uuid": "f7b34cb7-c37d-4efa-840d-1cc9bfe5abc1", "comment": "Malware payload", "value": "30fa3deedb0eda1961e9dd589687363391414dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039483, "uuid": "c16e8b70-c9c2-40db-b8a5-5db5ef1b1d7e", "comment": "Malware payload", "value": "b71e52e67f7331cd166ff8c463b0aa53634bafcc1b62ffd105b57382f8b3a6f7576c2035c2b37d0e3f231c11b74353c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039483, "uuid": "030d6978-eb78-43b7-8f1d-73e557701f3d", "value": "T1B00833175036EE2ED9337C316B002EA7CF4747FEA471A60DB3859088B6995C1297C2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039483, "uuid": "fa1f713c-fded-4b0c-9321-ee0948b4c8fb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039483, "uuid": "87849a70-e1d4-437d-8521-0af5c534226a", "value": "1572864:qt9IKPTy9ALRWYYTM9sbVlMUc0bajJ5GcsGaP0SnQy7:qUK7y9ALRWlw9srM1UEDGc/aPsy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039483, "uuid": "193c940a-1d6b-43ed-aed4-4ca365f4fdf9", "value": 77293667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039483, "uuid": "bbc46534-74ff-4608-9800-9a99263da4c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039483, "uuid": "931d4b32-9f85-40a4-ad21-1d65acba377b", "value": "Game_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11446c-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022244, "uuid": "52d92eba-3d2c-435c-916b-1064b595e060", "comment": "Malware payload (AgentTesla)", "value": "d18e57e802f8c3984588077736aa6a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022244, "uuid": "7a5fa3ff-983b-4767-a0fa-b975e1e36eee", "comment": "Malware payload (AgentTesla)", "value": "789843148af8202a575e81a00bb855e9c35f26fc8a1fb3b422bc75a257eac6bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022244, "uuid": "d32dda4c-b068-4bae-99d6-afb8a02ae54a", "comment": "Malware payload (AgentTesla)", "value": "b9bc21fbee2371a3db57c0d00defbb36162d0b21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022244, "uuid": "1c58ed77-a1d3-4db7-84fa-18a0a9eb7471", "comment": "Malware payload (AgentTesla)", "value": "213e939d6506b92bfa1ddfc9dcace7b5970ea23e7aff1521aabcc31701df3847ab21fec3d9af29f3465189ac6cb3eb38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022244, "uuid": "d83b42ee-7c68-492b-a0ca-b10c6cc97e02", "value": "T1A146F803A957910BA74E475E99B2F6C9E81A2D2BF4136447B02CDC68E3DBD5372AD033", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022244, "uuid": "86f24384-0788-45db-ac29-671d6e378cac", "value": "98304:Crfmol5lybTXdR15xxHob7UgPnC3Jw3KXQp97G8g:Cru+5s/1/xIM0UM9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022244, "uuid": "c7f07ade-b0d2-43c3-90f5-b33a10c220fe", "value": 5841289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022244, "uuid": "60981a99-a8f3-42e7-84b4-c0358e631be7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022244, "uuid": "34054936-93c6-4588-b6eb-403e1a8b6f56", "value": "invoice_2026 & packing list.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbd7fee-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784023426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023426, "uuid": "8a87a410-678e-4fa6-bed4-52fe0c5a924b", "comment": "Malware payload (RemcosRAT)", "value": "055b997d5589c2c01799c98752cdde44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023426, "uuid": "d2ac5db2-82e6-4120-a857-1adbc15bd7cc", "comment": "Malware payload (RemcosRAT)", "value": "78b21599a83dbfad39c17202d37dd2b6d552c9679755bc199a9826f3dd0e40db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023426, "uuid": "d90091bf-c24a-43c5-9b4e-cf87feca4f8c", "comment": "Malware payload (RemcosRAT)", "value": "40ebd40d5c84d2facd38a01ac800890315bf0bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023426, "uuid": "ba85ab86-0c30-4192-8800-3fe4d691c232", "comment": "Malware payload (RemcosRAT)", "value": "8f2733b8b52cee098b5da76cb44e3610f6c99b65fdf9c1482addb0b9473b876ccb16a5ea011945b73a1f3107dc51a982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023426, "uuid": "5ede62a1-27df-4d97-8765-19413bd8a26a", "value": "T133C41204EF86ACDDD87281B559BB95631830BDEC0538E76F57186BABAC31D80DE3A344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023426, "uuid": "a57cc9bd-7ee7-4ebd-8f12-b216e72065f4", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023426, "uuid": "159a66cc-3d57-440d-99e3-c7d7bc78d960", "value": "12288:8tgLdz19q4y/FiZ4LMDq5r8EbUhyVapm2ZCb4Wg1:8Op11y/FiZ4B5rsyl4WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023426, "uuid": "420eeae0-e490-46f7-ab38-4a0a42d14e35", "value": 564424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023426, "uuid": "2e6427cf-512a-45e1-b67b-8940fec36cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023426, "uuid": "d03d5f14-7892-40c0-866b-21f4304b82b5", "value": "055b997d5589c2c01799c98752cdde44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b79754-7fdd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784072639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072639, "uuid": "bd8d6f30-c39b-4655-843c-ca46135c6c07", "comment": "Malware payload", "value": "c5bee4bbdab0a5b20748f266772d4189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072639, "uuid": "c772f42b-fa39-4532-9c16-13a67d9224f0", "comment": "Malware payload", "value": "78f623acdbf8541288cfc969fe4c39ca194939bfb30e921dc2d6d9bc4012b4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072639, "uuid": "5cce20ca-0f5e-4040-85b0-28849fb08ef5", "comment": "Malware payload", "value": "5d31db1e638af76a103e288f08f39d67728d92db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072639, "uuid": "09e77004-ce1b-4fea-9f9f-2509fc1a1931", "comment": "Malware payload", "value": "6a7ac676976d062768ea3ddfb270d619219a5e853ca9e5a3f1baa2b1e3ad5a046e2ac8e7c53e44ed07b62eb4921c265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072639, "uuid": "e4b32e24-23d7-45b5-81b7-6a4835e2a5df", "value": "T14305AE2A32958F21C28A5372C1D7890097A6D647B6ABEB0B31C413D61D473FEDA4B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072639, "uuid": "071591ba-5be0-46a2-85ef-57509b499aeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072639, "uuid": "9dd35dd8-8aa4-4bfa-9d22-48aa503d8fab", "value": "12288:EVYGxhn+LlyotBhEUd2rGNWCjJgbjekdJxXthWwZribw:E6inaBJXJgff75iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784072639, "uuid": "cde03eda-764a-4931-9850-93862bf883c0", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784072639, "uuid": "f6a82c09-bed2-4afe-9eea-8c5a9fab9868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072639, "uuid": "46940fd4-14a7-4969-8e0d-f645fe0093e3", "value": "SecuriteInfo.com.Trojan.Mardom.IN.10.59186461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac3d11a-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1784023985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023985, "uuid": "1013762a-d80e-447a-9fbd-d8a2dd15d088", "comment": "Malware payload (AveMariaRAT)", "value": "2f9f8d28d4964dfa9a6da5526419b10a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023985, "uuid": "662f4a53-56db-42ae-87d6-3d60f665e608", "comment": "Malware payload (AveMariaRAT)", "value": "7948f29c8da354c9860efc87b920097a14b759af05fc7fb77a8d1a2074d2477a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023985, "uuid": "51011378-eed3-4230-bc22-f3b563cf33a8", "comment": "Malware payload (AveMariaRAT)", "value": "aad0204e98a36ae9928a272d3b65dddb520b35a8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023985, "uuid": "ee2f02a0-6042-480d-895d-31a263bf477d", "comment": "Malware payload (AveMariaRAT)", "value": "999ff915f26011c6ddc52ff66d4f58628d1ea4fa36796730a2e7558e18e0ed831e23353290aa1f74a6cff4cca51c2e84", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023985, "uuid": "61b4a7a1-ea50-45ca-a41e-3da5f7c0fd87", "value": "T199140F4526C9B45C33EB1BFF3A1FB1E5F86B08D964484546C119F8B8B262706F8E2DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023985, "uuid": "8cc2df5c-15fa-43ef-865d-446e041a0bd6", "value": "3072:flbuOiv82ypUcRmm8v1UaxugnTNYbe1UNMS9+zKaWnxj:fJ5E82ompbuATNYbe6NT9+zKaWnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023985, "uuid": "69c1487a-8776-4261-a6d8-644cbf8d99f5", "value": 202478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023985, "uuid": "4bce92cf-7bc8-4816-91f3-326df7a1e083", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023985, "uuid": "9a3115f2-6790-424a-90f8-9d09cffe04d0", "value": "CHINA\u63d0\u5355-SHHJ26070247.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537c3d17-7f57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784014846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014846, "uuid": "aebdfe46-957c-4c12-85a3-5124674926ff", "comment": "Malware payload", "value": "2e35ba877e1fa773499ae5ddcfff9c7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "etchash", "colour": "#0CC19A", "exportable": true, "hide_tag": false }, { "name": "gpu-hunter", "colour": "#3029E9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014846, "uuid": "9c7a25dc-2b81-4a7b-b9cb-04194231b4d0", "comment": "Malware payload", "value": "79557b00b437c5e596f0e068575ebc71319a7def2dea6411735c64d9290883eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "etchash", "colour": "#0CC19A", "exportable": true, "hide_tag": false }, { "name": "gpu-hunter", "colour": "#3029E9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014846, "uuid": "45a3bfec-e360-46a8-b1e2-122c483b73e7", "comment": "Malware payload", "value": "15eb85d5684280d794cf88f82c938975c82d909c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "etchash", "colour": "#0CC19A", "exportable": true, "hide_tag": false }, { "name": "gpu-hunter", "colour": "#3029E9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014846, "uuid": "94b4f52f-bae0-4433-86b0-9b06d3ed5b96", "comment": "Malware payload", "value": "ffbfdedebce2057f9b3bb4d89e189470bea23fc9a6714ac0d671622a71d768011403ced801fec522d5ef3f2516b11536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "etchash", "colour": "#0CC19A", "exportable": true, "hide_tag": false }, { "name": "gpu-hunter", "colour": "#3029E9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014846, "uuid": "9c0da19b-737b-41a2-8469-ae6ff5177f19", "value": "T1CF156C13F5E224BDC6EAC574435E9612AB31B85583107EFB22D0FA202F29EA15F3D761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014846, "uuid": "b1f105c9-4112-40dd-b7cb-ff33f074d0ef", "value": "24576:SL2mZaf0Y54OF3PlklBj+J6uV9pHNrmj+:cvcfH5r36lBj+UuV9pHNrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014846, "uuid": "0f7575eb-09fc-4773-944f-83ea32c8d9b0", "value": 958264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014846, "uuid": "3ccb95bd-d35a-449c-a7c5-9bb836e03892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014846, "uuid": "33a0880f-bf10-4fb5-a986-4f62e7c13df3", "value": ".X0-lock_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e51138-7f49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1784008887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008887, "uuid": "45143bae-b23a-4288-a81b-d5c953040aee", "comment": "Malware payload (RedLineStealer)", "value": "6b1a870bc9aa0a5d88931278f4375f50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008887, "uuid": "903c71f7-47a0-49a1-9282-4848083af22e", "comment": "Malware payload (RedLineStealer)", "value": "7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008887, "uuid": "de302e22-2855-41a8-81a8-336bf325f767", "comment": "Malware payload (RedLineStealer)", "value": "9139a0817ef5a3c0f4e97e562c22b2bb878d981a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008887, "uuid": "2c3478e8-5d8c-44c0-879f-42e601a263f3", "comment": "Malware payload (RedLineStealer)", "value": "49d1014f4622a7dfc68809310e0ef2f1d45f4d34ef15d2f38f9d829123928e0871aa95949e006db65d7591f4dc07eb60", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008887, "uuid": "ef58b263-e813-49b2-85db-8ec3f3a5e061", "value": "T109771256E2FD00E8E5BAC0B8C6575517E7B2345517309BEB52A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008887, "uuid": "16c9cad8-56e7-4580-a305-fdefcea86ed0", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008887, "uuid": "6f57a76f-74e9-47f5-a715-f1e98be97cd1", "value": "786432:Z2Xrb9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmv:EXl+RBwXzTUX0w8mxmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784008887, "uuid": "7fd497bd-1854-4c9a-8045-5a364428d52e", "value": 35517831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784008887, "uuid": "f6083307-affc-49bf-ba23-5b47bbd25172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008887, "uuid": "9655189b-f32a-4c62-a6b7-c5ebf61a8e61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502ec9d4-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784002815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002815, "uuid": "05914892-5717-4bdd-9ee5-5e469792c601", "comment": "Malware payload", "value": "d5787eb5ce307c560f336717d17fd905", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002815, "uuid": "ad3f3ce3-5e2b-454c-b1e3-d6a094771c16", "comment": "Malware payload", "value": "7b98bdc168a9c682be8d432bdd383da72b241909fb955332dbdb09f45c8e4a51", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002815, "uuid": "d86e7e2c-4933-4008-82d8-e83986748489", "comment": "Malware payload", "value": "4fa8505d59d657995d1a6751a37cb9cb5d9e5e73", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002815, "uuid": "bbb859e3-f332-467b-9320-649428a5dec1", "comment": "Malware payload", "value": "ed34219bd4843f745a6dac77e246fc9a1fff49f7f3aa306937cd1b77d30d78ca4ff6b919370e70e780c08b9d21b26b59", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002815, "uuid": "831a2b3f-fc4b-457f-9c3b-0c34813f5794", "value": "T16CC6BF19A3E50465E42BC734CA56C333DAB4BDA24635C10F095DF2C22F77A628B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002815, "uuid": "b5c1e8aa-71c0-478f-a8cc-a253ae19a3df", "value": "c46bdb18e323b17caf949ae831e40ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002815, "uuid": "59917759-42b3-40d7-bd16-36cc14bcf084", "value": "196608:3GR92+U+j4hvgCiJNaG8mkWMHsLGIclz:WR9ZFMlgj3aGp/MHsqIAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002815, "uuid": "7685b45e-bdbc-41b2-ae35-69f5c81ec8e0", "value": 12233216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002815, "uuid": "3de3bc0c-d9b9-4529-8079-e718e4c67e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002815, "uuid": "b599deb4-fd65-4247-a9fd-dde685e7a35a", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b434f7b4-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784024028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024028, "uuid": "5a1ea4e2-1d19-407b-b827-fc36f10d2a97", "comment": "Malware payload (VIPKeylogger)", "value": "f0d83f3d5433b81ef41faf3bb4fd5d96", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024028, "uuid": "8cbfda55-c867-4b01-a62e-879e18123f0d", "comment": "Malware payload (VIPKeylogger)", "value": "7bd24072f87f29668bb079199e62b5e66246adccf215b5d29fd42505bc166216", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024028, "uuid": "c739e884-ed00-4496-898a-8be7da0881c4", "comment": "Malware payload (VIPKeylogger)", "value": "a5749e7b65546d84a91010f10ade4a1e55fef150", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024028, "uuid": "835c4e25-ff5a-467d-96b1-5b29cb670cd6", "comment": "Malware payload (VIPKeylogger)", "value": "47b8f3e2765347140e2aaa08c74cd3815c8abee05a9d385da14b6c758163a56cd22f3b519ee6cb7c3aa90d0a765391f6", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024028, "uuid": "c7d28395-cdee-4c80-89aa-b0c05d722920", "value": "T1A9750A67877C597340F35BBD2F283E68E8528B336D569A6238B5F290E7708C504A1E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024028, "uuid": "c487bed2-497d-4ebb-8639-e41529184e2d", "value": "96:+Tt67Jo1ZHc6R5sN+uVInsHli2crf3EUCp7pcE1qiyZOG9RORBpmzTqkP7MJX:88Jo1h8ZZvcrf3EUCXcE1qiyZOGIiT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024028, "uuid": "e69c52d1-6c18-46fd-b95d-23619d4acc34", "value": 1673853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024028, "uuid": "a3ecc8dd-6bd6-4ed8-94eb-956051ee0926", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024028, "uuid": "dbbe0750-4b89-417f-8e4d-9b6666daccd1", "value": "TEKL\u0130F TALEP FORMU PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb1810-7fa4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784047928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047928, "uuid": "ba56f61b-1ee8-4678-a2a9-74c4d7c56654", "comment": "Malware payload (Efimer)", "value": "e0302228512abfe6bbc426e762c90e25", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047928, "uuid": "a30d8379-bade-4f38-b04e-770a3533bdbe", "comment": "Malware payload (Efimer)", "value": "7d2b009f6ec2a02836b984cadf294569a5d7095d9ee496118d408da37f0a269c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047928, "uuid": "cce115d0-1fd1-4a93-bb04-a6940aea701e", "comment": "Malware payload (Efimer)", "value": "6472914eeda58894b0033eeeaeca797a23fa1c4a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047928, "uuid": "61ccabc9-afc0-4121-b3f1-83c17159bfde", "comment": "Malware payload (Efimer)", "value": "0adfa8a6e80f624519fed48b5a8b7d04fdd84cc1d6fe6ac996317a9c89644aa73ca9a46d0669ba1d224beda1bbb1f59d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047928, "uuid": "23fcdb82-eb8b-4622-8174-06335d92b587", "value": "T14DE6331DA6D021FBEB77003EEEE06A95E644B4BA4B71C28B07B482E6BE171D05C35753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047928, "uuid": "0597c7c3-8a4d-4293-a1a9-5df579f46440", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047928, "uuid": "2386f1be-574e-47aa-8e40-66b37478e193", "value": "393216:a9tRlEQYvnh0hXMCHWUjX/cuI3/PGTAI:a9tjEQYPhmXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784047928, "uuid": "7a71b162-c796-4ce3-aeb1-61604fcabc78", "value": 14298464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784047928, "uuid": "50752579-95f9-45ed-9270-508eb189a5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047928, "uuid": "78dfa839-2182-4871-9ece-abdd3a50982a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b016467a-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784024021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024021, "uuid": "5bea728b-cd4d-42f7-a564-1bd8830fb133", "comment": "Malware payload (PhantomStealer)", "value": "42ba4ad3f9520ee54f5a93d2101ee967", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024021, "uuid": "c4971fc4-10d8-4762-974c-4ef7e2c81936", "comment": "Malware payload (PhantomStealer)", "value": "7d86433b6d5a41a027a778d25df88f47b3a2c8d511f3169ea76bca9f7368d8af", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024021, "uuid": "25e9f1cf-0991-498b-aa68-2448907a5397", "comment": "Malware payload (PhantomStealer)", "value": "eb430f8dd761d4ac73da981dea26d1847e9b3635", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024021, "uuid": "536d3624-e2b0-47dd-9c7c-cc50f9ac2f49", "comment": "Malware payload (PhantomStealer)", "value": "8a806b9c28b3805acfd247b7650041443995d7975b82b48f88ef9fb3f5a26838a8642330295e0fd1d872153c524ad975", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024021, "uuid": "a984a6b1-7d4a-410e-831a-cbb0c5100fd9", "value": "T1FCF6C28B93EE0F0E9CF22B7D01522CD1BB295B3995A7978C3E531E49ABE66034C1057D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024021, "uuid": "01584cc2-e009-41fc-b288-3efd22ac0d15", "value": "3072:J6LB9tIBnir7TkUwG5xxQmr5YxUtr5VyB3Nr9vSHE95VLmfsJBl4bxEAEG2MFJDh:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024021, "uuid": "ac74326a-bbae-4cab-8ce8-24c92e561173", "value": 15499436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024021, "uuid": "56e30044-3af3-4a0a-8ff2-71dc0897269c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024021, "uuid": "c384171a-4b50-4f29-97d5-dd1a022024c9", "value": "Fedex6577858874.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61ed2e4-7f71-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026286, "uuid": "a23c09dd-bc9a-4dec-8e43-b497d4b522d8", "comment": "Malware payload", "value": "f7e0ca8cf84874d40a34b88af8804bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026286, "uuid": "a1e2d3bb-566c-4b86-a2c3-ef218ce2839a", "comment": "Malware payload", "value": "7e937f0293fe6f962eb9c83efc03d7fb15db44c26170715168afa8f9f62dbf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026286, "uuid": "2599f12a-0895-4efc-b751-17b77bc929f8", "comment": "Malware payload", "value": "c8b8d85b21f34fa362235be1c25dc2d6874cd96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026286, "uuid": "ae067801-f8b3-4e02-9b0a-ee00b54a5930", "comment": "Malware payload", "value": "1e36c997e542bedf55bab753c18eeaf1330076ec94cd49095675903ac774bc911edbb9cbc4f8f33d68facb6eaf4372a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026286, "uuid": "947bcb2c-467b-4194-99d1-2789b63c3146", "value": "T1B9563A81F9DB44F5EA031A3044AB627F13346D094F34CFD7DA50BF6AE877AA20932959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026286, "uuid": "45888ff4-5264-4ea0-9eec-a28e9a4870b8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026286, "uuid": "f792351d-53a2-4adf-9d7e-d0d6bd4d421e", "value": "49152:7r9q5MQVeEtit8iypu5t5L90yoMoBs7k6FhymXGQal84p0gySPpb2iBnuyhS13hR:7Zq5mvypu7F90KgYIpuCnun5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026286, "uuid": "3aa156cd-2eba-4a45-aa6b-467d06da25f1", "value": 6082000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026286, "uuid": "19c84038-821a-4387-9d5c-3af7c4c492e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026286, "uuid": "d97c1c8e-cad5-4646-b3ff-24adcbae1b56", "value": "7e937f0293fe6f962eb9c83efc03d7fb15db44c26170715168afa8f9f62dbf79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570badcd-7f32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1783998961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998961, "uuid": "0e0abbff-4aa3-4d3f-967b-e7b31e62c002", "comment": "Malware payload (DarkTortilla)", "value": "df8e26f66145f175ecff2cef4ee76b01", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998961, "uuid": "4af19a22-41de-4d8a-ab2a-f49f3698bdf8", "comment": "Malware payload (DarkTortilla)", "value": "7f1c566eee880bce9a3f80880badee548b53ab3aded225c654faeff9cf0349df", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998961, "uuid": "71239ddf-5dd8-465a-9e26-46c6ab427a9d", "comment": "Malware payload (DarkTortilla)", "value": "18d4c8b9aa9034fa358fb580713a5a7534176110", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998961, "uuid": "13a80390-e61c-4433-84bc-28c517863d45", "comment": "Malware payload (DarkTortilla)", "value": "15313bba3f8e855aa6b5b8ed93a9eccbc8302ff544460cddeaa69699daf7c95d8e12011c8e63af74539b802e704af73d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998961, "uuid": "10f18326-adeb-4631-a2c6-bc66de8f3db7", "value": "T13D45F12549461635CA3D0A75C1D974A813F0FEF39266E71A2EE830FDCBB3794A9D7082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998961, "uuid": "ce63501b-d989-4cce-805c-9b57bb974385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998961, "uuid": "c14a0802-a201-4b7f-b068-d404fd087758", "value": "12288:yF6htfT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yy8G1R12Vg5CaCThajRlbrjV:f2UxAPqGcv/+Duyx4N0aYa95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783998961, "uuid": "75de100f-68f4-4db1-8eda-8d8b36afe563", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783998961, "uuid": "9cfb814d-b815-4eac-a1a2-9829baadc48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998961, "uuid": "b6dd9ef8-09b8-434b-b8b6-ee77345a2435", "value": "HSBC_BANK_CONFIRMATION_SWIFT_MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31551e67-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784002763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002763, "uuid": "ece2048e-2a33-48b7-a7a7-64ff8d564a6c", "comment": "Malware payload", "value": "f77acea0344aba66b8cd6e9078b87e3a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002763, "uuid": "ecbaea03-a042-4dc7-b445-d733d3a0af9d", "comment": "Malware payload", "value": "7f6fd336bcaf1c234ec7dece88d47eee9a29975359faddb87145a2c5d9541c73", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002763, "uuid": "3f8bd05f-396d-4a8c-98fc-15083f1c2e62", "comment": "Malware payload", "value": "9c26a2bba76edf0891870dd1bdc7c786a2b43145", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002763, "uuid": "41df3361-53ca-40bf-bafb-f72157c16d2e", "comment": "Malware payload", "value": "b095bc44a1db6622484913c30d7d2cc18b39c0f07c5bc6d1e65f157daa3c92da4c4042a0989938198c1aee9e43d752e8", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002763, "uuid": "5ed68708-5439-4ec3-9d50-e01ec4c9f4f6", "value": "T1EFF0DDA1CE57F180EE85D13264141A0D13608F978309B9876B29380AF9C5AC4E3455E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002763, "uuid": "c1455250-527e-47e1-aa79-411d98cf445d", "value": "12:5jsfYO1/8VZZOBoa5vzCPXRcyzm1O8Vwky1OYiAo4/DYJw4xoys7yYObdsm4cO8c:9sf98YoOveCyzmPmZjv/DYJJxE7y6mYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002763, "uuid": "b3d28dc5-14af-4c8b-816a-f4759ad16192", "value": 644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002763, "uuid": "58611879-07e0-4312-b628-0ee082c16f41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002763, "uuid": "1a4a72bb-b3d2-46df-8082-98d5165ba0b1", "value": "photos-2026c-1106037895593.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8638ddb-7f8c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1784037859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037859, "uuid": "84aacc3d-2fad-4184-b7b2-171be11aa9e4", "comment": "Malware payload (RedLineStealer)", "value": "72aa3594e47ab58aecf445d9703f6c43", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037859, "uuid": "2bcccd79-4bce-44c1-8c97-10f59eafe40d", "comment": "Malware payload (RedLineStealer)", "value": "7fc964fe47e08d13c158f808d0d68f3f2b9341dfb1ba6fb2a48690fe27e22682", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037859, "uuid": "e68bc5a8-58e9-49d3-b0a3-4b46b1a08ea2", "comment": "Malware payload (RedLineStealer)", "value": "78ea202006943110cb3d7559fc1bb7c4fe08755f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037859, "uuid": "8f9eb7bc-63c6-44d6-b377-9177bad9949f", "comment": "Malware payload (RedLineStealer)", "value": "619e946c7f063cef2826728fba10554f8361cae0239d95826f19f9fc2b4030ab20f8839d278ad9bf945e275a40e9ba1a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037859, "uuid": "0689c457-f0c8-43d4-a49c-47c47712b9b9", "value": "T10E771256E2FD00E8E5BAC0B8C6575517E7B2345517309BEB52A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037859, "uuid": "558cd4e4-d914-440c-b124-50d93d3856e5", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037859, "uuid": "d9e5d4cb-e347-4ae7-9c34-cf677d79e474", "value": "786432:Z21ig9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmg:EUgl+RBwXzTUX0w8mxmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784037859, "uuid": "25faccd7-b7ed-4071-a28e-fadf54ceff92", "value": 35517713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784037859, "uuid": "16e18405-b19f-44e3-8930-0e54fe153b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037859, "uuid": "399c4f1c-729b-412d-b6d6-73f5acda148d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759c7c72-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784033801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033801, "uuid": "c4f81ca4-aaad-4cb1-8677-176435912b3e", "comment": "Malware payload (Mirai)", "value": "11a0f3e9feeff8568ecae86f6b5a3cf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033801, "uuid": "6b7a2792-39ae-4c99-8ef6-735044777095", "comment": "Malware payload (Mirai)", "value": "7ffa326ed9a28aaa73ce7947f99449d8499fc03be6a305d6b1963e14e257b2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033801, "uuid": "75b62f5a-252d-4f51-9958-442da2f74b0d", "comment": "Malware payload (Mirai)", "value": "842390357062e1360bf97604b6007d8691d0a2b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033801, "uuid": "3d12bade-4777-41da-8a99-e26b08610a81", "comment": "Malware payload (Mirai)", "value": "bdf25a4d925a12cbdbcf3d168deb1f116c32d3a35be032a1135b91234ace124adbe7df74909fe340bff15f5bf027e9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033801, "uuid": "2523288c-754c-4a9d-9060-1a0abfd8f488", "value": "T1A7F3D627AF602EF7D8ABCC3781F9870924CC655A22A43BB57574E424B64B54F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033801, "uuid": "ed019a30-d61b-4295-8608-9804d6863dd4", "value": "3072:pvVdB5Ud8ROeRHNX4N8Adx0uxhf7Bnbe:t55UUOeRHNX49dx0ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033801, "uuid": "a0ebe3bc-e115-4d69-ad6c-4c7af69161d7", "value": 159356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033801, "uuid": "ad09a753-5984-45c9-9e27-b4313111fc21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033801, "uuid": "80412fec-7ce5-4ac9-821f-05d7098b08e5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a13cc6e-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009193, "uuid": "6ff475ea-6d68-4b92-8f29-ee731a91ce2c", "comment": "Malware payload", "value": "b1fcea687dadf17182b636f69de2b478", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009193, "uuid": "1d42ef7c-9bfe-4793-b3c9-24fe7d210c3a", "comment": "Malware payload", "value": "801c8666edf7b70a3fb42db7df84d462b5363919a2bbc887212579f6a2128f15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009193, "uuid": "3cc27fc6-9bfd-41f2-9f94-cae32e2a8706", "comment": "Malware payload", "value": "5c1fa1435e2144e356be0176023551427cd345fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009193, "uuid": "bd8531b3-652f-4300-8f34-b8642720f575", "comment": "Malware payload", "value": "8cb5da4aa096e8a574af44d4facc4697e0cc7a865e7b502c36e27e0e5554fb1cd1eb1cda6e8aee1be12c1cc245e8d314", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009193, "uuid": "116b9438-f0d8-4c71-94ca-22c1478ceaf8", "value": "T1B3236C6516857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009193, "uuid": "98228f9a-9a04-452c-a7bf-06294defb4b3", "value": "768:MXRWNGxVL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:glxqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009193, "uuid": "d2fedc71-0358-418a-86d3-0c8441e9e6d7", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009193, "uuid": "c10ab1f1-abb9-4fb0-bc82-30980367941e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009193, "uuid": "543ccb43-e01f-4b8e-9e37-5a473247d879", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f403cab0-7fc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784062360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062360, "uuid": "fd92982a-75b8-425d-8e44-f3601a51ad86", "comment": "Malware payload (Mirai)", "value": "28bed84beb9b71b60995f3739e6242ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062360, "uuid": "c3eda191-3a78-4927-938b-12cc9f6dd6ff", "comment": "Malware payload (Mirai)", "value": "8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062360, "uuid": "27654217-a0ba-4ea2-a9a3-2569816ec5bd", "comment": "Malware payload (Mirai)", "value": "c3d0200c509b7f4ac68ece241e415759ef3785da", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062360, "uuid": "9d6832c5-8380-4324-b10a-d3b82814d814", "comment": "Malware payload (Mirai)", "value": "abb0fac296e391afa220cc38d1e17710fbfd12d198f68d136ecc47f538d3a7d8edfb440628fee6ceefab860f3a3e197a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062360, "uuid": "16d4908d-a22b-464d-b3a5-f4d4cbb41520", "value": "T1C5515EDB030C5B32961989CEB7F731B4714AE18266DFD705FA44082D4FCAE4C7696E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062360, "uuid": "c6f005df-0818-431e-a6df-bce58a3b9a75", "value": "24:7oHDnD2JMJgDgbiBFMQMuZ9fESfEnE2EhE8gui9Q9bwcbnt3iDiJUfFOL+n+hM3I:6D2JMu0biB+RuZJJcvyK4bwd+hM3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062360, "uuid": "fecfc612-72a0-4fe1-8d15-18096be10fb4", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062360, "uuid": "d1f5df7b-dfd2-41d7-9913-bcf0e45916b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062360, "uuid": "6edb2d42-6c37-4f17-a25b-6a6201e030a5", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cafbc3-7fb2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784054122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054122, "uuid": "2d04365b-93d7-4c97-8b41-4fdb4e76e780", "comment": "Malware payload", "value": "588ebbe16593cdd13a0b9f4e77a9b513", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054122, "uuid": "d6f3f04e-0fd7-45b9-a3d6-bc2a00801ad7", "comment": "Malware payload", "value": "81ef05cc4d07cd22cd7cd7099f278dd9b9a3ae8ad4770b3d387892e1c6cfb7d7", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054122, "uuid": "595416b8-dcc4-4ed8-9359-1e0dcde3603c", "comment": "Malware payload", "value": "d230794982325afae687aef0a5245e50c7530539", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054122, "uuid": "c4b6fa9f-c47f-4e7c-926b-ea46668c21b1", "comment": "Malware payload", "value": "f7a89a8460a0a3812420a301651ea6c2b4a3fb7027e31947cb48972ea0a8a24232e07bdd7ddcd7f74eea83bc65df7c8e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054122, "uuid": "9c7df29d-f357-440f-87ce-4a79c738556e", "value": "T161E54C99890E0814C2F191BCECA30B7B05529554876CB68CBEA1D86DDFBB7F310A76F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054122, "uuid": "11ac17f6-69ed-41e7-a055-79142b8868f8", "value": "49152:2Y1dit9qTRlEltsd3srvRg5rMqQlyt0NtYc35iCORVTJ:nTEI8ltsdcFg5rMqQlyaN6c35iCORVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784054122, "uuid": "213b32ce-9c48-41b4-9648-c990a9daffca", "value": 3208656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784054122, "uuid": "73b73de6-66fb-4b52-b325-fd195d2b1db0", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054122, "uuid": "8cb0de71-1d57-42a4-b0e3-c8f0748b4e88", "value": "81ef05cc4d07cd22cd7cd7099f278dd9b9a3ae8ad4770b3d387892e1c6cfb7d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fca223-7f52-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784012649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012649, "uuid": "b7dd2358-c32f-4c0c-9b5d-c0e36698b052", "comment": "Malware payload (PureRAT)", "value": "3509393b29d79798b259223623bca4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012649, "uuid": "2a6b0364-5e2d-40d3-8f47-a6ce4c675d0b", "comment": "Malware payload (PureRAT)", "value": "825f8963d55e53cad341401c2f235523b2f9e87b503f83019fdac5f9f2714088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012649, "uuid": "4e5fb49d-d37d-45b5-bf41-4367a18ea1ca", "comment": "Malware payload (PureRAT)", "value": "3b004549daf62319f3bd68dbe423c50acf3203be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012649, "uuid": "73325ae7-abe8-4bef-8186-4ad85ffdf334", "comment": "Malware payload (PureRAT)", "value": "dbe52a55acda4a2aef8bbc9e72efdc6b44200bf6f84adeadb46878031f649e0bc7b1df0ce1ac49714a009b7459e55755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012649, "uuid": "ebaab5ae-4e5e-4c8f-b9a2-e8cc306677bb", "value": "T1E0648D5823ED8A26E6FD62B4E83D040D47F6B51A612EFB4F19A410FD6C13F8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012649, "uuid": "b775637a-b19e-4471-9547-72103e1883ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012649, "uuid": "a09c8bb9-7436-4dc2-b065-374f19c6c155", "value": "6144:5OxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:5Bu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012649, "uuid": "34f1809a-0ad9-45ad-9aee-ec17c4294d8a", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012649, "uuid": "47934387-53ce-42cf-b109-e9a0a2672589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012649, "uuid": "39560f9e-0be3-40a9-84a5-f05ba86cb49c", "value": "3509393b29d79798b259223623bca4e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac02d805-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784031745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031745, "uuid": "c082652a-2926-489a-ac27-7d9effb2243a", "comment": "Malware payload", "value": "6728a540eeda4ece665b797eafeb4cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031745, "uuid": "afe2d815-1ec9-4edd-80e1-b833d15adc27", "comment": "Malware payload", "value": "8265b83a8ec7e036c30d308e0570bff1cab43bf5851de28e3af547beb683bd1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031745, "uuid": "98588630-b1db-4127-a096-cbe96b1c17a0", "comment": "Malware payload", "value": "0f9a195c729ce13d7f61881be5e2fe4187cb94fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031745, "uuid": "86d9b0d9-acbe-410b-93f0-75c6691e0742", "comment": "Malware payload", "value": "bc822294c7118ed63bab62961335c097667c911bca18ff5ec5b47a7c7c25009fc78ff90075a7125d9e96a5080203275e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031745, "uuid": "b736e43b-a7e7-4fe2-b3dd-229ec953e707", "value": "T19E66D017E7A744ECD22BC138C79753327932BC461A302E7E9A56C7206E66F10A71EB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031745, "uuid": "9e7a8731-e849-4ec3-b62d-38d27a4b3d59", "value": "3b6daa7743235458e3954fdf7e5e5a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031745, "uuid": "e2ca26ed-8d6f-4970-b849-7e0971287391", "value": "98304:8E3PYPfp5+uuPaYlG+3uq7ukPjA54CDosfZVa3BOE6:8Ewp5+lZlG0ukPjHCMMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031745, "uuid": "c6cd93a7-9659-4d68-9b27-7d0e7f751a1c", "value": 6513664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031745, "uuid": "1305b102-a964-4124-aa5d-ec6cfa006787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031745, "uuid": "3cda904e-db35-4103-bbcb-62f39ca3e7f8", "value": "SecuriteInfo.com.Trojan.MulDrop39.37373.31031.24686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7b7905-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784002787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002787, "uuid": "530195a3-cbf4-4a76-bba4-a844a44b1936", "comment": "Malware payload", "value": "eb8fdef4de1a884bc1ba7a5534c2e72a", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002787, "uuid": "a14ce2e9-71ba-4d01-b992-63c64ff556bd", "comment": "Malware payload", "value": "82947e3951e1e32c7b4707a0138a12043cddcefb1bc727a1513dd8e3bcedf697", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002787, "uuid": "fc38865c-e416-4fd2-b484-5dcba3428aab", "comment": "Malware payload", "value": "50953062b8fd865329fc3bf23ff3c24c408a3818", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002787, "uuid": "7ae87430-c067-425c-8228-b7e74c311c0a", "comment": "Malware payload", "value": "26932ad12a834c9da4a642e53e5738c77f93b62470bfb44432043f79a08d78ff935a93b74d5de48336e1764d07b4626d", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002787, "uuid": "33f3e045-9565-4b65-be71-1861ce6caab2", "value": "T19D92083B365A04F743823B6498EE9108E768116B604D1ED9FDCC8384EF72B2657F9A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002787, "uuid": "fa3f3d06-6945-47f0-b330-1d914b71da9a", "value": "384:yqOmScTUSnvOF1qVQaMoLg3DjOymRU3Z3DF:yqPVveoLg3vHcU5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002787, "uuid": "9e202c5a-4311-4999-9d73-36770c7cbea7", "value": 20864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002787, "uuid": "1c2963ad-7441-46bc-9752-2e4bbadbfef3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002787, "uuid": "b45398a2-9547-4e1b-b2fe-6867b46fc03f", "value": "hezhiad.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3f1fee-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012316, "uuid": "bd40746a-5953-4fbd-a39f-39d663be5607", "comment": "Malware payload (Mirai)", "value": "da297f6c5d9edf3cac0df970fbfd966a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012316, "uuid": "526989b5-b657-4fc8-9bf6-f4d867ff9acc", "comment": "Malware payload (Mirai)", "value": "829b8ff8da9776ec84185fb3529cf2ce49d3befcd39bb60a760f0d800dee1844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012316, "uuid": "f33f7c57-bb03-49ce-914f-a856440860c8", "comment": "Malware payload (Mirai)", "value": "ae6d5382233bcedd8b58c1053d86146af3ad72de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012316, "uuid": "3cf28899-360b-46ed-baac-5d5f7eb0142e", "comment": "Malware payload (Mirai)", "value": "7259d114ed3ba263c97403ff0c387cf8d53801f5cdcc56d76b1a4d16489bdbc00784fe1c3e8e1d73bf3b97a34627d89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012316, "uuid": "a4558e0f-8c9a-4c12-b821-8133a9931f10", "value": "T1C2A33A86FD818A11D4D806BAFB2E118E33532378E2DE72239E149B3573CA91B0F7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012316, "uuid": "4084d20e-0c15-4984-827f-fd3ed84a2ba1", "value": "3072:7yhMMTIgGda5a1eU2+F74UQDa9QadV2q2B:Gp35a1eU2Q7LQDaRH2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012316, "uuid": "b94ce59c-f946-4eae-adcc-fb962601463b", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012316, "uuid": "84901850-1cb3-4044-98ee-2f19c6f738cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012316, "uuid": "62c34066-682f-404e-8708-48e78f7494fc", "value": "zombie.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219ba966-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022064, "uuid": "c595b44a-f78a-4936-9098-bd60135795e9", "comment": "Malware payload (AgentTesla)", "value": "73d3a30675edff0224cfaeef1b578b66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022064, "uuid": "4bc07cc5-4710-40ed-b394-548c54e64cf0", "comment": "Malware payload (AgentTesla)", "value": "8365a58fe73a021c914e57868087df4299d61dfdfd34e00cc89e496aa18c0572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022064, "uuid": "86bd4658-874d-4b4a-a97b-7c2532ce6110", "comment": "Malware payload (AgentTesla)", "value": "125ce3384144e4475e652027623b0aa5d6da081b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022064, "uuid": "ef5730d0-affe-4499-919a-aceb8f4f4776", "comment": "Malware payload (AgentTesla)", "value": "20c262e70252cbd71f3868c7ff3df5cb8e669a274988f766dac4b93a68025cea9c2af16025a5afb082863df4660d5af9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022064, "uuid": "0b5066db-4226-4b15-95c8-43388527cce9", "value": "T168340F027F88EB15E1A97E3782EF2C2453B2B4C71733C60B6F49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022064, "uuid": "326d489b-194e-4c04-afee-0bc076f040f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022064, "uuid": "49790a02-a80c-4fa2-b55c-9040ca8a7899", "value": "3072:7YrKayCK3qwf6i+L+5IkGTHo9rG8KaG5jnThhSoufzz:qKayCKaoZBssq8KaWTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022064, "uuid": "2fd12de7-a10e-4a06-8425-375a3ff1b149", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022064, "uuid": "c66a4254-6197-49bb-b345-111e280bab83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022064, "uuid": "dd94d2d8-b318-4c28-a418-4ace2e72c3dc", "value": "8365a58fe73a021c914e57868087df4299d61dfdfd34e00cc89e496aa18c0572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801c2f1a-7f38-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784001606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001606, "uuid": "9284d1b6-790f-413d-876e-d4fee0c88973", "comment": "Malware payload (AsyncRAT)", "value": "ca675d19e52dc6b473fdaba7f63b8e4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001606, "uuid": "f38ef315-5930-40e7-bd23-7325a141abeb", "comment": "Malware payload (AsyncRAT)", "value": "84747c0662aab4f64ef6bcb5ed3b27ca39d572aa43c2943573816a735c42c730", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001606, "uuid": "9c035282-de41-4c51-a124-8655d84423c8", "comment": "Malware payload (AsyncRAT)", "value": "2bda5d2b035271a5c04672a9085a7b19685745e1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784001606, "uuid": "51d413c1-7688-463f-bf9a-79530e6ef78e", "comment": "Malware payload (AsyncRAT)", "value": "3b9dd99c02b1a4e9551f6dba7cc664bcab27c9b9c8c6a668b0984e8b38ce3044b502c11907067885ed98e07f17d1b9c5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001606, "uuid": "0e80b425-805d-4a0a-9a82-db57be918de6", "value": "T174B4D1105FC47A6D479B0A27E53FB6AEF2E24989505A5CC6CB23FE446BB5300E6E3131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001606, "uuid": "125d353d-3733-46c5-bda6-ee515a27cdf9", "value": "12288:xZzX38kbT7VQ5KiOeijjiuB+LEmAp21jTpguxTq+cz8hDI44dqW:TnX2Ki5iwAIjTp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784001606, "uuid": "d3c53764-7da8-48b4-bc8b-7e138411af20", "value": 539430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784001606, "uuid": "201716ac-9dc0-499d-a09a-7924148cff04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784001606, "uuid": "11aaf791-8056-4b86-a51a-e95592f048ba", "value": "1C26TYY00000560.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3c1883-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022164, "uuid": "01fef39b-9967-45c0-aba5-e8c8a96e8778", "comment": "Malware payload (AgentTesla)", "value": "ac93e31be300525fa7c1cb135ddd2c06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022164, "uuid": "a5c57a74-903f-4ead-8396-8b5122bdd236", "comment": "Malware payload (AgentTesla)", "value": "84aaba3b6d8839289f88e384e6ae07f3621eab1f283d89b35a4f73bd4808e3d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022164, "uuid": "c7b8a039-7012-499c-8336-af0348f323b2", "comment": "Malware payload (AgentTesla)", "value": "9432d4fc2a5c43342362069ff40cb78368603c6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022164, "uuid": "238c624e-fe60-497e-b114-cc39b8926326", "comment": "Malware payload (AgentTesla)", "value": "1c624b2cd57d988c7292050d094db8519a781bb732d4ffc29e8e234cb3ecc16a7149859629c2c9fd445c687d3780cabc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022164, "uuid": "261ee0d0-60d0-41ed-a25b-1d0c5a4469ac", "value": "T1F6653309483290132537BC67AF94B75763FCAB3F5A81E312895CE64A6D5EF23EE49310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022164, "uuid": "21d34b47-19e3-4c8c-a184-ed1db93024ff", "value": "24576:rc2yP0E+MW6+UdhENfd7vbDcLYKmcbWN3h5N19MQafGqeftZcgWz4ANuTWtOHmba:rjQ+ZDUdhEJtvfcs1yWNR5N7Mx+qehAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022164, "uuid": "c4cf8832-8f85-4695-b010-0a5cbe659e6e", "value": 1549007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022164, "uuid": "012a6a6f-d883-406d-be11-917008ec11db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022164, "uuid": "fd2d784f-5f66-400d-b66e-6a9e2acdf7d1", "value": "84aaba3b6d8839289f88e384e6ae07f3621eab1f283d89b35a4f73bd4808e3d0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14419ed-7f74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemoteX)", "timestamp": 1784027512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027512, "uuid": "c4d54fa4-8247-474c-8810-145ca50e5901", "comment": "Malware payload (RemoteX)", "value": "fcdf36f4778815825ab6128b2e46dd61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027512, "uuid": "aa82d972-abe1-4fbb-9f43-a0a5f32d0293", "comment": "Malware payload (RemoteX)", "value": "85168dcb0ef99f785cbb51ec6481a0c6940a099cec3671faaef59e5f3978de45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027512, "uuid": "4bf48735-7d1a-4e45-a321-e48d9c808246", "comment": "Malware payload (RemoteX)", "value": "b850b2e82c47543cfbf1997046a068543ff1de91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784027512, "uuid": "56268d8b-336c-452b-ad5a-1f0740d2ae35", "comment": "Malware payload (RemoteX)", "value": "ac510e7b8e81962ece22cdd0b8fb00f520f675d9c9311f40061ba10f6534216255213d53829c9b8a98e5531740baeb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027512, "uuid": "2a7787c0-766d-4492-b0e4-109bfc8a2ccd", "value": "T1A9B6336A95C07DF1C8A653F42ED9A8472978FCB34B598791F21F0BD5804620CEF7AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027512, "uuid": "7077c709-e112-467c-aee7-d0a64643a5ee", "value": "1a4d57c190bf3109d290d9598b23407c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027512, "uuid": "bb0cb2a1-6f88-482a-a82c-803d9622f377", "value": "196608:NkwqaXGcT1rzfIDNZGjJlijdt7MEBuJD5b3CaSJlfPRmEk0t37Yosa:Nkwj1rzsSl2dt7BBuJDxLI30Ev37YDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784027512, "uuid": "30e65ab6-8ea6-4bbd-9dcc-79921a90b9ec", "value": 11289616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784027512, "uuid": "9b6841e2-b288-440f-946e-e14d38f2599e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784027512, "uuid": "8819c283-f70c-4a20-a986-ba1d25e3136f", "value": "\u0406\u0430unch\u0435r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3288be-7f63-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784020258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020258, "uuid": "8a46987e-8892-4755-b448-42160598d479", "comment": "Malware payload", "value": "38a3e6b402d00dc9837e9a2c1fae716b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020258, "uuid": "26efcfc9-4379-41ae-b1dc-79f9cbdc361b", "comment": "Malware payload", "value": "85aed78f4117b6a8f3faa65505e00d8250827f7e324ff0935444f6dcd5d8dcee", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020258, "uuid": "9e20fc51-0c8d-46c5-b944-2fec9ad1c50f", "comment": "Malware payload", "value": "4af097d049d02ae258d12dadd039fd47b8f8d4b5", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020258, "uuid": "4d26a385-12ac-4d9c-b398-a1c21f15be79", "comment": "Malware payload", "value": "4dc3b830580e371ecf90af9d8e2b2356c3861a79c63e104e13b3c704063883029e731ea97de51fa0f2c073c1762c6a5b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020258, "uuid": "50051edc-a7d4-4fb8-9e28-1f9b49399fef", "value": "T147052360FAF2DAA3D663BCB459C515C9021EECC98B16CB8FB060F33C243476AC9E9555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020258, "uuid": "f7136289-a9f1-4c12-a251-cbd4dbb59794", "value": "24576:PofwI/77dBXG/59nFByLxAxt76PdsaVF0:PofwIj7XEnFBqea+aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020258, "uuid": "5d836633-d226-4b06-a340-17c89e07404b", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020258, "uuid": "42ed8717-210b-4a9d-9736-c6edb5452d9f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020258, "uuid": "d64e9a6a-84e8-45e3-bd5b-e09fa1705aba", "value": "REQUEST_FOR QUOTATION 14-07.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277886d2-7f48-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784008330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008330, "uuid": "d6452aba-22b2-48b7-97b3-257c71977711", "comment": "Malware payload (Efimer)", "value": "e22497172f8d4c6b9a465fdee1cd1c94", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008330, "uuid": "520a8ab5-5247-48e2-bbca-0c339aead1aa", "comment": "Malware payload (Efimer)", "value": "862e54dc3f126e9bdc1c1be9c2abf1cea7348c39d22044b20bab193e74871e8e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008330, "uuid": "3bdb51cb-312e-4e19-ba66-febe24a78e9a", "comment": "Malware payload (Efimer)", "value": "5f9b041f77fb0af092e1e5a567cb3882e843fa64", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008330, "uuid": "ae83e3ab-2005-4172-ac1f-0aafbd14d3bc", "comment": "Malware payload (Efimer)", "value": "8418f03ce2ea7eb8e69104893e101d09ffc6bec20490607a2e97b6cb1135f5e12cc95cf4781acb61f98b992cbe2195b1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008330, "uuid": "8375dbf1-efbb-4c90-b512-a5c32c656999", "value": "T191E633999AD102FDE8B3803CFE916A44E0B974660BB2CEDB0AB443556D532918F3D377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008330, "uuid": "8e5b4eb0-9268-4c04-9ad3-3981d02afd75", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008330, "uuid": "03f56a58-ec9d-4a48-bf3f-b49e299b79df", "value": "393216:+gFuUcpFB8gEHiZ3PjMAUWqZOkWPyIXMCHWUjXqcuI3/PGTAI:+g1EFiM3PZqZayIXMb8XHH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784008330, "uuid": "a2145f2a-8874-4d18-a53a-f579d9ea27f2", "value": 14297173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784008330, "uuid": "87f2885d-f1de-41ef-90f0-786b7c14c027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008330, "uuid": "41049b8f-3d65-4ad4-8d8a-b9a898223947", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b563106-7f7d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784031207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031207, "uuid": "9eb646be-bac0-45f4-bc90-206c1685b5fe", "comment": "Malware payload (Gh0stRAT)", "value": "e5da6c7d192d79086a5a429026be2f84", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031207, "uuid": "5747138a-a662-4916-a359-c751afd90f13", "comment": "Malware payload (Gh0stRAT)", "value": "8635730e272497621742ceaf5f6c7a54238c431f1b1e3db8488a17976c9fc576", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031207, "uuid": "1e993cd3-21a5-48d2-994f-f67edc567c79", "comment": "Malware payload (Gh0stRAT)", "value": "46bdcf234a549a3ee23ff85cda9d4c145e55fad3", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031207, "uuid": "5edd361d-63f7-4998-be5a-9ec8adb791f1", "comment": "Malware payload (Gh0stRAT)", "value": "8ea42209be37a9ab777e5432018e869d15d31c3a1e19740aadff39508c6f78a45f133382bec2dcce28346062ca42c0dc", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031207, "uuid": "7c21b68e-d068-4b63-937a-9a7b9208c9f6", "value": "T1962733E504A4D35DB65AD0F54D3D66C1224486FFA3106ED3E79E26ECBA36C7E81FA008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031207, "uuid": "cb5c7736-0fce-4c53-8c13-f0a1ab596a89", "value": "393216:DsRs3HBnZ/hkDSLyUmTvvXlS5K1REjbfFQSmZAyJy1ztd4dREZjMAFI9:DQkHBZaDtUm7KaAbtQJMxAdRrk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031207, "uuid": "23e51769-e011-46c5-941e-d811b65dfd60", "value": 21379582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031207, "uuid": "84e5ba96-ca70-464d-bf12-77ee5e313dd3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031207, "uuid": "760a8426-289f-4341-ac80-6d058297fae5", "value": "Nut raw material processing contract.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be53c97-7f8b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784037140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037140, "uuid": "82493414-41c0-4b85-a814-9d5576766e42", "comment": "Malware payload (Efimer)", "value": "022de1fd649f7d495f8bdd08acdc7048", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037140, "uuid": "c69db21a-911e-47ec-86fb-e6b0260ce423", "comment": "Malware payload (Efimer)", "value": "863cce022db6778dcea360cf8a268103bcddbd0057e936cc5a2d060b2796022a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037140, "uuid": "9be1d184-a16a-4ee8-a174-3b3556eb9c28", "comment": "Malware payload (Efimer)", "value": "876b86a1480c6d2bcc58d97215af3d38a2564bfb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784037140, "uuid": "1b3d62e5-658b-4ffd-abfe-16e4f401a210", "comment": "Malware payload (Efimer)", "value": "5fe3f6745cd6e1c033212c39ada8fcbf185f26cf6f0b53b333d1349f6ff90aa32bea7b0012740043526836a914a98bc3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037140, "uuid": "c2e7827c-8cd9-4bd0-ac66-87121c843840", "value": "T1C0E633185FE412EDE2A3403CE9E255D5E69C78B64772C6EF07E0C2612E5B1F18D3D22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037140, "uuid": "c5b831d8-bebc-407c-bd06-f73675c93b20", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037140, "uuid": "7136d97f-0aa1-4603-9a8b-cbc0684b88d7", "value": "393216:GJ5H/iBVx0AepbUNEu2+i4pwXMCHWUjXccuI3/PGTAI:GuVx0tUu+iUwXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784037140, "uuid": "87184fd2-5d7e-46b3-9f34-61ff7f672ad5", "value": 14309316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784037140, "uuid": "2254ddfd-0635-4995-b16e-e46d43aa2b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784037140, "uuid": "4e99c966-6f73-4b0e-8832-75ec7ac66160", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bcd95d-7f53-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784013053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013053, "uuid": "cc2221f6-75f1-428f-8df8-fda32cf34cf1", "comment": "Malware payload", "value": "3fc24d984643e3cac186015299899933", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013053, "uuid": "3854df26-3bca-428c-bb19-2d4821b43107", "comment": "Malware payload", "value": "8863327a26aadb951d46a5a95497601ad05a8ed3f8ca6e4f569bafa945c3c905", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013053, "uuid": "150a9598-bd43-48bc-89f6-641df0820f90", "comment": "Malware payload", "value": "3650139eb34a9733a9016c89cfd5719d8d04d1e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013053, "uuid": "a230f223-cbb5-466d-9701-b926b1c93a72", "comment": "Malware payload", "value": "88c90b193a415ac892927217b57068fd5f0d9b2e1065a167211bc13a66c7b4954cbcbe37a7d506ab7d90a7eed6a707fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013053, "uuid": "96fdefdc-be3d-4f2d-951c-fe0a3f63c90c", "value": "T1A1C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013053, "uuid": "66a232ad-8f35-4ffd-a997-0ed99616485f", "value": "768:/8vCB+25j6es8R8b9FYpMSUpi+20qUpi+20YQX:/8l25J8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013053, "uuid": "aa741eef-f4c4-4f5b-8259-7c344eb29c8e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013053, "uuid": "02f208a2-e59d-4fa1-a724-816e07039840", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013053, "uuid": "ef2e7ad5-27f7-4af5-b2ba-67f187cb570a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce7c61f-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784023908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "cd62e49a-6988-48f4-8c9e-30f3411e9b6f", "comment": "Malware payload (MassLogger)", "value": "478f6b39b143fa3e970a21ed434df777", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "a1bd43da-93ef-4c09-b094-837a08602f72", "comment": "Malware payload (MassLogger)", "value": "88739414f8144e2554244d4446e1f9de48f0428cce157253a072f22ded4fa32f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "47162cf3-3386-4c1c-b60a-4a70589884bb", "comment": "Malware payload (MassLogger)", "value": "b462df07d200b56e4842a78470e03663c719bb21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023908, "uuid": "407b2bed-719a-4197-a831-03fa2b38e767", "comment": "Malware payload (MassLogger)", "value": "c25a05e2dc843b46567c0b3fd806426a2270c99b784166b12360db98451c32d27a76b0473e7db181d313d8e566e9b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "4f042459-fffd-481b-b7ab-dcf324ee27e4", "value": "T173D5D64157B9A1337360D79EA13AEE78A40F6013A4E9CF40399ED728791CD5BA704BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "6442538a-8527-4019-841d-15cb50c199db", "value": "49152:zFCNajR6/y8yndYDJZ5Uypok/zxJUtic9Gjnc3R86xHNO7dH9uCJGUyIDoDffSNp:zFCNajR6/PynSDJZeypoyz44c9Yc3R85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023908, "uuid": "bcf9e879-67e0-4b10-bb45-fea7b600e5d7", "value": 2930638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023908, "uuid": "c4447a88-398d-4cf2-b21c-256815f70871", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023908, "uuid": "1c90694f-c2b4-453f-bbac-63ad48191bb5", "value": "PO-9720226TMS807.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2257673a-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784023783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023783, "uuid": "546d7821-cd77-453e-8c37-bb423aaa9d53", "comment": "Malware payload (RemcosRAT)", "value": "055b965342119ca2b54be374bb0c25c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023783, "uuid": "cdbbab72-3359-487e-ba3f-a599d23e233f", "comment": "Malware payload (RemcosRAT)", "value": "888625bb2887f6965cf6d46b7888f73d9d55c0f0caf0abe54221bc455e5534d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023783, "uuid": "421e235c-108e-4bc3-8b94-518f88bd7e37", "comment": "Malware payload (RemcosRAT)", "value": "b838ad3ff29234fc93659973c47f23110424062a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023783, "uuid": "140a4ca6-8e21-482c-a9b5-bcb1bb4d914c", "comment": "Malware payload (RemcosRAT)", "value": "f01bd60a909ec5457b374e058d0e412cb2dfb77ec71ced11861e3c0f74de30886a65e79885a1e8a67183e04dbc5dd36a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023783, "uuid": "be909538-10fb-4f78-b44e-aedd3775f92a", "value": "T1CCF62373826F4B88D87C1D244A32129B9B1572C8CA9659CCC0F96B7477543A06B2DBFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023783, "uuid": "15277afe-a267-4537-887d-ac19c6aadf56", "value": "192:t8lyLjp6VNJp27uDwkyBwC4rFDKYkX/4J3/Bvgg65f6KyulEjVt6yVkMLZSk92RC:eMIXI3RbqfbfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023783, "uuid": "ffe5d72c-8004-4678-846c-5dc4cef2a54c", "value": 15906870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023783, "uuid": "f2d6f318-5be2-4f76-a6db-aaf08fdde475", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023783, "uuid": "c399109a-82b4-4371-bbc8-c7403e09977e", "value": "AWB no 530526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7c46f0-7f63-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784020255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020255, "uuid": "5e9753f1-b4dc-4d2f-99ac-1ddf492de7ce", "comment": "Malware payload (AgentTesla)", "value": "4886872376a5c9cdb2e1146ac7e1d07e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020255, "uuid": "2f5bc42e-df11-4eee-aef0-0c0d2f7269bc", "comment": "Malware payload (AgentTesla)", "value": "88e877bc0443ccab70c163df9bd1e45fa1af3f57bee40e0850e04f15e0646b68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020255, "uuid": "34a3b26b-8c18-4063-beac-bdfea9346159", "comment": "Malware payload (AgentTesla)", "value": "d16dc047ff0979472508107ce52625230b882f05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020255, "uuid": "1c214247-a988-4e62-aae3-cad298ae206c", "comment": "Malware payload (AgentTesla)", "value": "0a6420f491779c89e2606a1a0510b799e0ebee3b8246bc661f457d7a88938119021492e5e83873dbd9de61423b7e402d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020255, "uuid": "94f11fab-a88d-4198-8025-120746ea702b", "value": "T126052378FDE7CB7BC9536670689D108A011EDCE1875ACA0F3520F32F99363B6959D029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020255, "uuid": "e7828625-4807-49cc-8df3-95c431a67d02", "value": "24576:uofwI/77dVVzzjI9nFBjNJMhlZ5L2J6muLeYLQGX:uofwIj7DVzzOnFBjNJwZ5NeRGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020255, "uuid": "5ef7935d-9b9d-40c1-827c-f207ed2e20a9", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020255, "uuid": "5676422d-d56d-484d-9cdd-d619f348ca3b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020255, "uuid": "74c82c05-5a8b-4235-9e28-303698968515", "value": "Product_Specification_List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b1386a-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011358, "uuid": "3c0e3d5f-0d5e-42b7-bc6d-126a09ce9287", "comment": "Malware payload (Mirai)", "value": "1155b0916653b9e564a1d0db39095830", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011358, "uuid": "c631b5dd-738b-42c8-9026-c7744a4ca170", "comment": "Malware payload (Mirai)", "value": "895c88d509c92a3cfb2e91df23ef3eab3d61d15dce35419dffc7632d23489acc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011358, "uuid": "26c71dd3-e072-4e4c-982e-8c9215c44485", "comment": "Malware payload (Mirai)", "value": "144d0b14edaeaa28b426a47e101feb2390dc2985", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011358, "uuid": "cb4ed493-239c-4783-8479-b9d1a0b381b8", "comment": "Malware payload (Mirai)", "value": "65a3a7a1e4fbd231a8f4a0ecbae8f9b948683a2f1f54cc5cb756f365addbee6dda82690a769aa90591625e852ef1ac19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011358, "uuid": "855d2a75-a545-422b-bc41-8659b2b0c0f5", "value": "T1E3E32A1AF9099E23DDC6C234858F4B65323BB06AD35693933664427C7E8B3AC89F5DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011358, "uuid": "467ffd02-c7c6-43ad-a3ff-e0c5976f25aa", "value": "1536:KCBWFOJQf7pbrpXdJj9y/SOTXcAUvWydtmqdPR/2y/Zp4XJXLnqdrS9opJOSkgAG:KC0OJ8pXdJvey7pJROy/H4XJ7nASCki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011358, "uuid": "a0040aa4-88f6-4166-8972-be880644520c", "value": 148984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011358, "uuid": "44e5298e-bc9b-4808-ae08-9a948dec9745", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011358, "uuid": "82a15fb3-6463-4676-ba68-d64e2664e22e", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ec3335-7f86-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784035041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035041, "uuid": "8c49af2a-50ba-4012-a3a9-697a9ec9e755", "comment": "Malware payload (AgentTesla)", "value": "fcbf112a460cbd0d8d3ef297b05f17c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035041, "uuid": "18309ccb-8557-49a1-85d2-7a9840ba2bfc", "comment": "Malware payload (AgentTesla)", "value": "8a1326b0bee029dd4470ab53bddc3202de54614ba58a54ee1dc4d60928b812e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035041, "uuid": "0296a104-b65b-46fc-9058-6cc8581861be", "comment": "Malware payload (AgentTesla)", "value": "3ac26d76bd47e5f4eb5fff6c3502f7d1c840f8d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035041, "uuid": "dfdd6f35-a4f7-4bf7-9b6a-41f33a47a204", "comment": "Malware payload (AgentTesla)", "value": "2c7ea2acff86b5e6b905674c33a85a32ca1135b542faaca896cd534806330a92282663be25ae40d3af69135f684770e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035041, "uuid": "768a843c-bf6f-4772-b515-ab1755f84036", "value": "T1B6850AF7C6280261D12B4135990E2477F898C6B3F457050B78B59FC8AA37ABB568BF34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035041, "uuid": "e98a4f73-d25d-489f-abe9-949ecc753972", "value": "192:5M6DWk6z612yjpgBQOV1P18wsPwP4Hsa2LqNAIu+CuEiJ1VLWal:BVm1P19aaqNAIpFV6al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035041, "uuid": "1523a519-9c3d-4c66-86a1-895c43d42518", "value": 1832854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035041, "uuid": "b347ee13-8366-4125-9a6b-e0a56ff26164", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035041, "uuid": "5ea7288a-4b5e-41a6-89d5-9ecc93719f07", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525a1770-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MedusaStealer)", "timestamp": 1784035889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035889, "uuid": "7ab56177-8e73-4b2c-b7cb-1dfae32de8d5", "comment": "Malware payload (MedusaStealer)", "value": "1dc9b9053a4c36993b761696745cc724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035889, "uuid": "7a1e7cc6-2d0c-4ac6-96a9-98695dc4486d", "comment": "Malware payload (MedusaStealer)", "value": "8aa5c3cd3117f58ff76888ec83157436c775c87600b4c1b6c2620b93e5d41271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035889, "uuid": "5d5cfc47-7fab-4244-ad55-d83f6a703d43", "comment": "Malware payload (MedusaStealer)", "value": "712554a7d420d657936131a1789f4a38117c7bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035889, "uuid": "fd6ae0ce-a605-4722-84b8-e490713d831d", "comment": "Malware payload (MedusaStealer)", "value": "664e2c2fe36ef4261520f167a7aec34c9517ccc1d11c6f79f51c99e592e0519601a51061ba7e201ee8cab001f7d5dc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035889, "uuid": "ecd6a95d-cb5c-486e-8a4a-4a0634253deb", "value": "T14A965A03EC9515E9C1BED1318A6396637F627C490B2163D32B50F6247FBABE0ADB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035889, "uuid": "1aafa686-a674-4183-b9e6-354f77c04f3e", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035889, "uuid": "553536a3-2aaf-40cf-a066-d52d3ccfe886", "value": "98304:75g87MWPn5MIuLJGU6Oct3hXBcB5oUixw4pvE:7PgWm5JzqmyUG7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035889, "uuid": "69b00026-6e6b-4464-bbf9-da3e165842e2", "value": 8842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035889, "uuid": "c9d67a6a-4e3f-4509-8a58-fa52b27fe998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035889, "uuid": "0571973e-f21a-4031-85e0-7a90150311dc", "value": "8aa5c3cd3117f58ff76888ec83157436c775c87600b4c1b6c2620b93e5d41271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1210b83d-7f64-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784020320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020320, "uuid": "761b9a30-1dd2-4934-bce8-b61439d2cc69", "comment": "Malware payload", "value": "d13cb0f942861f54d1d061d66f1612ea", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020320, "uuid": "abd5a5a7-66f6-4d23-aa0a-de20f423d015", "comment": "Malware payload", "value": "8c15babd3a9d274ec5b0b7e36139dfcb08d81cb1a9e472514bb534c7bd8a8ef9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020320, "uuid": "574188ce-6565-43db-bbd3-f20e6dbd627f", "comment": "Malware payload", "value": "821aec1541635ac5b5e650bd2e7802b46bc0f2f2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020320, "uuid": "d20520ac-3754-419f-98f6-cd7f87e3a288", "comment": "Malware payload", "value": "61f47a2024d03547b4ae88230e36b95b21cc83904369f79f3ad37a5b4f5cf7a30a573448a44995b9ad8b553c74040cb9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020320, "uuid": "9647eb3e-902e-42b4-a62f-8de43c1d9ba2", "value": "T10803FA3B940D506AC900217AF2B7E18439ED06B357315F553F4E582FDBEAA2F0D688D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020320, "uuid": "46bd8baa-779e-4f7a-b55d-19af36ec9d1d", "value": "192:iC+jJjBaCg6OJGwcODwZW62UnY0Pd+koxbqT:iCuJjYCg6iZqZPd4xbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020320, "uuid": "d16255f3-0520-4e26-b601-aaed21f163ba", "value": 38298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020320, "uuid": "e2df6717-705d-489a-85d7-bb666d24c36a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020320, "uuid": "3b6f6c7c-1aee-4aad-84ab-92fc2e9f48f4", "value": "weneedbestthingsfromthegreatpeoplesaroundtheglobalcoing.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7a2dbd-7f1e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783990331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783990331, "uuid": "e125d71f-8ccb-40f9-a7dd-800b5d88f0a6", "comment": "Malware payload (Efimer)", "value": "7849b8d963c64b913d89f8d512559119", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783990331, "uuid": "b65dfc6b-9389-4975-8450-9a66cf045114", "comment": "Malware payload (Efimer)", "value": "8c4cac17d41571cc262de43846310440f0d0e31bd3dfa6e5c9df00bcbd5b323e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783990331, "uuid": "d0773938-0483-418c-b19e-25f02fdfd96b", "comment": "Malware payload (Efimer)", "value": "b67922864eb02abffbb792e59749553b4ba80df3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783990331, "uuid": "f4ec401c-9721-441c-818b-b49164982a06", "comment": "Malware payload (Efimer)", "value": "ebfb39c0df9cb55410bccb75a3231eb89b712606ce1a0b1cbebae59c55f2f525fcf3f7b56706f01858bf0631e7de20a9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783990331, "uuid": "a713b5a4-f41a-4623-8c52-f0453a4758bb", "value": "T168E6335CE5E022FFE6639138E9F242D4E598B4760BB3D5DB479493B27E172E0093C622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783990331, "uuid": "9e130d55-0a88-4c01-8385-e898eaf6dcd7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783990331, "uuid": "2f4ccf55-49aa-49ea-8709-e801b0905aed", "value": "393216:dnoTR43c2YufRJOX9NXMCHWUjX8cuI3/PGTAI:dod2c18AHXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783990331, "uuid": "688cc1f2-f288-4198-85b7-8bae8257b475", "value": 14290129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783990331, "uuid": "e9079254-0eed-459d-bc20-14ea7e6878be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783990331, "uuid": "93febd91-f467-43ef-8c21-80b24a014b1f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee3995a-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZeuS)", "timestamp": 1784021844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021844, "uuid": "b2a8bc92-2fbb-4291-bc1b-29eda0c6a986", "comment": "Malware payload (ZeuS)", "value": "0a15d395369645b594180541e13f05d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021844, "uuid": "0b75296f-324d-4127-8e67-ba0108c41cb1", "comment": "Malware payload (ZeuS)", "value": "8c50b7a1ddc3e95f1106e7515fb36811c298257135b3b376c82bee04391e6cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021844, "uuid": "2355e45b-c270-4b9b-a6ba-53602c66707f", "comment": "Malware payload (ZeuS)", "value": "c22abd6f58b80af730abad42dde43979de469117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021844, "uuid": "04176bcd-6915-4d6b-ad31-ad997bd3808f", "comment": "Malware payload (ZeuS)", "value": "6d3dfcc4ac0bc55584f1a43f2dc17ce3917f0ef2a8427e6ef1df1f002a0aaa02d45ff81aca63264580fe813a9e69d308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021844, "uuid": "e8931448-ea13-4069-8e57-2cb94605f9b9", "value": "T15305DF4237E4D439E0B702368D99D2BA9667BEA5CE7086CB77C03E4F28351D59E35B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021844, "uuid": "5d66a191-8c7f-44ef-b08d-c56e83aa5499", "value": "1e1b5a0d947e9eee1d7a0f3d37cba951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021844, "uuid": "f5d54889-9d4c-4f4c-8f12-0ed5dbf2ea8b", "value": "12288:A64+Fte7Q2hAUXRsIW0CbbNsI+3ODOuS0t+VMPAW:3Ftes2DRsH0Mb9+3aSCPAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021844, "uuid": "fb6f1b9a-b366-4a41-9f26-e48b27079a6c", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021844, "uuid": "d03e3694-374d-4f3d-a38b-197701f9677f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021844, "uuid": "34df62bb-e84a-49ee-b4f3-5d68f08efd9e", "value": "0a15d395369645b594180541e13f05d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7dd5a8-7f85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034645, "uuid": "07e2fe1d-c387-4383-b84c-27a5e98a7db1", "comment": "Malware payload (Mirai)", "value": "e64f94843e19bc46cde7b297e78ab527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034645, "uuid": "4850c2b1-b84c-4ce4-9355-75bae2b7beb8", "comment": "Malware payload (Mirai)", "value": "8d48ed5046e20f56f7c60c307ccc21055e777a4c2611484f11681af57929e011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034645, "uuid": "e59fcac1-abf7-4a2b-b9cf-7e0f0084f9dc", "comment": "Malware payload (Mirai)", "value": "502fe50ae92b83717298614f50318dcf38a728e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034645, "uuid": "cdd2ce71-b2ba-4ca7-92a3-57d7674bed10", "comment": "Malware payload (Mirai)", "value": "bd34737242635f2d4f56cb6f20105a09cd991a0e31f17d6c5f7f80d37fdc90b35da170e62e445b1ff10b612e5803b59f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034645, "uuid": "2a45a42c-b85b-46b6-9a1f-511f1178a170", "value": "T1AFE3D50E6E394F6DF37A8375C7F74A209B58B38216D1C649C26CF9122E3424D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034645, "uuid": "5d18883e-1028-4d2e-9d6d-b73bee3b4911", "value": "3072:UNgQfXka1LLOakoAdWpQZJll0c8vFtM39HeJmNVL6D0MeDwgfw6DUeqPVfykbGz8:UNgQfXkDT6q+6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034645, "uuid": "11d191ff-f97d-44af-913b-3796b7f352d7", "value": 156300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034645, "uuid": "50bb6b8e-e5ea-4f0f-9096-9abecc04479c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034645, "uuid": "19fcaacb-c401-4393-9945-46f1b6613e7d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ec17dc-7fa9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784050255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050255, "uuid": "a9151970-0d4a-4850-8a1d-bb57a0a5d5b4", "comment": "Malware payload", "value": "aa2e1369013a7ce09b2a435fe66a1c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050255, "uuid": "693d3574-325d-4184-9f7b-d9e863caf078", "comment": "Malware payload", "value": "8db515e787086c6338598c862601d6643c898af8407452679009ab51960eb299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050255, "uuid": "a2788084-1141-4332-8547-a2ae19400140", "comment": "Malware payload", "value": "d54b0ff7aeba501554ab1c2cead2838632e8b452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050255, "uuid": "690363f9-3d50-460b-9e03-c64d47b56696", "comment": "Malware payload", "value": "fa9d49055910b9e82933b9aadd0bcbc96c612ae0f4f061c0fbeab6372ed154813a9d73b6daffc028915bf9e4aaab1593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050255, "uuid": "0464e608-78db-4f97-9263-f21d4f5696e3", "value": "T129D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050255, "uuid": "f69ef39b-daaa-420f-9104-f071f34407e8", "value": "92576cbf961890053b0276abaa28bb78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050255, "uuid": "09718a86-55ee-4c59-b41e-f058a78494c7", "value": "12288:8NH+AxETh1IpJWIf9KvvGQJClDeSF6X+j:8kAqTXCJDWgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784050255, "uuid": "de86a55c-8163-41be-b7d7-4e2eca6c5244", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784050255, "uuid": "4722a0f5-359e-4e31-8b15-51d12835fd29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050255, "uuid": "576b3203-656f-4dbb-a303-05c35596198f", "value": "SecuriteInfo.com.FileRepMalware.63522757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe7b36a-7f4b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784009686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009686, "uuid": "3a4b45ec-cf28-4f45-a8e0-0bd3e9c08a46", "comment": "Malware payload (AgentTesla)", "value": "132fd7e557ae7b95f7dc8c2b5bbefe06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009686, "uuid": "b54f4e00-dcf0-4cd4-9a1b-16e261343b5d", "comment": "Malware payload (AgentTesla)", "value": "8dbd16903437126bd14983912aac07748f95289da274c04f5f4a6610e77bfd9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009686, "uuid": "ef4fdd6a-6c71-46dc-aae1-2f1542a0ed61", "comment": "Malware payload (AgentTesla)", "value": "3c679b739501a308372dffb6485de4ae9c14293b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009686, "uuid": "2079735b-d8d4-4034-86e8-3558f64aa0e1", "comment": "Malware payload (AgentTesla)", "value": "d018b46b435ebbdcab6029b8808fc6235baa19363822606d0068c9896175f8a1accb0f3985eca0b4dd3ced20c0eb8af1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009686, "uuid": "24356713-f0e5-48a1-965c-251de4bbef51", "value": "T1F72523989645E62BC9A623760E70F2F4237D2CA96910D21B5FEDBDEFB872F011C44192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009686, "uuid": "fcbdf2c0-e396-4b01-afff-7676bfef4b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009686, "uuid": "39f0bab3-b54a-4368-a6e8-92356b3e1f9a", "value": "24576:zpE46pRY37MD4NBnHXp0gy8VGktvxUZ6LC0hoQ5:FuvZD4PHZg0p2Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009686, "uuid": "698c0101-bc9e-4829-ac72-6ef788147523", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009686, "uuid": "22986d4f-3068-464d-91c5-9d85ff9b4922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009686, "uuid": "d5a9ea4c-b482-43bd-98ef-e122c0bacf03", "value": "RFQ013072026,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b0809f-7fb4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784054986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054986, "uuid": "950c480f-6fd8-4c1b-82b1-a7c68bd7a79a", "comment": "Malware payload (Mirai)", "value": "ccde69e5939f79a9e003f62a147cb53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054986, "uuid": "527fd53e-2244-41e3-9165-69e10814d544", "comment": "Malware payload (Mirai)", "value": "8dcbddb7a3b55ed63e56eb6d166879071683b6bbc6eeb03740dad94fed880ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054986, "uuid": "8faf7fe0-8de9-4e31-b329-894dd402a0fa", "comment": "Malware payload (Mirai)", "value": "977faadac7f50ba12d328d3d5ba25695bba9fc15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054986, "uuid": "9ae14347-c08c-4cb9-84d1-dbaad8f2db03", "comment": "Malware payload (Mirai)", "value": "fc788049eec996722c77f4eea0d73b23cb13c2f35883707e4a8f6623ae826f278c55c84b2a28bde4c22a38b59eede853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054986, "uuid": "154474b4-fd19-41cf-b46e-37012c13b439", "value": "T19BA34A89EA13D4F1F8526D700C37A3368BB6D4365136FA81FB513B716C2B712A907A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054986, "uuid": "444fc2a1-fccb-4792-ac36-47b3f1706e46", "value": "1536:+j8xhqZx3kF5r6gCnQfxPZUKRdMDRRBBQaE1h6n7vOk8w27qNt2eIuRrnk9l9yJ:88aNW2gCn2BZBR6QN+7vn2m72+kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784054986, "uuid": "ffb52f54-281b-4ad5-bab0-c305f347557d", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784054986, "uuid": "9ce55f93-d9a8-4a38-adf2-d2df67a0b5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054986, "uuid": "978b8b3e-adea-4f71-9448-01610773cb0f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d3f100-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011946, "uuid": "5dfdfc4d-64d4-41e4-b6bb-7f02c2813c04", "comment": "Malware payload (Mirai)", "value": "8fae66faa7ccab100795a0904e225cdc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011946, "uuid": "42a54157-8482-4841-914f-388f8239541a", "comment": "Malware payload (Mirai)", "value": "8df55aa02acf01bb6190d97881e9888875e8608ff1dd0cffafc856c796bea2f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011946, "uuid": "e6fdb28b-fee6-416c-8019-305ac992e4bd", "comment": "Malware payload (Mirai)", "value": "02a4ce02c48e3382369d827adac1d58d6c69ff7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011946, "uuid": "89bf1f1a-0d25-45fa-a744-0603a507af9a", "comment": "Malware payload (Mirai)", "value": "d6790bdea30fda78ebfac4511593e81c2803ed45298c61340f4c6122d13809c1df0c8c1c0f3f1cbb7fd353c21a3fa7f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011946, "uuid": "14df482e-693c-440e-8c36-09b93fca4ce0", "value": "T17B21329AA5854D54EF28E63C9E3107337B46CD69C50FE38B4D2185E55A2324C2B840E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011946, "uuid": "ea59676a-640e-4c1f-9018-bfb6a84f4e63", "value": "24:solnAwdGtlH4rUpTXtWpGGlIaEktmEJmJuzGokC7m1g8ONfeN:solnPdIH4rUpTXtWpGGSNEJmESo772go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011946, "uuid": "9dbb57e4-69b8-4b42-98b5-d5679e71c4c9", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011946, "uuid": "293a2be6-79d8-4f73-b13d-db5a5e0db437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011946, "uuid": "8bb5ac95-770f-424e-acfc-e59881937ad1", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6ef0da-7f55-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784014114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014114, "uuid": "5e8ef61f-c245-4f74-9ef5-7081abf570e6", "comment": "Malware payload", "value": "0b641b9391766dc99987a8d3c71e8e3c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014114, "uuid": "31dc3a0d-7cf4-469a-be6d-21972b180a87", "comment": "Malware payload", "value": "8e08bc9e69ba580aef0c45430e5facba38d0fc671dee8eaa2f6d5abc2124ab1c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014114, "uuid": "edba2755-8b27-402c-8d3a-0e7d7ad51ef0", "comment": "Malware payload", "value": "b1e29369e6547a5b1e1a0f07f1847644ae3d4ace", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014114, "uuid": "fdcbbe6c-ab95-43dd-a17a-e311c23277da", "comment": "Malware payload", "value": "a89afa8bb0406832e31b5bd719c3223309a71c887f3d91a39b9611c4f8513ff04ab212290716edde70185e5592c4e8be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014114, "uuid": "321ce5e1-d9b2-4378-9f6c-f167bbc69dae", "value": "T17C236D652A857C14AA98C4371D7E2F0CB9AD43E6320452ED7FCF3CF68C4A69D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014114, "uuid": "4ec844e1-3dae-44ba-862d-ba83784c54b5", "value": "768:bFXOGVvYf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9Lpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014114, "uuid": "f1371fe9-3f31-4a38-846c-49e82dcdb438", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014114, "uuid": "323fb12f-53fb-44ec-806f-0858c44d8444", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014114, "uuid": "605aec16-1d9d-4a6c-b702-4213b4dc91d8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7533f3ad-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023922, "uuid": "7f390516-8719-485d-989f-effc4508e94a", "comment": "Malware payload (PhantomStealer)", "value": "47cf174e98fd0b2b158bddea199de5c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023922, "uuid": "b29d89a8-0e2e-4ffe-8867-3423c5770e66", "comment": "Malware payload (PhantomStealer)", "value": "8e2df0b4a58c0de8a7691082a59a7c3c8d348a273b6ddbed0b1023a98a8fc9b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023922, "uuid": "16503037-6198-488a-9ddb-5da16be4d18c", "comment": "Malware payload (PhantomStealer)", "value": "3b7eff06d4f00ea21df210b27a68cda7b67c5b20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023922, "uuid": "d8e0f8c9-7402-4e48-b361-918d81123ad8", "comment": "Malware payload (PhantomStealer)", "value": "270ea65481c0176834b651f97609d645b132ea7dc07e494d1edc9469183c0912e4898bc8ec663b1131ad3b6b30b3570f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023922, "uuid": "5baa1752-01ad-47c4-ac1f-7b64e3e31335", "value": "T1430619915724A1337569D7AC913ADF795A4EA00314E9CF08306E8328BA6CD5BD38DFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023922, "uuid": "655b99be-1281-412e-9f63-cbbea08b3397", "value": "98304:lJVnjnmmQHCzCYnbgmDDjJLXPOpQROnSdRVGPXWqe66g/6/4laoRKIpFJS6R2nd:pvwrGJLXgcGP26MQlJRKIpzrEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023922, "uuid": "4067e816-c573-4be5-8f54-334f9440f945", "value": 3837983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023922, "uuid": "e1bc9bca-7c23-4fa6-a103-04f98712758d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023922, "uuid": "66c7a048-f828-4f2d-a62c-aa18a4c60374", "value": "bjevcjpz (1).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fa669e-7f9f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784045767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045767, "uuid": "6fed741a-96e1-462f-82dd-aada34228789", "comment": "Malware payload", "value": "b095acf446b47b7c1f123f4e81d2d646", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045767, "uuid": "4bdeaba9-eaa8-44f1-83c7-a6234e88a646", "comment": "Malware payload", "value": "8e6d648dd5b03d2d56ccc1a08908ecdfdd1dbbfac5c9d8d399d9a0e5d9227579", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045767, "uuid": "15a4b789-6e72-4681-a72a-9432734f82e5", "comment": "Malware payload", "value": "f3cff9f39b1241467569ddead45741a14b4c71a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784045767, "uuid": "34dbe161-5714-4b35-9593-66c64105ccbb", "comment": "Malware payload", "value": "ba4701baae27160b294c748f288c63bc90e437624d1664986de16656ca133064a0024c3732bed63de2cd532d5947ab20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045767, "uuid": "4756efc4-aa6e-4b0a-815d-e1a53d313753", "value": "T1B322C70832A0712EA12C13A3489F233558FE55B53ED9C7F8993FCA953E41A867C56DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045767, "uuid": "fdb5ccc4-da58-4a4d-a123-899f6aee28a2", "value": "192:P3AQe48IHr9YnS98l9k34quFWiPR7S0xj43tsPrc8LY5SoH1B:P3z/JYS9OkIquFWbw4iPI8Lmh1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784045767, "uuid": "eab8b3b6-651b-4851-beee-e20592adc06c", "value": 10889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784045767, "uuid": "a8d31f93-83c8-443f-9f24-37062e8ee821", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784045767, "uuid": "ef629ef1-ca3b-4ebe-8416-df0c46fadf76", "value": "Demanda_Civil_Reparacion_Da\u00b1o_Patrimonial_NUM80005.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478852ed-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784002800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002800, "uuid": "ba2abbe1-bb8b-4016-a690-bce3ef30496d", "comment": "Malware payload", "value": "8795dfa9120e5eea3e9e27136005b5b0", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002800, "uuid": "5c7ddb8a-c810-413a-baae-39e4ca873baf", "comment": "Malware payload", "value": "8f4ba25a2d35121f9f0e87c7a7a7e863321a892c700bb54754937c923e8237d5", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002800, "uuid": "db0a6ef1-b1e8-4b4a-a441-edc6357aee9b", "comment": "Malware payload", "value": "a9611927fa92d9ab724f0e33e3bc883439f1ab21", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002800, "uuid": "e57bf5f4-c2ea-4dfa-b965-1e30ff900c4e", "comment": "Malware payload", "value": "ad5aa0dfabbffc6c192ea4df5333502c95824327dd16be95900b91b1b49985baae35991bd2197b6d035753ecdf7ef18c", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hezhiad-com", "colour": "#2CA5DF", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002800, "uuid": "f81a8c38-0c44-4e24-b713-e169cf87c970", "value": "T13C963385D7FA31B3EC172778C6E82790931704579AC348E3BDE4875372E2AD930A994E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002800, "uuid": "43c45854-177e-459f-92f5-15913f244e9b", "value": "196608:hO3vLwYcxl4yGqlQowZHhs/fbQ1RONuYN72lb7bEtRzLj8:hGwYcwRoaH6fbEONaYXj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002800, "uuid": "b429fbad-037e-47d4-a331-5f061a64a1a1", "value": 8673815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002800, "uuid": "01d4347e-3db7-40ae-b870-671993811b6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002800, "uuid": "425412a7-243d-4fb9-b685-0d78de29f901", "value": "parceloexpressdelivery.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6d3b9c-7f9d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784044951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044951, "uuid": "0d768075-53c9-4b75-81f2-02913194adf4", "comment": "Malware payload (ConnectWise)", "value": "7046e88eb63b1d5271901092ce6e3838", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044951, "uuid": "f7f4087d-eb7f-41d4-a6a8-63d8be1c5a84", "comment": "Malware payload (ConnectWise)", "value": "8fe09be2bb21339f8b9ab4f3f30a9bcb4f6e167410ef3449f9659b3fb6f1cd10", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044951, "uuid": "85a7b6da-7a02-410e-aefd-b30a2226bbfb", "comment": "Malware payload (ConnectWise)", "value": "cc8caab23e20032831b1dc6e45a781925b6ee938", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044951, "uuid": "fba0809f-bf3b-48d9-abcc-b1405a905b5a", "comment": "Malware payload (ConnectWise)", "value": "cdc2512a4b0cef68c11e80102c252e1400ee95e9b3ae7cd7534d3a72698f34ee602a4fb5a8d86b17a1890bcf9d8fd3f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044951, "uuid": "2d796a1e-9167-43f2-8e71-9a2b1987a97c", "value": "T1B5646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044951, "uuid": "c3aca4ee-1f23-41f1-b8f1-460b9d3971b8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044951, "uuid": "7ab083d9-b6c9-4bfe-9519-e7fb3be65ce7", "value": "6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9L:Z1iw7gryNkSV1hy1Z1u2JLu9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044951, "uuid": "3e517e10-b513-45eb-9049-979facca3c47", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044951, "uuid": "5e3e1ccb-8096-4355-a6f4-89a83ea21c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044951, "uuid": "28cd72f4-5936-4398-b263-1fbcfc91123a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07832c2-7f8f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1784039081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039081, "uuid": "bc2f9b42-5e53-4311-a6a2-c6e8c7ac91c4", "comment": "Malware payload (DiscordTokenStealer)", "value": "7866e055d6135c7fcbebc7bbdb8266d5", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039081, "uuid": "a7741907-8008-4d03-8fec-57bbe12c3a1f", "comment": "Malware payload (DiscordTokenStealer)", "value": "9115c69843820f1a93b137bf6eab805294d61bfee04b971b7df01de2c927a12b", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039081, "uuid": "88535d64-fdf5-4608-b052-ecdee8342f6b", "comment": "Malware payload (DiscordTokenStealer)", "value": "772623b208e9e5e6768d3e10fc41a9851ac73a52", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039081, "uuid": "6586ba7d-0184-4b3e-b156-ed3d55d1cf39", "comment": "Malware payload (DiscordTokenStealer)", "value": "27603351d279570e5a50b9e7bdd11da53c29bc721f5d69044bd45418ab95187243387881abd58a14998e8148f854c60f", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039081, "uuid": "c504befd-93b7-40e5-8075-4c08290a876b", "value": "T18CA3F909F9A2212EC3A38077DE162846DDA13C4587599DFB63C1DEB65DE1AA43F3C702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039081, "uuid": "b019eb31-aaa7-451a-bdc7-ac6b86cb3147", "value": "b4d1f2d1ff81e1422a846265341502d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039081, "uuid": "9b56d1c9-4962-4593-84d9-6c2784c1ff98", "value": "1536:1JphlLTl13YNwcAerKzjz+4hPGKS+1eZvr4iomvG7hghbgZoHOsh76iifYfonWfw:9TJW/6SBhZDu5BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039081, "uuid": "815bd91a-0800-4e75-8634-6984954de054", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039081, "uuid": "2bccd7fc-1a47-4a00-98bd-d7615a48bbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039081, "uuid": "3f4f06f4-10bb-4e65-be30-e15a368e6d97", "value": "velocity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ef9091-7f66-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784021499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021499, "uuid": "e9076644-cf47-473a-b757-1e452522421e", "comment": "Malware payload (SnakeKeylogger)", "value": "975e32cf15bb1ff35595c094c95a0154", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021499, "uuid": "a40b04fe-86bf-4e7b-8769-5bb028ad117a", "comment": "Malware payload (SnakeKeylogger)", "value": "914a06741e5c1a028dc0b9e63d845230b11692454afc37785462ed6c05ca3add", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021499, "uuid": "03619b9c-12f8-442a-8bde-432dd5b0d80f", "comment": "Malware payload (SnakeKeylogger)", "value": "e98244573f5d9efe10104f612bd019220c75db56", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021499, "uuid": "c6de72a6-a3b4-49f2-90bf-af23d9189642", "comment": "Malware payload (SnakeKeylogger)", "value": "707ed934436bb1c7da27474332ed518e3b443315cc30e951c228e0d32d839eb8f70a6db73ee24f5cb78e7afe1828518c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021499, "uuid": "f6245875-c0b5-4dc6-bacd-f7b3d8933e71", "value": "T11825F1105FC46FAE87AE0A16D07F265FF3E25AC910666CCAEF23BD056BB5301A253174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021499, "uuid": "91afeb6c-8da0-4956-a729-270d96f59973", "value": "24576:oHlMeX/glCHyUDu+fZ4DlKys4l9l5exDoZQkvzg8:Kl/IlyZ6WS6x0Ck9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021499, "uuid": "e081ac56-cf33-4ad3-b808-9597eb20f8db", "value": 1007658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021499, "uuid": "c29b9a18-0270-49f2-858a-69985bc16b98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021499, "uuid": "2759e90f-4f99-4973-acaf-bd6e317b8215", "value": "Vessel Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b131093b-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784031754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031754, "uuid": "2fe21f43-f4ea-4800-8669-46275f883595", "comment": "Malware payload (Formbook)", "value": "2400507f87fef5cc83e59bdc47ae9a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031754, "uuid": "4e6b7c2e-89d4-43a5-a3a4-d2fb9f10d882", "comment": "Malware payload (Formbook)", "value": "9344ddd2906925b386bad207e1fb416739a5657a7103feed770d6d6b8d042556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031754, "uuid": "8b480807-fe05-4ed4-85e1-9e922b7a8027", "comment": "Malware payload (Formbook)", "value": "1deb24c371bfa6af74a660dc93253575ab5e0132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031754, "uuid": "0a4ba7ac-a79a-4e50-b3e9-0a8aa1c5b304", "comment": "Malware payload (Formbook)", "value": "50e0845ee7e4b5ab5364b8ea931278d0d4919d05f57d9aafac8c82f14a8e193633e412bb3ee00ae4bce19dcaa37d564f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031754, "uuid": "55098013-d664-429d-bf60-13cbf0ac661b", "value": "T12F2522186214E613C9522B7D4FA1F2B917791EE96820D3669FDE7DEFBD32F058C10086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031754, "uuid": "b84d8814-ed5a-4381-b47b-1048ca479053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031754, "uuid": "5394b420-fbea-4553-b8dc-086e4fb71629", "value": "24576:wNs6p16CuMyqQmVknwuIe6UYBo7Qfo0KB1Y/JNWqU:g31XVkwuIe6UY67QQ0KBGJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031754, "uuid": "e2df0c5d-332e-45c0-9bcb-ec2eaa26e605", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031754, "uuid": "35d844b3-43e0-403e-8a6c-496529000f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031754, "uuid": "2bf03c68-d2b7-4d4f-b6b5-2f0265aa0eb0", "value": "SecuriteInfo.com.Trojan.Siggen32.64932.5089.29475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bb809d-7f7d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784031036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031036, "uuid": "26d51698-60bd-4ab9-84e3-3abaf36d0b3e", "comment": "Malware payload (Gh0stRAT)", "value": "3c230061e5a16cc559b0a7f025f08250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031036, "uuid": "a781c708-9468-4fc5-a27e-3f407e99b6f1", "comment": "Malware payload (Gh0stRAT)", "value": "93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031036, "uuid": "f4fe5b66-2667-4146-b9e9-b2b3c2132738", "comment": "Malware payload (Gh0stRAT)", "value": "fd4bf20350133d8f8c12ed6047853571d89209df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031036, "uuid": "f583e383-4250-4818-b081-03b2b674d6a1", "comment": "Malware payload (Gh0stRAT)", "value": "f53db471756c857a9f7f9565e16b053f4500c6aeef3ec14a4b8cb105cbaeb3e0690a656d1aa2361835a0391fbecabb44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031036, "uuid": "5f5984ac-3492-4c61-b46e-fce924b66613", "value": "T14B173327B2CF943FE1BB4A3549B3E512493B3A646A234C5697E84898CF1A0D40E3F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031036, "uuid": "dbc3f749-7bed-4af0-878a-a3d7e8df12e2", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031036, "uuid": "5a0e6874-b5e2-41a4-bd17-04f8c9c882ae", "value": "393216:qLv/GnyaHH8CjG2PzfQGxhOS0WzZt4pq4VaRVYuaMKl4Ya:av/d5Cq2PzIGxESth4VaRPaMKGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031036, "uuid": "f40b14b4-4cb2-480c-8de3-10ce64691377", "value": 20027449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031036, "uuid": "cd72a26e-6f1e-45c7-9fb4-a1536833cad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031036, "uuid": "bfef8ca3-9f1a-414d-bacc-7b5fbd59dd98", "value": "Four Seasons Purchase List_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fac40e-7f9b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NWHStealer)", "timestamp": 1784044088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044088, "uuid": "e92d60fa-51c9-40a5-a98c-ae9e207538b1", "comment": "Malware payload (NWHStealer)", "value": "c80c3d0c0430e22dc4287879b00328d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "unauth-amper-cc", "colour": "#14A543", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044088, "uuid": "f685da92-2d5d-4b61-8207-e1e9806c5d64", "comment": "Malware payload (NWHStealer)", "value": "94b21f488f5fecc9aa5ec4a4188e7d14049d0b9e0d3d64027a450640bfbd706d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "unauth-amper-cc", "colour": "#14A543", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044088, "uuid": "d1993d0a-7a3d-485d-a4e6-784cc25e4320", "comment": "Malware payload (NWHStealer)", "value": "5ac5a982835602e627361e29a0a621436279760c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "unauth-amper-cc", "colour": "#14A543", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044088, "uuid": "e77ee929-24f0-449a-b14d-a03986fd869f", "comment": "Malware payload (NWHStealer)", "value": "ef1ca564ff97d24e091f85d266f0d0918c6ec29473b91f4ee954eac3df085eea23755dff5221255449ae8646beb64b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "unauth-amper-cc", "colour": "#14A543", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044088, "uuid": "9c300ffa-c0d7-4a64-81c4-a8efad731365", "value": "T1A0286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044088, "uuid": "985e996b-50ad-49dd-999e-5fa52d1f1385", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044088, "uuid": "9622de0a-85a2-4d81-9d6a-32b36bf9c46e", "value": "1572864:vZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:vZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044088, "uuid": "b8f81297-925b-4d52-9ad0-5018ab6021c3", "value": 97853440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044088, "uuid": "b818e508-fbd3-4cf2-9d0f-9cf1f47f7efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044088, "uuid": "75ad1b56-9c23-45aa-adc9-4dc396527801", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa80607d-7f6f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784025434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784025434, "uuid": "c2bafbf4-7df6-49e0-8a02-e756a39e0c00", "comment": "Malware payload (SnakeKeylogger)", "value": "13ea5c2f23f1822b68f4699f3064b440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784025434, "uuid": "5d79a523-359d-405b-8f25-29663eaf0e33", "comment": "Malware payload (SnakeKeylogger)", "value": "970d178fff5e535e65917b5b007dbaf5948d32668899bded7d954e5823fb50b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784025434, "uuid": "fdab6e4d-b30f-45da-a4fe-f20358ac3956", "comment": "Malware payload (SnakeKeylogger)", "value": "b23452357b766f78e42fe315cacec7e2697064dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784025434, "uuid": "7a8e19d8-e119-431b-83f1-7b81878d4df5", "comment": "Malware payload (SnakeKeylogger)", "value": "facbbabdbe43ede6125d311e13907518b12969398eb554fc5f661b2fd5b022edfbed6c23907825fcd00bf6eda547a1d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784025434, "uuid": "953f4bca-67ef-4a35-aa4e-25e42e1f9dec", "value": "T13B251248A604CA07C69913355B72F7B423AD1EE9A851D3179FED7EEFB932F448C40292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784025434, "uuid": "1d4ec91d-8887-4cbf-8988-0c387e588c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784025434, "uuid": "56fa00fb-f481-4f75-96ec-68f3b4501fcd", "value": "24576:xfu2HiOb1Ivsc7Fx0K15mvMxQkABFkWDj6:x3Cxvsk3oMx0b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784025434, "uuid": "ffa613e6-57a4-4482-9566-64a65a56053f", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784025434, "uuid": "6fc04386-5d89-4523-bf3a-3a65a8a5cee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784025434, "uuid": "4efacb28-f226-45e3-a286-e6efb741d856", "value": "RFQ -TGPF000124-00224D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37592718-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046582, "uuid": "fa233f24-e210-450e-921d-44b779a33346", "comment": "Malware payload (ConnectWise)", "value": "abffa933bba9273c4dc2096c0e125ff9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046582, "uuid": "74fafcf6-0975-4acc-b20a-5f78957d8c43", "comment": "Malware payload (ConnectWise)", "value": "97219eed1eda6a12d672138da9c9c540e95be415d227fd81c6933eb1b81f7160", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046582, "uuid": "dd68f760-e690-45dd-95af-6e4fc40cbca7", "comment": "Malware payload (ConnectWise)", "value": "e3bc15a2d2a89e5a384e1d323f7a7d8e6ba5d0a6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046582, "uuid": "79cd95f1-962d-4efc-9d57-58be84d2e45b", "comment": "Malware payload (ConnectWise)", "value": "9f3b384f28f15296a8fb2d62f68b97d1fc0d3e9b190d641c312d341f09a65e1952fbd2b5ae9cc9d95c551e0a28547d1c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046582, "uuid": "b99a571c-6302-4f4e-8eab-d0abb62d42f6", "value": "T1B2647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046582, "uuid": "86455ef4-cfa3-4981-ac16-b85ae6dbbf85", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046582, "uuid": "83ef964f-57f0-4969-ac9d-0e5c513c7139", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9O:R1iw7gryNkSV1hy1Z1u2JLu9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046582, "uuid": "de881788-e80a-46c5-b8b6-9d35e221b9cd", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046582, "uuid": "cfbe4b79-bdbb-45eb-90d5-cd88de181558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046582, "uuid": "25a48404-54f8-498a-afcd-fe7e33eda669", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165f61d9-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022045, "uuid": "a7db3303-f04e-4e61-864d-42c9cabc4345", "comment": "Malware payload (AgentTesla)", "value": "83aaec9b27ca20a5f1cdd75aa3c89d9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022045, "uuid": "0a7d4151-538f-4156-8612-797cf76d680b", "comment": "Malware payload (AgentTesla)", "value": "97b6c601828796cbb4b7f7d7dba3789a792816fdca70201e3965dc57694882a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022045, "uuid": "9674de21-bc53-44ec-aead-017216fea080", "comment": "Malware payload (AgentTesla)", "value": "aad5448e55ecb42184fc171c6128d809a8396596", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022045, "uuid": "7f3cd67d-5cd6-4ece-be5f-6912daff9a76", "comment": "Malware payload (AgentTesla)", "value": "659a416c083fdd14ad99a24ab75edf24f1bcb970ca802de6727c631850c7861ae05d286c906b55f0b243827764fd789e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022045, "uuid": "23a8c728-5cb9-40b5-bcff-b8504b48a254", "value": "T1B5340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022045, "uuid": "4f32ac56-da02-4d0f-8fce-bf48b4cb1e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022045, "uuid": "a0fc9c7b-15c8-4c17-8857-673fb616cc55", "value": "3072:Jcp6CyKaNWSKOzujU4nTHo9rG8KaG5jnThzqsufzz:i6CyKagDf9sq8KaWTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022045, "uuid": "9e284242-7e4e-4f06-818f-2b310e4c2fff", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022045, "uuid": "cf6d396a-8e35-4ce6-af70-35f9fc3282a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022045, "uuid": "ac60609c-6cf5-4833-b58b-c96764aa51b1", "value": "97b6c601828796cbb4b7f7d7dba3789a792816fdca70201e3965dc57694882a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3750482f-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784035844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035844, "uuid": "13c1d97b-505e-47a2-bf2c-1ff69d1f8695", "comment": "Malware payload", "value": "640bc315414400c37a1cb0a51cf73be7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035844, "uuid": "de3dc4b8-2087-4d77-84a1-89951ce61f6a", "comment": "Malware payload", "value": "97cfeb4679dfeeb2efdf3de68370c252592eb1777fef5e2a44cc5ae17cc2ad82", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035844, "uuid": "d105dec7-e50b-4889-bf29-5eebe768cbaa", "comment": "Malware payload", "value": "b598cbf6e03deba1636d946196e1a231aee0ee79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035844, "uuid": "6ba8e96e-b1f1-4f46-a193-c23959b08082", "comment": "Malware payload", "value": "4c908d3486322905348dbe0625900c089c7b53d46e73a2ae9fd3e3d68a6d00ddb0aea14b440402b2a3ba2160d7d26bec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035844, "uuid": "6d5ecd10-6205-4edf-813c-7eaa0d8c520e", "value": "T16FC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035844, "uuid": "f53eb311-5ded-4509-bebf-d6ebaa012a1b", "value": "768:i8vCB+25j6es8Rw9FYpMSUpi+20qUpi+20YQX:i8l25J2d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035844, "uuid": "7f69aa1f-c76b-4f32-b068-b074f1b69767", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035844, "uuid": "d413a4b9-b46d-4960-b47a-2561979faac7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035844, "uuid": "4d893be9-906d-4588-a4b0-55ff03bdc390", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d77865-7f77-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784028835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028835, "uuid": "a8744918-239f-497e-bcee-62f8d6e7681d", "comment": "Malware payload", "value": "b201df61ee7a55acad9115364c392397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028835, "uuid": "62bafd05-5e9c-42b2-b365-7e7418570f4e", "comment": "Malware payload", "value": "97e98f39185696d58e5c5613cbc7af7a3fe912cc961360d0d80414638f7a3728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028835, "uuid": "565c9a2c-e2aa-4a75-b308-9e287a99283e", "comment": "Malware payload", "value": "de0bb95ba73932350b676d3bbd7313699ed68c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028835, "uuid": "736aa822-4822-41cb-a239-3b3a16c772da", "comment": "Malware payload", "value": "156501ee05cdb577cb697e56d11ea8aaf7689f2384220c1621198020717010f66b87baf06a97941fc40c82fd7ca3a3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028835, "uuid": "6a9000b6-2d9b-4c6d-a648-05315d1e26a6", "value": "T104C71256E2BD00E8D47BC0B8C6574A17EBB1345513306BEB66A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028835, "uuid": "161f2cd9-e62b-4fd2-bf2c-947e6d2d4bf2", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028835, "uuid": "ea006391-7a6e-4976-9f3d-b2990e66d12b", "value": "1572864:hIVoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLir:hIVogVJnhVTMVEDjQKoFeLir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784028835, "uuid": "c781526e-bd6b-4107-891c-276bfe50ed00", "value": 52787538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784028835, "uuid": "87f78dc4-041b-4021-803e-c977c8b2e4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028835, "uuid": "f4d5552d-80ef-434f-a31d-1785db3eb591", "value": "97e98f39185696d58e5c5613cbc7af7a3fe912cc961360d0d80414638f7a3728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5bf89b-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015430, "uuid": "7944cacd-9d4f-4224-aa26-79b8ad15a9bb", "comment": "Malware payload (RemcosRAT)", "value": "b75450cd14abd967aa9e6b605a487209", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015430, "uuid": "1c5ea4ab-14f2-4ee9-8adf-a7c5bfc80975", "comment": "Malware payload (RemcosRAT)", "value": "98bb8fe3b8c340b90b3b740c1f7e507f8321392c0d1393da73632015990c6b54", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015430, "uuid": "e1560dcc-b354-4b12-902f-14adc46a1678", "comment": "Malware payload (RemcosRAT)", "value": "5882b3e7641825c3eb0912f2870d3a1c4d079d67", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015430, "uuid": "59d99849-f0b6-4682-93e7-42ef2ab24fc1", "comment": "Malware payload (RemcosRAT)", "value": "fed2392603e230ebfa70c087b307c90b73a3de9e9e6ec59bee68094e71123272e4439fc0e7f3a24043b57d622393bff5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015430, "uuid": "54b73f3d-908d-4bc8-8f13-4b58e183ae4e", "value": "T175052355FAE7D967C0836970988D99C6022FFCCA8EA7C91B3120F32E74352F8D6C5925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015430, "uuid": "5ed957eb-5e02-4dfb-aa7a-a9423ab668d6", "value": "12288:LSUGfwI82NBzTJSdXdw88AhUNZX+G/799qdKFBZEhQMnwqZcWPsd8wuwFz2uG0Iz:LofwI/77dXuG/59nFBPqRjUzyxDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015430, "uuid": "05a498a5-6f8c-43f9-8c36-5d6361c6c2e3", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015430, "uuid": "a1306333-345c-40ea-a6a4-b577253ac4fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015430, "uuid": "f8148438-65d3-4672-9a6c-82ec48ec3c20", "value": "REQ Quotation Order 0774.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d88e01a-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039720, "uuid": "3170df50-861d-40a2-a369-4f6c29e658ae", "comment": "Malware payload (SilentNet)", "value": "4569ac0a4638ee10c10586bcdeb02d7d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039720, "uuid": "3578eab4-dd58-4f74-96eb-ee8077cf166c", "comment": "Malware payload (SilentNet)", "value": "98df029cde9bef8c2a29676219930716d6532721e6bc3fb6915f38acb0842bfe", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039720, "uuid": "17df807a-76f0-4f95-afed-2aeb4a9f0e49", "comment": "Malware payload (SilentNet)", "value": "9ae770d94603f19351a4e2a506aeed39f1d14b84", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039720, "uuid": "a37faa14-8916-4c99-a1f1-e3180be69d3a", "comment": "Malware payload (SilentNet)", "value": "93d514cae9a4e9461f2cb93a4d345ecc6305ab82c0a3827a56247c5ecdff994c9b9b0453dc2673fcc2db8e38b08e88e5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039720, "uuid": "414450da-da51-4bb0-ad59-b9991738110f", "value": "T14E350227D51C4726EA1F9977F1018931FC6E03D1B00AA42703B959A7C6E788D8F4A7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039720, "uuid": "c57d09d8-8c7c-40ab-94b8-001304f9e564", "value": "24576:TBbJUWcTYdN+qJjOCD4gaoWILKfi3ij3FJuybju4+vsfZtc:TBuWcjgj9DuCLn3ij3FJuFZvmjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039720, "uuid": "32c8bb8b-9690-403d-9fe7-9c75d5b9e613", "value": 1095093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039720, "uuid": "0ef27ce5-50b9-4aa0-ad7f-15d7c26665cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039720, "uuid": "e9fe895e-8035-447c-8d4d-0782616becf4", "value": "Argon (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ad5f4a-7f1d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783989852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989852, "uuid": "a7f1e3e2-a5ba-42fb-855a-bf5df0547372", "comment": "Malware payload", "value": "973a62a7624943aa89b1379b41160c3d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989852, "uuid": "0130dc16-6580-491b-936a-2825ef54616e", "comment": "Malware payload", "value": "99688efb61464aca1b733c7824d247637f259bd9dae86a06969e3fe748dddc45", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989852, "uuid": "4fe4c21d-509a-4432-8c2d-222d49741f78", "comment": "Malware payload", "value": "133dc1a73a4712c3159b59a050a76cf214e24d9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989852, "uuid": "3e75c414-c224-40c4-abde-a679c029c281", "comment": "Malware payload", "value": "34f575d58b3eb98472cd10b5c3b4d112c95b09de3178c4a6d70e394c616f1a317ff164a45fd69719557e6efe8d65eba8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989852, "uuid": "1ef8ae37-8b58-41ab-a1fb-0f332b00bf66", "value": "T1A0C27D966A867C44BEC98A3E4CBD2B0D6DF5C3D1224D52AC3D4A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989852, "uuid": "cb8e8754-9e25-4640-84bb-74b6b6aeca23", "value": "768:P58vCB+25j6es8R5B9FYpMSUpi+20qUpi+20YQX:P58l25J53d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783989852, "uuid": "5246fa28-ea0f-4a1d-af9f-acaaba55e91c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783989852, "uuid": "8ff4f40c-487b-406e-9c5a-05d22811fb9f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989852, "uuid": "bdfb9d28-6ac7-47cf-bde1-f687b7983d7c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d4d90b-7f99-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784043230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043230, "uuid": "c209b9f2-91d0-447b-a491-a60b284500ec", "comment": "Malware payload (RemcosRAT)", "value": "d1750b22a4bbfeafbfc0811a31439500", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043230, "uuid": "69bc4997-b6aa-40cf-a9d7-2c1c39cc4b53", "comment": "Malware payload (RemcosRAT)", "value": "99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043230, "uuid": "33352872-7f55-4f96-8e1f-07dcabafe9a0", "comment": "Malware payload (RemcosRAT)", "value": "9ce499ab1fb412e7934e7e720c74c2476624b0d5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043230, "uuid": "11fc6fce-908e-4cc7-9a83-7b6b049cf4f6", "comment": "Malware payload (RemcosRAT)", "value": "0d036830421c1d21a4b818589e1e0d8fb129857d5d89d508d82292640c50fa21a0fb9ceec17138011e58707701b1563b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043230, "uuid": "1a9a6f3e-4415-4405-b69f-9fed3cab39c0", "value": "T14464F0B6C67428760E9C1368105D3FF3ADFC9DCF846874A4844CA4DEB4A47E2AD6C2E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043230, "uuid": "b1235eb6-2362-48f7-99e4-551ce978e333", "value": "6144:M4H4QjBpKk6GOYqntG7dgkbwhsMvvBAeU+4Vt6csRD:54GBpK1nrtozqXBe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784043230, "uuid": "74aa625a-9d41-499f-a18d-dde1a900f1af", "value": 308942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784043230, "uuid": "924154e2-228b-4408-a46a-6e03dcc57980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043230, "uuid": "75f5ea84-5fe0-4e3b-9203-a43161d28e19", "value": "loader_8e7c4479c8530a2b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773b5193-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012329, "uuid": "5ef9c51d-50c3-4048-b1c8-33fd065fd372", "comment": "Malware payload (Mirai)", "value": "fa81a8e38ca9a5dc430569b05ef2a8dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012329, "uuid": "efe54ad1-d63f-4717-a677-4cc4e6ba178b", "comment": "Malware payload (Mirai)", "value": "9a4e23d89979e54b66c91689831097148bf942de02ef8f427bae9bb3bd87a49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012329, "uuid": "57be3ebf-4d3c-47de-a9c0-13098c4f2d9d", "comment": "Malware payload (Mirai)", "value": "b985b1a775e9acd9701ab5ed202983a15cfc062b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012329, "uuid": "dcc958c2-5334-4a9f-93a1-5c74d80a44f9", "comment": "Malware payload (Mirai)", "value": "6431c42bc69a13045c7db07c77a284f180127420ae1e1a899ed49ffcda8d3cb4cbdfc0774a653c2c20d43d4ea17827f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012329, "uuid": "efacd6e1-b0dd-40b8-a016-c15ee6fab0fe", "value": "T1C7834D02774C4983C1E319FA2D3F23F6C7ABE9D012F4A685280ED74681B5E33595EE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012329, "uuid": "e627b8ab-b48e-486e-8a9b-3e2ab717b196", "value": "1536:D3MHZS97L8FKohWa1XPTXnOClIt0vr83E:D3MH2Lo/fdlIqvo3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012329, "uuid": "a8ed5e85-9bb3-4357-9b93-695d69214534", "value": 83348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012329, "uuid": "327d8497-1e46-4c86-849e-c695432de344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012329, "uuid": "fdf0883d-dce3-4c80-a39f-498b37e2c51b", "value": "zombie.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaf20ef-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015452, "uuid": "d6b8958a-bdc3-4a7d-9527-1a308f4e154f", "comment": "Malware payload (RemcosRAT)", "value": "d7f38a41f64e8ff1187fe82519c7cb79", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015452, "uuid": "282c345e-4cb2-4545-899a-f916d72c7356", "comment": "Malware payload (RemcosRAT)", "value": "9b217a3f5400225eb066239a6d77ea2b5a338684c52bcc9ee9e328fd6ee41329", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015452, "uuid": "e13f4beb-13ce-4936-bce9-59efe01bc4b2", "comment": "Malware payload (RemcosRAT)", "value": "9bb6dafc2cf26926c4cf381c02119e0a5aa9ab90", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015452, "uuid": "79f3ff6c-0894-40d1-88a5-1435a84a8836", "comment": "Malware payload (RemcosRAT)", "value": "c3cecba9d2a8ede246941b179b12d95f9c260715871f0960049fb9e396fdebe5684f416e6d51db2581cd01aa633c41a6", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015452, "uuid": "ab02a0dd-9736-453d-ad4f-c76cf3d4285c", "value": "T1F13402529887107AD3A262772F1C06AA50FE93D69D3170A709CD36E6EF435BFD274D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015452, "uuid": "7189ab97-149f-4727-83b8-cd8203d2b41d", "value": "6144:3BaHy/mK5QgB01iHbMolUo1yHSAZLTCrPBavH:lCgB0kHjN8H5PmBavH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015452, "uuid": "3a70d75e-269f-4fa3-8895-0c33633a391d", "value": 237070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015452, "uuid": "e2e6ba1b-f5f9-46e9-b061-64e6d912e1d7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015452, "uuid": "4a3504cb-e706-43bc-afe0-8c9a7e736b32", "value": "Quotation QU204277.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133ec4a-7f7a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784029928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029928, "uuid": "129ba922-72d0-49d5-b1b9-839a97987e21", "comment": "Malware payload (Efimer)", "value": "37073ab135f9616618661ba7f69f12d4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029928, "uuid": "f4b97b69-2f26-4f5b-a8b3-b6edc758991a", "comment": "Malware payload (Efimer)", "value": "9b91432230f930df707d577b9a1d2d5a82ca2d370491608a0c20c729c66d0257", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029928, "uuid": "87797c7b-41c5-48fe-86ef-bba836577696", "comment": "Malware payload (Efimer)", "value": "13aaac2d18f6f3525da20f4b31bfb060a531d372", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029928, "uuid": "7b2e85ea-7b47-4651-a671-c53dddf51846", "comment": "Malware payload (Efimer)", "value": "0235b91deec9034071b1fc19000a19cee61624c425ec3c4807420650610787cedf7dbcbaf45d55a8fb8b4d100bc5b04b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029928, "uuid": "40690a0b-7a55-4736-b383-4dd897f264ec", "value": "T1C7E63348AED110FBD5A3803CADB156E5E416B0A61735CADB172897E12E271F18D3F32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029928, "uuid": "eedadd69-2f5b-4c0b-992f-385b9ece3234", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029928, "uuid": "b0d9b66a-5d62-4111-ad31-686fbadedd9b", "value": "393216:LlpNj1nA6lERlJ7BqdUgoGXMCHWUjXXcuI3/PGTAI:Ll1AgUGXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784029928, "uuid": "7528cd59-3f2a-422d-ac7a-8c1da1087339", "value": 14296143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784029928, "uuid": "bb4a5330-7ec7-427a-8d69-6f573e790a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029928, "uuid": "a5533304-4e3c-4e29-a3a5-4a2decc0947b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb4af64-7f1d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783989981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989981, "uuid": "ea86a487-9fa5-4070-8b48-8c43f3d015ba", "comment": "Malware payload (Mirai)", "value": "72b1e7c2846860a4dc684e8b8062aea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989981, "uuid": "13aef579-04a3-4eae-929a-9f0726093588", "comment": "Malware payload (Mirai)", "value": "9b9999e19c8c0aab1ee141dc985454251f602e388f55f323eb1d17083cd8098e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989981, "uuid": "de32c342-6b31-4e6b-94c4-93817c571db0", "comment": "Malware payload (Mirai)", "value": "dee1645e7f95a397113531c9915de0d93268fc01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783989981, "uuid": "c386dd34-7202-4017-b483-647643be3afa", "comment": "Malware payload (Mirai)", "value": "13b00ae1c0a9741a19d93ef8fdee3e060e771501ce18c0c7c930bbc435a4bd780f7d30019212d20bf029afb7c2d2939c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989981, "uuid": "243f1b22-9a09-42d4-84da-a7ec49b08d7d", "value": "T1B9456B57B2F364FDC053C430879BDAA2A931B42546226E7F66C4CB302F66E741B1DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989981, "uuid": "d5e2010c-327a-439e-8d50-ec9bee1484ac", "value": "24576:Iy7ZDK4ktU8MwKBn9ExlWhGVfwXMS+KguK79qvB/eH:H7BK4ktU8g1hM0MSLP09qkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783989981, "uuid": "33cd384c-4710-450b-a3e4-6f82e575f728", "value": 1241928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783989981, "uuid": "328cb058-8d34-4616-a699-98f17c49a25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783989981, "uuid": "fe3cb180-327d-4aa2-a2e6-ba836dfb8e8a", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9329e5a5-7f7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784030844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030844, "uuid": "d401dab9-2777-4f2a-85ac-e740777a4e7a", "comment": "Malware payload", "value": "5ed4539dd877aa5da24196bf0658eef3", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030844, "uuid": "9e78ffdf-eede-41f5-917a-e5ba9fa2f176", "comment": "Malware payload", "value": "9c4faf515bac54a73110d0b387a471a9bf4ba77f8aa18e667fa5560e2252cc7c", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030844, "uuid": "8bf73280-feda-45f9-b844-c66d4cc100b0", "comment": "Malware payload", "value": "9e1908a6f9ce6f2fe184b4cdb9029831c602747e", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030844, "uuid": "f75ad66c-3d9c-48f9-84c6-be6e11223570", "comment": "Malware payload", "value": "6e35528fc9004062c3dcb685b6182dde1ee3e4fc1a9d1096ed5c68fea8cba6f9335541d5ce93d29d5553f326d827698b", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030844, "uuid": "26a73799-658b-468a-bf37-ba4faba24d31", "value": "T127B092502460533ECF4FCE1A8299C2214C7A3111626682A27A61861879046AAD216549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030844, "uuid": "67038c3f-1a1c-4232-98b0-8c5de3dae536", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFSWEan:s8GFGMFI1R3Ks8zsO0cKQ+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030844, "uuid": "5f7e2e11-60ba-459b-bd30-67101bb3d721", "value": 116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030844, "uuid": "30c48b4e-7517-4e75-803a-5cea3bb7dffc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030844, "uuid": "f5818e1d-8a6a-452b-a7ca-f019d6554697", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948cd044-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011949, "uuid": "4fa41c8d-cc02-46de-bb25-e62e148c923e", "comment": "Malware payload (Mirai)", "value": "0a5bd275e238cc9276b8013850cb6bbe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011949, "uuid": "afbf529b-c368-49c6-b795-6f8dac2e9f3f", "comment": "Malware payload (Mirai)", "value": "9c582fc64c2961f75ad41d7c29b7477604ff91c64cc7ca23ba11a516cb9c252f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011949, "uuid": "c3d53cef-51df-4e18-8deb-c1dcafbdecbd", "comment": "Malware payload (Mirai)", "value": "2ce4e23f90e10b525404f1e14eaf52c9ab921545", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011949, "uuid": "e9cca20f-acdf-4125-aaeb-ccdf9a669b94", "comment": "Malware payload (Mirai)", "value": "18ef4db7e3986109237fe5dec7c6d12089be827deb34eb0a07d658250fe1854125fcc07994852270a0f1305734b5c7d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011949, "uuid": "41bcd1ee-d95b-4f30-8205-3e388c34b44a", "value": "T135042A46AA414B13C0D627BAF6DF42463333AB5497E773069528AFB43F8279E4F12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011949, "uuid": "d656a23a-dad3-4945-bda0-6fe9de3e6d3f", "value": "3072:s9kPeIfXMO7YEc0aVLrC+dTmY8DRqh9838juouM/RYN/duC:6ye2MOUX0aVLrC+dTmHO983sXuM/RKd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011949, "uuid": "a7362961-bae9-40e1-ae29-a2a6db4dc35f", "value": 183902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011949, "uuid": "98c98f3c-51e6-4856-92fc-ed1cbb1e352f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011949, "uuid": "c866ad65-e5e1-4aad-bccb-76fd7c2df744", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac7285f-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012335, "uuid": "68df07a6-e51d-4cee-8a9f-1574e3a80846", "comment": "Malware payload (Mirai)", "value": "4ae4647e43df92ccbf57264298b469ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012335, "uuid": "467b00bd-7cb0-4590-b844-3b2490fd8cbb", "comment": "Malware payload (Mirai)", "value": "9c5d54e794c076f6cd767cd6a15d4081ea1967e3a5fa344056f424afe909a302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012335, "uuid": "2949ad3a-f82e-4ded-a0ff-68424181c4d1", "comment": "Malware payload (Mirai)", "value": "08da2f8c898206f86cabd9039abbdae32a8c08c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012335, "uuid": "b28424a9-aa0e-4d02-85f3-10083433f8f9", "comment": "Malware payload (Mirai)", "value": "408be8798c7686f398457a2f00187e3f4437703a561e2505319720f0b01823d45a629e9abdb369d6a4ae5846799acc5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012335, "uuid": "df6aaa0f-25fd-476c-964a-b593282eb189", "value": "T168833C0BBA9040FDC569D13447BFB236E472747D133572AB1BE4FE252D06E601A38B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012335, "uuid": "f69d69be-e00e-4ba1-9a9d-36f256b9e0a5", "value": "1536:at8uHLr4aU7wpv8BkyHRfQ8Ym6gmcDb5cGz:aZHdUuKbHRxYm6gXb5cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012335, "uuid": "15d652c4-4599-4911-b8c5-bcf985658a49", "value": 85376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012335, "uuid": "b009477c-e367-4d4f-8bd6-0b444489c9f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012335, "uuid": "09df1480-08a5-406f-b48a-efe3dece9780", "value": "zombie.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b6ab82-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NyxStealer)", "timestamp": 1784035872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035872, "uuid": "3a6b9800-c560-45c5-a1cf-121e36edb680", "comment": "Malware payload (NyxStealer)", "value": "7aff04a2469f7e8029279fa064e2b13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035872, "uuid": "58d42933-4328-4095-bafd-2b4bbec420d0", "comment": "Malware payload (NyxStealer)", "value": "9df99c94a008d23ebe56d2ac7c893867d798f58855a24ca4852d8577cb00b006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035872, "uuid": "c130df57-4fd5-422a-8508-296d0080a806", "comment": "Malware payload (NyxStealer)", "value": "c79310cd6ea5b5131c71a288491e1d9837c59164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035872, "uuid": "6c1ee975-fb7b-4718-a4b9-a899ac75dceb", "comment": "Malware payload (NyxStealer)", "value": "996c6ca031c44e56c0bb26d10b2c9295dfe8ae3605a9e103dd146d440417d40baf9748a199512f0f590302dcfbe5ffc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035872, "uuid": "eb488b66-bf28-454b-998d-8be08d2f00cb", "value": "T172253B47E1A321ECC15BC1748756A6B3FA31B85841387FBB9BD0C7312F22F506A59B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035872, "uuid": "ba4837d6-57f8-46ca-9cde-a523fd1f4e94", "value": "5cbb4d1ce6634ea430c2a18d3e073cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035872, "uuid": "1cd4f485-d413-4f90-8a97-a215fa36902c", "value": "24576:j1Cvc3yF1Yg56b4DvuKQlHcvhN9tdwZ1:j1CvciFig56qQGvhNb+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035872, "uuid": "9c32feeb-d216-43a5-89d9-2c1508fc2218", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035872, "uuid": "e3f89c86-5f88-4574-9aeb-4561c73f981c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035872, "uuid": "252e727a-eabd-45bf-998a-c111b822185b", "value": "9df99c94a008d23ebe56d2ac7c893867d798f58855a24ca4852d8577cb00b006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcca951-7f81-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784032983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032983, "uuid": "610a1ec9-9a1b-43a3-a498-3e2ffc6b602e", "comment": "Malware payload", "value": "fb79683d97abd0650e8e1176fe50b6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nextjs2385-ngrok-io", "colour": "#6D6B7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032983, "uuid": "cd26edb8-b579-4994-8e51-083d7c2663cd", "comment": "Malware payload", "value": "9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nextjs2385-ngrok-io", "colour": "#6D6B7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032983, "uuid": "bd730fa6-afe8-464c-867e-05fe9fedc512", "comment": "Malware payload", "value": "e08f23905e843ae192e468f0c1bb1263eafb7370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nextjs2385-ngrok-io", "colour": "#6D6B7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032983, "uuid": "ae0dde5d-c1c8-4dcd-b84f-128084ecc2f9", "comment": "Malware payload", "value": "d31f32a29f3e183f56aa562261e903bd5460821a543174e808c2ad355a65b253f972cda8bfe45876dc3f1fc3827606e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nextjs2385-ngrok-io", "colour": "#6D6B7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032983, "uuid": "3e90e268-5148-4261-a228-d616eb70b70e", "value": "T176D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032983, "uuid": "fbc8eb2f-7d44-4452-9633-03ba3196ce32", "value": "92576cbf961890053b0276abaa28bb78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032983, "uuid": "e7cccae7-3044-4d23-aa1c-598909139636", "value": "12288:gNH+AxETh1IpJWIf9KvvGQJClDeSF6XKj:gkAqTXCJDWgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784032983, "uuid": "fc6279cb-53b5-4b7c-b475-acd5a529480c", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784032983, "uuid": "b1c6f194-a341-4d33-b3a5-89fb7fcd8878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032983, "uuid": "58a76cbc-2581-44c0-b6ea-4fd6257c05ce", "value": "higeleveltask_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124bae3-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784012185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012185, "uuid": "6cb268e5-447d-4342-a7cf-f588ab40c358", "comment": "Malware payload", "value": "b385e7b3356ef4ef9589798c27b8db5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012185, "uuid": "877abae6-cf8d-42a0-a911-dceb58e42478", "comment": "Malware payload", "value": "9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012185, "uuid": "e0422053-6a41-40fd-8b2e-137a94e86cce", "comment": "Malware payload", "value": "16ba918fdd8a1e0a9b184177bfa6c760071404e3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012185, "uuid": "d1a7596e-a017-4c0a-80fa-48fa11e12c4e", "comment": "Malware payload", "value": "e8906e596027773ca8abed1dd5c8d8ac4bf4a6008a7af336c1742f6e3b4372182c4cf2740dbc2d2f396d30a2126837cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012185, "uuid": "9a206e6d-03f6-4aa7-a5b0-82a222cc7c01", "value": "T1FB517FD733110E712D667BABFDBD8E2C3182A0D158D32FC458EC38A562CDE88B446A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012185, "uuid": "fe8dfa3e-fd4a-47dd-9c2d-8a929dd054a0", "value": "48:i8Be9Behml8BeLBenEl8BeEBeCXl8BeYBeePl8Bea/BeazvZl8Bea5BeaFvjl8Bc:i8BKBgml8BIBuEl8B1BpXl8BdBBPl8Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012185, "uuid": "c5c82ac8-07d0-4c0b-862a-b75f0203decd", "value": 2929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012185, "uuid": "52981435-34f1-4adc-bb6b-b27b812ab318", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012185, "uuid": "7d1e4879-96b2-4504-aab2-0b3e9b8dffa0", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c64fd3-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023863, "uuid": "e0e8725f-ca9b-46e9-9695-8c209b2cdad9", "comment": "Malware payload (AgentTesla)", "value": "c9ba14c490a2b03289ac12b89172715d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023863, "uuid": "4f33d733-f067-42b5-b0a9-b74c094fcb83", "comment": "Malware payload (AgentTesla)", "value": "9fd781d549aec0e884a9d90541e8d7e5802d0de0cc36fc9d3c8533deb44846ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023863, "uuid": "9a64c468-2ccd-4662-a2f9-956d699efdc1", "comment": "Malware payload (AgentTesla)", "value": "ae142808be765b3473929a4ffc6151542919fab8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023863, "uuid": "3a2a80ec-cba9-4c65-b31a-24fee9a733f3", "comment": "Malware payload (AgentTesla)", "value": "ed6c8e66646d45692565383e16a4e49b2755d23952c670fbcf7275574f5fae37b58107ad35f90024a297f595e56e080f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023863, "uuid": "7e31f0d3-5a58-43fd-92e5-fc001a84fc63", "value": "T1D806494098B0B28B75A4C7AA954F9FF4594E94979D34CD403B0FD63D8D09F8B32922BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023863, "uuid": "6b3d822b-31f2-4ec9-af3c-d8cb09cb7064", "value": "98304:G5+CzBn0tdqOB7Hv1c2QS/42uKDdEf3cI:Onc1Hv1ZQSQ2ziMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023863, "uuid": "b97220ef-c2e3-4b5a-aad7-257af0c737fe", "value": 3781576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023863, "uuid": "980ae36a-e947-4503-887a-56292585117c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023863, "uuid": "d330ab8b-809b-4ca5-8b41-18070641ad52", "value": "TNT AWB TRACKING DETAILS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9747bf90-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784012383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012383, "uuid": "8802d05a-d2b3-4b3f-8ceb-8b2dd3511061", "comment": "Malware payload (RemcosRAT)", "value": "3d780d586123610d7d874e6bb0efe714", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012383, "uuid": "8969a467-e37d-4570-9835-13bcf5bac3ab", "comment": "Malware payload (RemcosRAT)", "value": "a0cedf46fab9040b2d45658a6f71606eec9800f94b7758d41674dd16168617ce", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012383, "uuid": "0230c655-7a4b-497a-859d-167461d9f2a8", "comment": "Malware payload (RemcosRAT)", "value": "1c23342365b515519ec4ceeb7bc95f10dbfa179d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012383, "uuid": "b5042066-e0e8-4a74-bc5a-3e0ef3d55dc1", "comment": "Malware payload (RemcosRAT)", "value": "60da871a6a2364a6376395aa485956897e1fbd89b8a18e27845aaf107dde4856142fd3af5d35b17a1ace126316ac3711", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012383, "uuid": "1681b48e-276b-4569-b948-42921831adb0", "value": "T14603E7188DD2BF928B3BC2652CE4BEF591119FEC51662D3438FC9057B366B699E4030D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012383, "uuid": "e2cfce62-3d33-42be-863b-0d91f924f0be", "value": "384:Tw8ydJ10wHyd80VieOLKtlD/w31uCGWwPwn:TwRKw+wluxWwPwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012383, "uuid": "fc7049d9-3679-461b-abec-f99077095a1f", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012383, "uuid": "fc2fc06c-10c6-4847-bde8-75e799abddf3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012383, "uuid": "f53cd35a-dc53-4f24-b0f9-43fcd28ae8b7", "value": "givemebestthignswithgreatoptionsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caab0de8-7f7a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784030078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030078, "uuid": "47a94c7d-8e88-408e-831b-c6f4a6195eac", "comment": "Malware payload (Mirai)", "value": "05f35f78a5a159676a20c9b6851f59a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030078, "uuid": "ac18d71e-b472-467a-97f4-1e5255463d83", "comment": "Malware payload (Mirai)", "value": "a100ed818728b245622f75d385a6176f2f83893fc279256ceb323e0390ae2ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030078, "uuid": "26a802aa-b00a-4f9c-b109-d74f8d2a6c76", "comment": "Malware payload (Mirai)", "value": "2bfafba4eb5d0b672b715e2df6de6d077cefe474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030078, "uuid": "a7f6fbdf-4248-4092-aec6-81620c5515a0", "comment": "Malware payload (Mirai)", "value": "93994e13ca90b4bbb6783dd19f82b114ee6b59c217478714465b721038dbf7c41bff0bf4476ba7c355e78dba0e9e5e48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030078, "uuid": "29469608-f8fe-4176-a79c-1656318db586", "value": "T1A6B31A89F881AB24C2D226BBFE5F014E33534BACD3EA72129D145F6477CB95B0E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030078, "uuid": "e90c3e19-f097-4a93-8ee7-a42f1a144f4c", "value": "3072:kA0ItQDUQ0UeuanOytgvwIJJw2lazRJPYIRv6ewnOxvwP:kAPk0UeuahWvw2FlazRJPYIF6oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030078, "uuid": "212beede-d193-4be1-9601-dce37b585046", "value": 113680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030078, "uuid": "42c0b37a-e057-4453-a550-a0c0fd48ede9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030078, "uuid": "219ea387-cde0-4860-8c9f-44178b50014e", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bfb772-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021963, "uuid": "caf21d37-32eb-4b74-95b7-19607e9f27ba", "comment": "Malware payload (AgentTesla)", "value": "dcd8cb6dd4db70d7951844a50a735519", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021963, "uuid": "3a1be2d0-28e9-4eba-afc1-829b054948ab", "comment": "Malware payload (AgentTesla)", "value": "a1e24e180009ba7b76729719211473e95688af635c78d698b853c009cd0edfb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021963, "uuid": "7f75fff1-d8db-4151-9437-1ade98ee6a42", "comment": "Malware payload (AgentTesla)", "value": "98a70adce1b60c5b38ecc196f4a9a6d36310d6be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021963, "uuid": "29767c5d-8635-4d8e-b800-1560e871ccee", "comment": "Malware payload (AgentTesla)", "value": "3ba6768b1be4835dc6e9754cf973e84ed7452368e07e2bbb30f714a856c10c617a804f85a720c57eb078a26118044d05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021963, "uuid": "90a78fab-54bf-456e-978a-5302c900e8b2", "value": "T1957533158D6AEF422CBD5F9930E5E308CAAA803E36B553495B80BDC70262144677FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021963, "uuid": "f4a4c53e-faf7-4a5e-aa13-8375f50ed8db", "value": "49152:6GO3BXWn2UvYZBBebj9H89Qj9BtJGjkk9J:5OJ5UvkqZf+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021963, "uuid": "0e71a96e-9aa9-4183-b040-1d2420e6731a", "value": 1576702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021963, "uuid": "2bda8025-0346-4360-862a-53bb7f12040a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021963, "uuid": "0825ab1a-2b0e-4964-aea2-3de696b2edad", "value": "a1e24e180009ba7b76729719211473e95688af635c78d698b853c009cd0edfb6.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dfda07-7f64-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784020321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020321, "uuid": "d043ce2d-5cce-44e2-8e8d-356250c19a19", "comment": "Malware payload", "value": "8228d367af278e47c1d783b56a43baad", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020321, "uuid": "2004aa99-3340-4681-a225-9ca18f9c84d4", "comment": "Malware payload", "value": "a21d5eeb730560acbf17c86246dbee7870b3aafb007a71440e89cf2b346b6f8b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020321, "uuid": "d28b6cc9-915e-4c60-80a5-3319a0fc47f6", "comment": "Malware payload", "value": "b55f2f0924c818864ff8faa93884dafd6d4167c9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020321, "uuid": "f91b6144-d62a-4e17-bdee-8d70a9a97d7e", "comment": "Malware payload", "value": "e882a27e8ae241509f1513113e1a8dc22df53df6a2926338ba0fd69c52252558b597c9d704a14f0dae4f35157ff69dbb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020321, "uuid": "08b3e331-3077-4db7-9f1c-13f0d0a8b193", "value": "T1C503E93A2EE330AB6D03A22704E5A859CA57B85B3606703EF1DC06FEDF55034A591D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020321, "uuid": "c6748914-2542-482e-b81f-2de323693b46", "value": "96:q+qKN7yN7xN7qUN7kzpN7iN7yu4aVHV2VLVTVyz4FVrVQV21V2VFXx9nA9O:pEHpCp0Yp8Mz1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020321, "uuid": "51d412e1-c697-4eab-92f0-eeae93cf7b98", "value": 38270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020321, "uuid": "9a0eabd6-3ae9-488e-9b06-b768512f9289", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020321, "uuid": "52ba1f3d-4b1a-4cf0-8f2f-6c129bdf70a9", "value": "givemesomethingsgood.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f0480d-7fad-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784051923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051923, "uuid": "81d5ea83-5147-4824-a398-2ceeb84833eb", "comment": "Malware payload", "value": "468d27c8ee230cd63d8c89763d8f3e47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051923, "uuid": "5a43800f-65cb-4a2a-9d02-cda3dfec9daa", "comment": "Malware payload", "value": "a3861ca7da0494b1ffa4dfb0d940d1c27a34a38481f861a55ec1cd4cd97ef9b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051923, "uuid": "d3800a78-e73b-4d9b-a502-5995089d939a", "comment": "Malware payload", "value": "2d3243de54ec17d0c6677a7fc89d99b9a8045fd6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784051923, "uuid": "8051a091-6471-44a1-8983-4ed894464259", "comment": "Malware payload", "value": "f6823fdcf084dfee75aa42b769438494a9396b9fc68e9d877a4df5e72e485015e8129dd9b467d4d7aa47fc313d66651d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051923, "uuid": "03ec81cf-65ff-43bd-a90e-35fb95ac9a35", "value": "T144C28D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051923, "uuid": "3c78a5bb-0f50-429c-b9c6-f6f2b452febb", "value": "768:lu8vCB+25j6es8Raj9FYpMSUpi+20qUpi+20YQX:08l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784051923, "uuid": "97ea24c7-fa52-4ecf-a09f-7942f1743440", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784051923, "uuid": "7f7822aa-ddfe-4923-928c-ce735108c020", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784051923, "uuid": "f15a052d-e3e5-40b1-9d7e-fff9b4dde6bb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bbb093-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015432, "uuid": "f2dcd99c-193e-4437-8432-4010035af6b1", "comment": "Malware payload (RemcosRAT)", "value": "4a345ea531c30678df6cffd963890789", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015432, "uuid": "cc647070-fc01-4bba-b831-78c978baaac8", "comment": "Malware payload (RemcosRAT)", "value": "a50b107c3c5ad5704f784b9d651d4d3e94e9931eea94c69705c4f935161dea1d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015432, "uuid": "2f846628-72c8-432c-abc6-a68e4588857c", "comment": "Malware payload (RemcosRAT)", "value": "71d1325b9f2890a8b5930e9cb952cb5598b8b796", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015432, "uuid": "b9f1a63c-ca95-49ab-b6d3-147308be7c22", "comment": "Malware payload (RemcosRAT)", "value": "224292525b9dac3e4a758a406b7b3a5eff0df54363469ebf39d07ed738c7319c264515e345fde49b69482f3767639b31", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015432, "uuid": "68343b64-30c9-45f2-8e2f-e15c37fae95e", "value": "T1AC052310FAD2EE63C6D36AB079D947C9032FFCC5864E889F7121732E753179685E902A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015432, "uuid": "e0be1b54-6b6f-450d-92a8-655ad7717bcd", "value": "24576:eofwI/77dwXG/59nFaG4L0wf5VPkI8YvF:eofwIj7mEnFaGi5j8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015432, "uuid": "93f54b6e-d0b2-46d5-a12b-b2d3725042d2", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015432, "uuid": "659909cc-41e0-4068-b2bd-303f3072968b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015432, "uuid": "49dbeca4-2367-4476-a799-bb3dca968906", "value": "402933-GENEVA .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577c2f5c-7f6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784024731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024731, "uuid": "b9c70140-97da-487c-9758-a9db2cebd4b3", "comment": "Malware payload", "value": "a10466b6a444ccd6c661ab10fde34057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024731, "uuid": "97157aee-41a0-4400-bf08-c9393721d49d", "comment": "Malware payload", "value": "a5516a25bc40eb74359b74dccbf7309ffdc173c4a2d44a47f09d62da45f566c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024731, "uuid": "8d328beb-d53e-4b86-9263-0ec440749974", "comment": "Malware payload", "value": "e78d7cdf5a4f1e0a1a22978dc4c60dca15d9910f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024731, "uuid": "1e48311c-e3c7-4a4b-80aa-9a58f45dd2b7", "comment": "Malware payload", "value": "3758a19280805d07a43c3868baf79b0a8c60b33dbe1c8ae4253dedf373032c54fc11db868af1de1060d91d010cc3e029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024731, "uuid": "ac2e2003-6e64-4494-b1cc-0d473587703e", "value": "T140E4BF15174C7E0BE59E6A37C4F2600D27B5A0B5E9C3CB472444AB2D1FD1391AE32BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024731, "uuid": "6370e6cb-fe33-47e2-84d1-fc902a31f5e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024731, "uuid": "146e9e1f-20c6-4dd4-9e27-32754d89d20f", "value": "12288:iHa/ZH+1f2JhnRGO1PKtv6oYKXCbBr5/mBS9APHd59HozPHa/:wjZuhR9K1XCjqPd59Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024731, "uuid": "f2db8ad8-aa71-4755-b6da-0e5f07831e6b", "value": 713104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024731, "uuid": "62a135e4-9af2-4ffd-958d-875cf4e41295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024731, "uuid": "02ec9134-a270-45ee-8f9d-07cf4a645993", "value": "logs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c38c9ce-7fb4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784054858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054858, "uuid": "51ab0a49-4574-44c4-8fbe-7687b7fc6df2", "comment": "Malware payload (Mirai)", "value": "df47360d432c296430b91f529a2ee196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054858, "uuid": "b1b20afb-0fc7-4111-89c8-1c91ad73453b", "comment": "Malware payload (Mirai)", "value": "a56d15cde8dae3826dada7044ba5e8bac63cc473fe1de9efc0faee7099967114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054858, "uuid": "53d3af94-548a-4db7-a760-f8b839f396c4", "comment": "Malware payload (Mirai)", "value": "85bef37dc93f36689036a8517a3e849be94f0f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054858, "uuid": "a346b4f2-00af-4297-bfdf-bbd464927e60", "comment": "Malware payload (Mirai)", "value": "d53ee95946bc1a9df90b455b3bda172fe84c3ae60f5656ee16f6838b3d3d782c16feb71de1446d2cac99982f349eaf54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054858, "uuid": "89e3dee1-7b8d-4397-be70-b234a760a141", "value": "T1B7930845FD829F01D9C916BBFE1E018D335367A8E3EE71129D206F2177CA61B0A7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054858, "uuid": "ae13d9d3-980c-493f-9b45-41ff0564cfec", "value": "1536:WFnfLrTz4qSMMVeENtvjAtQnHF2JoTaDTRakMFASkpdX9l0WiGM3nTH6Y7BlTHwq:mLrf4qSMMVeiUtQ4J1DtakMFASkYuM3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784054858, "uuid": "31d9ecca-d850-489e-991f-b62075a42bb5", "value": 94272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784054858, "uuid": "f8cafa8d-f77f-4481-ab0f-29522940940c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054858, "uuid": "158d567b-9a89-41c3-8d47-815cebd5c0f8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41553691-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009232, "uuid": "a37ed5d0-a46b-476f-a3ff-ea746155119b", "comment": "Malware payload", "value": "0220c52b91a20d3a9324f50f53a8d603", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009232, "uuid": "5ca610da-0603-4911-9b13-40ecd8846ac0", "comment": "Malware payload", "value": "a5b28d301bd025dbf4c4815c412749650bd07ebf6cdf8a4e6406260da8d6c0e4", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009232, "uuid": "5c681f88-1731-4419-b549-9dac51e5c039", "comment": "Malware payload", "value": "deb5482f7f16b9ec51a2e9827afd7ccd0b939a02", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009232, "uuid": "1f56ef8c-49c6-4a23-a490-e62fb67b44d2", "comment": "Malware payload", "value": "02a4be571062a5f274196499bf3ce3ce20f2ee15f7a7309d12256a5612dff49f9eb8fcb59eef8c7e6e8b84e36344da63", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009232, "uuid": "12b06092-b67a-49ba-9f76-13e2128b50a4", "value": "T11C1633CDCAEB6078EC774021C3D91DD193AA00BBEECA4A7F5AC25BD394D4485E027E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009232, "uuid": "d7b989e7-8ec5-4261-ace5-8ff115eaa412", "value": "98304:yK0aBfrzNXrg18sb7bEU8oDvav7azyjiQ6nlaOoP0/jvVLOrn4m:RpzN72lb7bEtpaz20a8vROrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009232, "uuid": "140e8baa-5dbd-43d1-a471-3fe390caa636", "value": 4160943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009232, "uuid": "3af9c72d-120e-42d3-bb9d-5bb6476ffc9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009232, "uuid": "b1e26c34-9dd1-48be-a04d-d98e60992c7a", "value": "a5b28d301bd025dbf4c4815c412749650bd07ebf6cdf8a4e6406260da8d6c0e4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06640f5b-7fdf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784073128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784073128, "uuid": "15974baf-4c41-4fff-b6d6-f020927ad9ee", "comment": "Malware payload", "value": "816713f696a7dd4ab40ad08c76d16591", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784073128, "uuid": "6e0d7410-c9aa-4515-b0b1-9058d57bfd3f", "comment": "Malware payload", "value": "a6b3947c7ad280189c1ea1eb16876759c230aa67daa843b001991ba745cf6054", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784073128, "uuid": "ee2c3830-c882-4c85-ac7d-f0c2639a781b", "comment": "Malware payload", "value": "80b4aaa0b3a5f6b29e600e9e147b2564d432b405", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784073128, "uuid": "457e2a83-544a-4886-927a-36d3ce41a8eb", "comment": "Malware payload", "value": "09817f5e6feaf2adf5acd2d8bc0b51832d02dbb66e31de7be6672d29cc1deaed6916cce3a9aa0f2bd28d8950b4787e63", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784073128, "uuid": "f4f6388a-1594-40e1-a211-1276a7e93a60", "value": "T1A4E6330465E443D6CBB3803D99E224A5E16878760772CDC7DAA843F1AE573E08D3DB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784073128, "uuid": "32f0c9c4-24fc-46f9-bbf8-89f2e632b48a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784073128, "uuid": "a51fb32f-dfa4-4add-8e2e-0f8b5c1d719f", "value": "393216:IEZMZRh//Yf0eDeRYFkr5n0uXMCHWUjX4cuI3/PGTAI:ItZR1QhDjFA5n0uXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784073128, "uuid": "e60aa4e3-29ab-45c3-9be3-854a427fcb82", "value": 14320430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784073128, "uuid": "11941880-a477-4bc0-8339-67781e69c568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784073128, "uuid": "adc88a2c-0334-474d-a3ee-4b5f133f0a47", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317ac178-7fd5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784068906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068906, "uuid": "e42fc245-23af-4809-8f74-f9611f0dc8f9", "comment": "Malware payload (Mirai)", "value": "f02d8836b9916257432ca366aa5507c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068906, "uuid": "708e0727-af5d-44e0-a282-73467a8a1058", "comment": "Malware payload (Mirai)", "value": "a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068906, "uuid": "2cefa23c-6839-43d4-ac6e-dbb8d781e725", "comment": "Malware payload (Mirai)", "value": "f3292e04938ea87ee4b33b6b905a1af7847e2425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784068906, "uuid": "10aa0cf3-49c8-445a-9234-60c68930ca2e", "comment": "Malware payload (Mirai)", "value": "76081360ee893dcaec6ce00390432c2c9dad04828ebc4beb6c8d0992f6aadb97522a04e2c3ab76ef4e692131687cc390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068906, "uuid": "ad774a97-12e7-40be-b282-c87bd051879b", "value": "T15CB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068906, "uuid": "49876c86-9bf5-4c30-901e-9dd61e92b857", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzD8rSR:t3SrlGWnKTU83AQB5A5Liy36fPUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784068906, "uuid": "f2918799-92f9-480b-9299-3ed6eb40aba6", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784068906, "uuid": "8d6634ec-6378-4ba4-810d-1ac626ec24bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784068906, "uuid": "44c12034-fb7f-445b-86e9-607fd9ef9ada", "value": "a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cfbd80-7f30-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783998266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998266, "uuid": "fff2ad1c-cee4-47e3-a064-4242a326b3a4", "comment": "Malware payload (AsyncRAT)", "value": "8a95f70e998254f132b5270c74183bf6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998266, "uuid": "dc9002d9-8ff0-4b06-a0f4-35533b509761", "comment": "Malware payload (AsyncRAT)", "value": "a6ec0a5f8122e29d1e951b907f673da4b481ab5f4a368c5c171433640d53a3a0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998266, "uuid": "f4403653-00dc-4ee7-af21-5d1076901ad5", "comment": "Malware payload (AsyncRAT)", "value": "7f645193d7060e8636e9ef740aceaf914d9717ec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783998266, "uuid": "3902a4e2-fce5-4719-ab54-55568c0e4641", "comment": "Malware payload (AsyncRAT)", "value": "957df191a49b45fa35cb88a78cd303e8c28cdca746f1c734493c7369140ccc875dd846e0fcb47a4b2cdc41838347a09c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998266, "uuid": "b6733f79-41ff-47ae-bd14-9b1deb7defcd", "value": "T167C22B0837E4C571E2FD4ABA8833D6008B75E55B9913D76A6FC890AD2E237CD8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998266, "uuid": "c86e5202-d1ae-4f4b-87fb-8e657a5097c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998266, "uuid": "a6ce5e75-6d07-4c2c-a2da-baa8bf096c2d", "value": "384:yN3SaTSXW9bVWw7HtZARPn9jnH9qbuUsMbQxnCJfJBndnjJ6JKci+:yN3SaT5Lt+zIbIBiBnLci+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783998266, "uuid": "3b3d65c9-98c6-477d-9ff4-2f9e2829ca4c", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783998266, "uuid": "908bfa6b-bb87-4292-b58b-4f7c30d7c68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783998266, "uuid": "814323b5-a1cc-4389-a110-932066bb41c2", "value": "F8BETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b604701-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023932, "uuid": "05a6302a-5013-4d77-8802-73cf6266a555", "comment": "Malware payload (PhantomStealer)", "value": "438bc3b451038ece1a0bc7b72d25072b", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023932, "uuid": "50aa5599-d41c-4e65-9b80-1f1efa34146b", "comment": "Malware payload (PhantomStealer)", "value": "a73d8790694f57c4a027934d43127edde40f46041325457177ec0fb028ddeede", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023932, "uuid": "5d6b98d8-4f94-4327-acbc-d849af0716c1", "comment": "Malware payload (PhantomStealer)", "value": "175af1b88d58fc822be3ddc736f37941b9b11569", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023932, "uuid": "62d7ae92-4c1f-439a-bc63-f229ed2e9311", "comment": "Malware payload (PhantomStealer)", "value": "07e2bdffba18c7485580bd714d02f1930737d495aa11eea45d7019b8d236a4153c394bb564431adf962697a7898ff66e", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023932, "uuid": "90a9287e-52c3-4e18-8932-8aa7bf885957", "value": "T112F61D9D56DA92C5FADBEA0705086AD2059EF42BEFDF435980DC04CF82DFD86C019BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023932, "uuid": "f7396849-6fcf-4d07-95a8-a0714d38450f", "value": "384:RhI+pjEAR3LGodVlxG/qx0m/BS8i/oOGHlMWEZvHkG+Q4i6dCOi5b1HZcPx4UPGY:R4FGQGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023932, "uuid": "47fa1290-5d71-4921-a8f0-b6e93267bc5e", "value": 16149066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023932, "uuid": "3037992d-abff-42bd-8273-b5a179d12a86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023932, "uuid": "d55a5778-5df2-4d3a-8431-4443b982906c", "value": "Fedex_customs_Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe02185-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784024041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024041, "uuid": "8e92e681-362e-4e28-a3f1-4a50b810ca62", "comment": "Malware payload (PureLogsStealer)", "value": "586e644188eff0a088f9263b4a9d6a65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024041, "uuid": "85547900-9564-4853-b762-a17d37e2a1f7", "comment": "Malware payload (PureLogsStealer)", "value": "a88512a75d65766e556d3ef13bda81a0dd08b5468a26b5c58dcf6c875d5e51f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024041, "uuid": "e13fd4e5-7540-4fee-bb80-c714f753d459", "comment": "Malware payload (PureLogsStealer)", "value": "9917dbb7c8e8c0e91144e74235e4ae795f35886a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024041, "uuid": "21add4a6-adaa-4523-8b64-45a1e2be8553", "comment": "Malware payload (PureLogsStealer)", "value": "9f3844425a7caca0ed29ba7d5c0b2cd14e2f0c9be914f077e42d3b7dbea75c4ce9a88392fed8ce378df0df88e443f948", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024041, "uuid": "8ac7eddd-4684-4f44-bb22-45dc2a571ec1", "value": "T1A465CD747CCB3550F77B8E0382ED3AA109E7BBB23F2B04396A9864455757256D8E0E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024041, "uuid": "6ff9d112-3c7b-4301-b1bd-a9b033decb50", "value": "3072:RwnlkOgh3ekt64ozGHl4+KV+EcjjFCMKpBNnVMLQs4aomecqeiHbibnP3tZUjcB:fh3a4ozGHl4TcWPNGdaAbnP3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024041, "uuid": "42c9b3a5-dcc8-45bf-8b05-55cdf1102e11", "value": 1532202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024041, "uuid": "2412ea04-6615-454d-9a66-8f1e73b52141", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024041, "uuid": "d5418f88-1d1f-47b1-893b-a5461f9d5168", "value": "Scan_020020260710_PO_008565.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45592243-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009239, "uuid": "b432cb3a-b514-4fd7-a771-d730db2f64b1", "comment": "Malware payload", "value": "8baac4d9023f0040a785acb70eb2f59d", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009239, "uuid": "003b236e-5205-4a1d-b619-392503ba6d12", "comment": "Malware payload", "value": "a9884164426ebc66918432acf287fa4230fd72d74df82d5422d79c341cb55562", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009239, "uuid": "a2c8e1fd-832f-4105-adf5-90b4db2d9937", "comment": "Malware payload", "value": "920f2ba4b0413e8b3d06cb93261217473113757b", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009239, "uuid": "fd0e2274-f6bb-461f-80df-e1a24876150a", "comment": "Malware payload", "value": "f68575628fe1fe50fd9fa426e5f6dce243167b3218d89849e94fc8274b8f4c04b5b2ebb383b050b0335b8b0e518dda24", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009239, "uuid": "e0f21911-9046-4c55-a88d-d25abef1dfc5", "value": "T1DB7533965BFD410FF08217C89B15AFC31839DA55B10E50AE3354BAEBB392D45DF482B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009239, "uuid": "5289a988-c023-4f54-bde2-944aa5cbce9a", "value": "49152:abbN7E5iOxbvmAtxrHo6vTk+450ekPBBBaZHfz:aV7E4OxrmAtxrI2PbBCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009239, "uuid": "e531281c-c8d8-49de-bdeb-c809a6871140", "value": 1584793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009239, "uuid": "19115485-13a8-464d-a5c7-52628f5737fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009239, "uuid": "e8b47236-6b25-41a3-a6a6-97adf150b68f", "value": "a9884164426ebc66918432acf287fa4230fd72d74df82d5422d79c341cb55562.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7b1708-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784015455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015455, "uuid": "51a7af87-f3f6-403e-9918-40848d37ed84", "comment": "Malware payload (PureLogsStealer)", "value": "dd6152104a7fc1e4f20ad931c93b2d1d", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015455, "uuid": "e8de4faf-da24-4671-9b7a-fb8ee905d1c4", "comment": "Malware payload (PureLogsStealer)", "value": "aa22d6afbe7b428eaa217891f67ba98970a4682ad75db338ace8ea13a7938284", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015455, "uuid": "5fd43b87-1aed-447f-a240-1a776711d012", "comment": "Malware payload (PureLogsStealer)", "value": "8831ef64d4d4c0dd616bd215c22f613bec836b92", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015455, "uuid": "9d15bf8b-c35c-4101-9a63-44fb1c294268", "comment": "Malware payload (PureLogsStealer)", "value": "ba07137423d692993f7774226b0f88d913224e24b8eef201400b2c7278d0c0270b52571fd5e2d309cdd8a8115fb6fb63", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015455, "uuid": "ef8934c2-e80e-482b-af65-316b904073be", "value": "T112252329FFA55787D263843969EAC8D9011CBD840F0AC42F323873587B78BF486E9179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015455, "uuid": "89a764f7-4201-42a9-a20d-c27fa7e18cfe", "value": "24576:VfwI/uEL7C8zX66/KE+SOm+9Rqk2sUHKkSx:VfwIH757BKJ1F9RqwUHKkSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015455, "uuid": "7eef9205-9498-49f8-b90a-d29fde27c4f3", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015455, "uuid": "b7e043db-675e-4d79-b668-849c1023db95", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015455, "uuid": "2cd74b72-b6b8-4faf-8349-bca9ecee2786", "value": "OC_8918007.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f61eea0-7fdc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784072070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072070, "uuid": "6d21bd5e-4daf-433a-9468-0270c773957f", "comment": "Malware payload", "value": "5d6001e6b85de38a6e390f7adc47acea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072070, "uuid": "66bd71ff-d42a-4c16-a52c-b4604b3c2bf5", "comment": "Malware payload", "value": "aa251d0e0ce55abd93ecda85cebafd82ea119f406cb63d9556fdeec1f4a27d1e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072070, "uuid": "9e739dc7-9da7-4cb1-ae2a-fb904b361c70", "comment": "Malware payload", "value": "492bc465439a735ae106697474162364167c572b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072070, "uuid": "1d257236-ff39-4bc2-9780-83cd44d500d0", "comment": "Malware payload", "value": "72b56ccdf5d45ca518757835215610d232c408c70117ea9e2b79cbf061b8f670fcb37318cf73566834b9afe6a5a1748e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072070, "uuid": "abd919a4-e97c-4842-8ad4-109640e46904", "value": "T1D5C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072070, "uuid": "06abd6b2-91a6-4374-b15c-f4946f3f72f1", "value": "768:c8vCB+25j6es8RU9FYpMSUpi+20qUpi+20YQX:c8l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784072070, "uuid": "882e12e0-7123-4e6d-bf3d-bbee59aba12f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784072070, "uuid": "fe0dc6f1-d52a-46cc-ab1c-090858086a9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072070, "uuid": "b31e5486-d652-4c29-a5c0-b3a9e3fb23da", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb71cd2f-7f53-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784013329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013329, "uuid": "b172e787-0382-40c7-9439-b205c1c1868e", "comment": "Malware payload", "value": "6f65461b54117243e0fc8fdb91dd8d2a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013329, "uuid": "69c98294-6aa2-44c5-b3b4-ccefae8b7503", "comment": "Malware payload", "value": "ab58aaef04e0000e5b31c9fa691fdb5daf5d80de3c7a4a426f89eb73fe2b16ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013329, "uuid": "3cff0db9-0357-4802-bc6d-ad38a894a620", "comment": "Malware payload", "value": "6da6f2942d865e345758e912b92392e2ea44477c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013329, "uuid": "02c078a6-16e7-4078-a0cc-0132d1741550", "comment": "Malware payload", "value": "ef35e5353829fbf2f8e51732a3dfd762913f8ca1348f7f8bfd739c2fef91abcd5f515dc7d025a8e3b8e40a6ec3379f5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013329, "uuid": "8450c2e1-aa2a-4e29-819b-08fadb09ebe4", "value": "T17CC27C956A867C44BEC98A3E4CBD2B1D6DF5C3E1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013329, "uuid": "0401d80e-f793-4775-b5d3-0f5653bb7e9d", "value": "768:N8vCB+25j6es8Ry9FYpMSUpi+20qUpi+20YQX:N8l25JUd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013329, "uuid": "fa8b9eb1-205a-4a8f-b9c0-963295af2258", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013329, "uuid": "e34c51c1-a1dd-4951-8330-acf22177ad6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013329, "uuid": "6ee2d928-aad2-4fc8-b434-d69822a42056", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680d0ad7-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022611, "uuid": "b396e487-6fd4-4f98-98dc-a9e0845dc96a", "comment": "Malware payload", "value": "2c8f09a2200e945520a7b36894a4db70", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022611, "uuid": "fdd716fb-6808-4e71-b986-687e25c482f4", "comment": "Malware payload", "value": "ab6d730ada254a2ce116414343776925d758105b29d2003792ec85b84df0c12f", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022611, "uuid": "314f5404-10d8-4f6a-836e-69e8316136eb", "comment": "Malware payload", "value": "1344259ca1f7ed65b0a2dacbfc7a8cb902f055df", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022611, "uuid": "16d4f651-6c94-4300-8988-fd949faabc92", "comment": "Malware payload", "value": "d48440da01e2ab40080e6a4056daf8cb73931f08591b56775a6a3f0f1ba2a64e59ce5ddde06c2efc99eb714a3eb55441", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022611, "uuid": "60407e54-90b8-4777-bc57-9d40046119be", "value": "T120A2C0549B04D423CBB46872B5778E195B0F7EB0E1A7F0536304CB807CE2991B5AD78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022611, "uuid": "a14ed2c4-f741-45c2-a766-7b9e1fb90ae2", "value": "384:ztyifdekA2E/BdOELQOPyXIREiSFbTikd3LmsmdGU57D7kbXMTPpXD6w8qiqe:R38k9WaMjUbTikws3UKb8ThXWhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022611, "uuid": "970da290-770f-4d7c-9e69-a9457f1d106a", "value": 21592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022611, "uuid": "806bfed7-3cf9-4761-9cb9-e6752f3b4a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022611, "uuid": "38476c8c-20ac-4273-9153-1fa217e8a1cc", "value": "ab6d730ada254a2ce116414343776925d758105b29d2003792ec85b84df0c12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5508c6e4-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784035894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035894, "uuid": "fba48ed8-4c67-4f37-b5b0-40645ee0d1a5", "comment": "Malware payload (RustyStealer)", "value": "9062fd38a3c4505e53941ca086bc777c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GajendraStealer", "colour": "#9B6F2C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035894, "uuid": "7b151ae8-3569-477c-8089-11a6e64e16cc", "comment": "Malware payload (RustyStealer)", "value": "ab782f75957f3a4e4a398f170f5d41c592d2f8ca135bda12875b994944e78ab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GajendraStealer", "colour": "#9B6F2C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035894, "uuid": "e29482fc-eac8-408c-a3fe-e69cbd733c80", "comment": "Malware payload (RustyStealer)", "value": "da1704cfbae51d5ae66f214596e1462fc8878d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GajendraStealer", "colour": "#9B6F2C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035894, "uuid": "e92c2e50-90b5-4de9-9af0-266190969a18", "comment": "Malware payload (RustyStealer)", "value": "0b4199cb29cae370b6eb783405da591b7fbb58a28ba9e033def7bb3d7066e022049ef05473a42c47de694e57ed50ac98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GajendraStealer", "colour": "#9B6F2C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035894, "uuid": "2f8a76ca-c2e7-444d-9e78-d8dc8300237e", "value": "T158865B11BA5A58ECC05AC47482464A63AA3134DB0B35BAFF45C486783FAAFF55F3C718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035894, "uuid": "7f9c3829-bbbe-4bbb-b757-c93c5c35348a", "value": "0fcd0b0c9f2103055a1bd05bf71f2565", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035894, "uuid": "73dd3a2e-5feb-4869-8652-c8f40736ac9f", "value": "49152:pVZPDexk6G0LmFQvY8aIdRNGPBuDqKrKB6LIooGTlGeU+P3h1MujN4HkbuYAgt9i:LlDewavYJwM749vE595zAoH5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035894, "uuid": "f404f621-622e-4769-93df-6a2966711c70", "value": 7987712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035894, "uuid": "4d9346c3-5631-4092-bdff-ab3e7675437f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035894, "uuid": "40125c69-21d9-4aa7-9dbe-7f90230a94dc", "value": "ab782f75957f3a4e4a398f170f5d41c592d2f8ca135bda12875b994944e78ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41c869e-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784023679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023679, "uuid": "8f4fc71a-3ce2-4dd2-b698-6ef7424e511f", "comment": "Malware payload (PureLogsStealer)", "value": "510dfb0a16748d793a7b2dceddc172e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023679, "uuid": "d41ff106-b778-42b2-8e39-8063a61a735f", "comment": "Malware payload (PureLogsStealer)", "value": "ab7936c15b85360fea0e6dd54939781843f1c9e42d9d7a63e9570e2cd5e56919", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023679, "uuid": "a26d203c-7827-487f-b886-ef304182b530", "comment": "Malware payload (PureLogsStealer)", "value": "045d6ac124d3fef2324ae45fe6ddf48185105b73", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023679, "uuid": "6803f971-4311-455f-b395-286f35983952", "comment": "Malware payload (PureLogsStealer)", "value": "63fa195f3d52c9e8d6ec7d2c4430f0003c8c2ded345015514577fee6dd24b7ac157f089575e3068dda3cfad03035557f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023679, "uuid": "0d5e315f-b58d-4a7d-9b03-c18edf718817", "value": "T19E46394657A462723321EBCD873ADE75D50E900329D9CF54329ED629382CE4BE358BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023679, "uuid": "c8da3ae3-2fd5-4a5f-9c80-789e76bbce89", "value": "98304:yKguj5CtU3QSPWxAnu7bKLl+MYjjkJaBrY1bhTJSB5J1qF7i5m9+cl9RAl09SjzT:yM9IzhAnObKLl+MYjjkJaBrY1bhVSB5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023679, "uuid": "ecbfd46a-4358-4e6d-831a-81f775542d60", "value": 5359871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023679, "uuid": "19f36c7d-1b16-493d-b1e3-b47ef0ae706e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023679, "uuid": "ae3d83da-2772-4469-a4a4-4de100baeb5d", "value": "seethebestthings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6004dfac-7fb7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784056099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056099, "uuid": "ab99528a-e5e9-424e-8526-fedead2489ef", "comment": "Malware payload (RemusStealer)", "value": "65b3365e8f4250c573db411546d878ad", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056099, "uuid": "441c99cf-8937-4103-a459-8c246b155de3", "comment": "Malware payload (RemusStealer)", "value": "abc81d4d4b22d8388e829f3fedeb35cb3d3a7e50a108ba1ac779161b21a5bad3", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056099, "uuid": "0c675e6a-50fd-4ba7-ab8a-0b49d45fb685", "comment": "Malware payload (RemusStealer)", "value": "58d9a67598361da6ecd4815ced630fd59d6998e3", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784056099, "uuid": "eb47f97a-1447-46f1-b6b7-32c49a5b7643", "comment": "Malware payload (RemusStealer)", "value": "7ac96e66ca56f7417927d186594c57ff9f0fc9b1cb6a15735c17959623f7f9385d352532271bb18e45d550c65875440d", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056099, "uuid": "8ca5b2bd-d0e2-4254-91c6-4d3f165f33ab", "value": "T14D665C0BFDB50ADBC0BAF13444637216BE613D0086226F675AD4F7741F337616A9AB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056099, "uuid": "a19bf3f2-af2f-4d31-a14b-0a9eca32c293", "value": "a3e81ef42267088b67ef184fb27eec81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056099, "uuid": "f20caf84-1d81-4a7b-9543-15334c56c316", "value": "49152:hfKgQhEHqNuTwGtzenlakWtfmrEQSJtqK1RTVp1bD9vMJgFU+a08CVbxWEhtUO9n:SMqQ0EzlbBvGo8kLLeffs43a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784056099, "uuid": "71c315e3-7ba2-4c48-afbe-4eae335a0156", "value": 6633296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784056099, "uuid": "42bfcee1-732b-475a-860e-a5035e99e42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784056099, "uuid": "2be16c0c-d83a-4c67-819f-e2453b3bfa2d", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79423feb-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022211, "uuid": "144a5ab5-121a-49c7-bf13-7d425ac97e1d", "comment": "Malware payload (AgentTesla)", "value": "4c1c2d0599f03f5484ed68cdf4c7d456", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022211, "uuid": "b5651f3e-867d-4a46-a431-668794611bf8", "comment": "Malware payload (AgentTesla)", "value": "acb79df7ee7ccb16e1cc5cb55d0eaf42ab05c82311b43d5d141fd1a8613e1ff9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022211, "uuid": "24ccc6c6-df60-496f-979e-44113f917bd4", "comment": "Malware payload (AgentTesla)", "value": "e3c227744dbe64290b2d9ecc62f60a87217b665a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022211, "uuid": "1fa8d3db-8d4f-4256-9761-9185ee26212e", "comment": "Malware payload (AgentTesla)", "value": "3d4903b24484de9072961504155b5439d2149639be38b9d15883f295cc3ae3df99a8e1cf8ed82ac509f790a2d1badbb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022211, "uuid": "25025222-4818-4ce1-943d-9b18ff781f84", "value": "T12D46A7439755D132BB8397EEE7379840A81DA2F13D99CF39380EE6207618C5B62F91B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022211, "uuid": "4b53017a-790d-4a09-a5f2-bf71f91ff8bc", "value": "98304:WwKX49+gXhd5rqWVDwViqEPJkEnAFHebJsDzr1HU2CPG0QhiXfmpecMMya7:N+g75rFDwgqqPa+bJsDzrObPlS+fMdM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022211, "uuid": "ca14512a-3292-424c-841c-5aacbce7f06b", "value": 5840705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022211, "uuid": "a2e030b5-8486-4399-9c49-02973660eae5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022211, "uuid": "81af2dac-65e8-420a-8081-6536313f1afd", "value": "RFQ \u2013 Angebotsanfrage und Proforma-Rechnung f\u00fcr die beigef\u00fcgten Produkte.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb97a62f-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784015450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015450, "uuid": "2361fa1c-ec76-4ee1-a2b2-d5448e207b5b", "comment": "Malware payload (PureLogsStealer)", "value": "270e9e153900db30a154432c2c1ac718", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015450, "uuid": "b088aeb0-2e77-4884-a225-87e6b8d0dec5", "comment": "Malware payload (PureLogsStealer)", "value": "acc3c30b719a76092ce0fde7c73cd628909f72668e1b36294a7cacdbea4e5391", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015450, "uuid": "f4a0e487-d368-4d66-a9cf-86572ded0db6", "comment": "Malware payload (PureLogsStealer)", "value": "5198b2dde70d424b2d04eb55867ede78e824e11b", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015450, "uuid": "e9f95b32-771a-4446-85d3-492b1db96666", "comment": "Malware payload (PureLogsStealer)", "value": "acd3c11476dd1d912e40f5fa862541ad5471119e03df27bd408de2c67431bd757d90e5bf244d85f260fb1c6a293b0cf9", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015450, "uuid": "4a0ad4d2-63ee-469a-a6a8-5fc341d8c127", "value": "T1A4252328FEE09333D1B684349ACCCD9B125CED197B07816B31B9F30D29706B856EB599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015450, "uuid": "007e88db-5cfa-43d2-8802-2514ad0c4a71", "value": "24576:bfwI/uySsIFiLLflEBputK1zKRlKUsw3u6jnVaS0qbp:bfwIRxOo8xqljsAPjneqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015450, "uuid": "b1b67ca0-3240-497c-a7fd-ce9800480fa9", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015450, "uuid": "3ec52cc0-30da-451a-ab9e-fd52d27ab047", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015450, "uuid": "5eb64add-a28f-42a2-8121-834e9fd9c417", "value": "BRIVIO_PAGET_CA_Oferta_09-07.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185d68ba-7f19-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783988118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988118, "uuid": "6dd422c0-2255-4429-81b3-daad444fdea5", "comment": "Malware payload", "value": "4e460df77f903c9e6c4bf24171597cfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988118, "uuid": "0610537e-237f-4182-8b2c-0642bbbf4260", "comment": "Malware payload", "value": "ada0d9426190134f8a1829a16b1a001d781a5ad656042d43cff7fd082c771ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988118, "uuid": "6be32039-08c6-48cf-82d1-55481d35d4f8", "comment": "Malware payload", "value": "eb6a4b330c18b80c9559baf4dc5f451226361608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783988118, "uuid": "1f5f080e-0b72-42c0-9817-e4e28dc81e18", "comment": "Malware payload", "value": "28fa9a3911812db32fa4cb359e0bf425fb299e2f849801018882706cb7b1ad2fc571d6e97a08ee00b65d4842806204d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988118, "uuid": "93494f94-f73d-4bf7-a9dd-b830a4da0e9e", "value": "T1B3C312970247977ACE00B4317C0A6840E56B68BEA6AD4BA50D5153FCCC57CC7EBAD253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988118, "uuid": "15131872-737e-45b4-b894-61c6edd2d541", "value": "3072:yA+E5VsLyQM95fo7eCwAPxFUq+2AwjhYSnI7empNCVP/r9/0:t+E39VoSCDEdxBCVP/Z/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783988118, "uuid": "9c1f338d-625e-4c3d-be31-390bb8875e9d", "value": 120280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783988118, "uuid": "5ab679e7-c75a-4b08-94cf-2d4a52cb6511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783988118, "uuid": "cc86ca46-5fca-4b48-a7dc-ce0e1dcf3840", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ccf30f-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784012119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012119, "uuid": "6423fc4c-d8f0-465b-803f-a3f97c9c31ff", "comment": "Malware payload (RemcosRAT)", "value": "bb80b31e43893a35fabbdca00c3fd55e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012119, "uuid": "bb3a9e2b-3141-439e-9de0-000804abfb14", "comment": "Malware payload (RemcosRAT)", "value": "ae1a58b73c14de3d0d4af02ac0c136a4e804ed1a911de386fa40208672611309", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012119, "uuid": "66f9e374-93e7-4f16-8dfb-9fed0646b806", "comment": "Malware payload (RemcosRAT)", "value": "ea709516603279a6513ab58ae93ce220f0f0210e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012119, "uuid": "1b395837-54c9-4ad2-b7a9-83ec09feb90b", "comment": "Malware payload (RemcosRAT)", "value": "1628251640f801f8314882b1538a7c4344ee2ce4b043dd636a8806cc16f3545c4613152cdcd3e37be325ae79226d3dd7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012119, "uuid": "048a9ff3-a4c2-4710-bb56-5e38b37a7ead", "value": "T157452208725AD60BC92227391E70F2B927BF1DE9B811D2169FDDFCCB7A62B459C041D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012119, "uuid": "c4acbd2f-17b1-4164-8336-f626507b2537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012119, "uuid": "52aae37a-db6f-415f-bdcd-3cc0840ac1a3", "value": "24576:6xN6pbVwFbESb7mw/7T5Xald1sWNUcuNJPEfL0I++XpUXLlqhF:D1VcbxPms7TJqsWV8dEwW5U7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012119, "uuid": "be68fdda-b255-4122-9283-8e767fbe32cc", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012119, "uuid": "9a8bd92c-1771-43bc-b1d4-47e90471b94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012119, "uuid": "9a7a34df-a985-405e-86a2-e4097234475f", "value": "TaxInvoiceMH1252.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb58b12-7f85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034643, "uuid": "525386a1-c879-4114-8371-be0cdc82ff04", "comment": "Malware payload (Mirai)", "value": "04a30b22aa02b89d3e6d4fec633a695a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034643, "uuid": "58f32d27-ffd8-424d-83b7-efb749d43c28", "comment": "Malware payload (Mirai)", "value": "ae3e605632958c050c98cb42fd155a9fccf0f3eecab449eb32323f15344be9d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034643, "uuid": "7a58c482-7994-446c-8c31-5c99cd205040", "comment": "Malware payload (Mirai)", "value": "1facaa3a203b8f710da05de893081a9b59dd7f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034643, "uuid": "08d1910e-c624-4063-bb4c-4e0566eb45a1", "comment": "Malware payload (Mirai)", "value": "7f1b8dbbfc947980f98d58a9b0d9b9e09ab83accf8d4664158a83c4ddd5c2265762326e0f6d482b0252b5237827f059a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034643, "uuid": "95ac4f17-440c-4725-b930-1481246cff67", "value": "T1B6D3078AF8819F21C4D612BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034643, "uuid": "3c0e7249-ac5c-47af-91c1-b4d07d30814a", "value": "3072:0No38XVcHvqaXd4+lR4uAvjsdMXCuNSaQSXYCmNjIbGtkKJp9qZnbWK:0No38WPtXy+lOuWsi3NSaQSXYCmVIxKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034643, "uuid": "a396394d-e3f5-4d3a-99a6-2bb62df3448a", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034643, "uuid": "0fc8c521-062c-4356-892f-08fab846c287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034643, "uuid": "ec562233-a690-49da-a43d-62763ba51efb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7be5045-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784024007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024007, "uuid": "3abd2397-ceec-4b8f-bff7-506c9164a4e8", "comment": "Malware payload (RemcosRAT)", "value": "9f78b1cd79f3f4227724d1419be7c82e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024007, "uuid": "f4e8af60-c7c3-4831-bf69-561467b50c49", "comment": "Malware payload (RemcosRAT)", "value": "ae41ff70e01087351812394f34575d4f5debac0e76888c16ebaf1c3ed7267bd6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024007, "uuid": "a65e25df-acc8-4249-9e02-d9c150250f33", "comment": "Malware payload (RemcosRAT)", "value": "d436fde67254b80e5705db28485975e52312d2f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024007, "uuid": "4d8698ec-e80c-4d67-b857-2906e12c4d05", "comment": "Malware payload (RemcosRAT)", "value": "e1d6e14d85229be8d1a04732c996515c1a59f3d6dc72344b530159f11ffc62a980a85dc595a92d363e9115450acaf1c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024007, "uuid": "8933731b-2c3b-4db2-9401-bf3e988a4750", "value": "T16EA34A30DE5146770F83AB88FDA50661C67DC325863A04B1FAD98B0D85099ECF77C6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024007, "uuid": "71f8fb42-1493-4a91-9a9f-ed6d5614822f", "value": "3072:gWclhmmFp8/th0NTGQQbuPB4W7SOgob9uT4Kbr5qg:e0m8VctQUmW75b9cVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024007, "uuid": "5ef85651-6048-4e5f-a0f5-327c9c5d06cb", "value": 103214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024007, "uuid": "18bb8066-8fb8-4dca-a6ee-1554c693b89a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024007, "uuid": "839b6ff7-7fcd-4f49-9817-58fa01ab4a49", "value": "Sardelle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115a9259-7f64-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784020318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020318, "uuid": "6028c02e-ad8e-42d3-8683-58d5a4990303", "comment": "Malware payload (RemcosRAT)", "value": "a8bdcda3932ea297c0055cdd5b80583c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020318, "uuid": "13192efa-94f8-433c-bc58-58c7d4f8bb58", "comment": "Malware payload (RemcosRAT)", "value": "ae593f0773938ade4a4dfdd2f49d47b66482cd4090f269ef39549f12a90ee80c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020318, "uuid": "88f2560b-f6ee-4067-a15f-3d95a0ef6e2f", "comment": "Malware payload (RemcosRAT)", "value": "bd5ad3b7cdad6da71663f37199cf286c1fef4559", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020318, "uuid": "624c334f-3382-43e2-a8e3-6b8ed761ba51", "comment": "Malware payload (RemcosRAT)", "value": "772f7b25c3761236e6e857f2bcdb1388799445f8446a32db7839fc0ba9c8214ff2a05a239cfc5701ad0635515ad3e6bc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020318, "uuid": "a6b8bcd2-1c58-4a11-b7db-91902da37a73", "value": "T1EE031A7F69B4B40DE6EDA279063453081EC450F922B99289351FC2D317B9ADF3C91768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020318, "uuid": "791cd232-bbd3-4b1b-8adf-2f7dd9b8cfa6", "value": "192:rjg6SHASX9yjRJS1Ntjpjcj8jMj7ajUjdNjkjWjK9vkxX9:rjg6QAY9yjRJqNits9vkxX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020318, "uuid": "0347301b-1f9d-4ef0-baec-d13dd1d3ebf7", "value": 38169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020318, "uuid": "7ea67b78-a8e7-4112-b756-7a1d46c16868", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020318, "uuid": "21b8aef2-abed-4d8d-81fd-364e3dc4c0cb", "value": "wegivingsomethingbiggerthingswithmebetterforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce496673-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015481, "uuid": "8c247438-abf7-43ec-9060-8aac52815311", "comment": "Malware payload", "value": "278f589e843ae329a2206f74f92f9485", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015481, "uuid": "6194d68e-9295-479a-be7e-f8c8011690c3", "comment": "Malware payload", "value": "af4ba8a010dfa75131e0b57fd00d63ecf9dc954a3c1124cea1c5fc18b848b2ad", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015481, "uuid": "9d65cf18-99b9-4b02-9f55-15a9f43664f9", "comment": "Malware payload", "value": "e44762c5606f6b2211793aae135ad785f45d5598", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015481, "uuid": "b582b6a8-9f7d-469d-9333-dfcc87db88cb", "comment": "Malware payload", "value": "7783978ef453eb2f8a2bbf518e702ae1ad0176d2a1a2cb7582e66f398feb9767357f8b03e924dcd17edd790c0aa9acc5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015481, "uuid": "42611fbe-ef9d-45f7-8a93-01a5311c9587", "value": "T1C5F51212FEA92735039CCAE9094BB1270960BF49964A1DF5F9B1BDC2E1775F6824F038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015481, "uuid": "480ad909-5651-45c9-bf77-00aee49303b0", "value": "49152:8EkRrESgTcsd3R3gB0ofB7YXHWdj978Y5TNUf:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015481, "uuid": "2b06ab17-6380-41d9-9d06-513f1d542d92", "value": 3335984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015481, "uuid": "6bc19259-e03b-49b6-b35f-97546ea9fccd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015481, "uuid": "f6f9c92b-0fbc-44e8-9fb9-cfe32e08eb2c", "value": "envifa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd38f68c-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784022754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022754, "uuid": "b461577f-3986-454f-acf9-50e2a6302194", "comment": "Malware payload (SnakeKeylogger)", "value": "4460382b75123be4beb269d95034c5c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022754, "uuid": "e123aa92-0ec9-441c-b41c-668b8210f387", "comment": "Malware payload (SnakeKeylogger)", "value": "b290a3177beadf9ec47f90f3aff8aa25bd4424bfdb31452102a9c3e47e3ed229", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022754, "uuid": "af23f209-7a99-4e0b-9490-73a2ce8d8369", "comment": "Malware payload (SnakeKeylogger)", "value": "c9cb1666a8f943369bac12e94e2c95fe4ffbff95", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022754, "uuid": "3a89a98d-d22e-4fc1-bc80-aa20a33a8df6", "comment": "Malware payload (SnakeKeylogger)", "value": "ee28ad167b88ecbe80eab064c6f594632a5d4b9a6324b373924e66f5d963a9e855602bc6b3b8d70d665bbc1b4306206a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022754, "uuid": "bdad6df1-8881-4e1f-b523-3de1938bec19", "value": "T1A425F1144FC46F6E8BAD0A16D03F565EF3E286CD146ABCCADB23BD056BB67009263075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022754, "uuid": "faf12f76-7afc-4779-a4a7-efa8fc5a56e3", "value": "12288:qSbfbXZQ8rl39bN+1tLxAUiSKtWLsK2DxPPZ7Qn6pFBhGaKs+q852VqC8tP1MRx+:f7ZNcSt0+bQqGaYh54v8tC7MKsdE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022754, "uuid": "6f137030-6206-4d54-8f8a-f37d983a361b", "value": 1009962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022754, "uuid": "0541df6c-6dfb-4f72-be17-1daf8361b704", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022754, "uuid": "022db799-ef37-4085-9ecb-d7e8ef63c859", "value": "VESSEL PARTICULARS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04d8584-7fc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784062327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062327, "uuid": "93c454fd-a468-4f4f-a772-f5dd0d464ece", "comment": "Malware payload (Efimer)", "value": "65e8d25b6125d17596b8c53c4563cd6c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062327, "uuid": "a793211b-6c5c-450d-9edc-9b22263966b0", "comment": "Malware payload (Efimer)", "value": "b36510313521bd52a5eca4b3c7c3a829383883537472361d936c74ef2f42f1a0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062327, "uuid": "ad3619c4-d9cc-4149-b6da-6a64da25fa88", "comment": "Malware payload (Efimer)", "value": "18107d8159254a1668bb06ef5f0faccdafe27f62", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062327, "uuid": "56895933-11ef-404c-b0cf-8d01236ef92d", "comment": "Malware payload (Efimer)", "value": "c927675644be4e3920f4533b4bedb9740a4da3995db592af86691eec66de4745a07ae7f7338e207260717340b8d5b8ee", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062327, "uuid": "1d4f47d0-d104-4155-aa91-b0aa103f11e8", "value": "T17EE6331D3BE402EDEAA7913CDB919656F565B03A4731C0CF027893A67FAB1E08D3D246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062327, "uuid": "71d948f4-f211-4268-a7ec-52f165136bc4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062327, "uuid": "bbe99647-8ed3-4e6c-b902-02bca01cd55b", "value": "393216:5NknB89bvRDqeXMCHWUjXacuI3/PGTAI:5+BGjRDqeXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062327, "uuid": "94864736-a130-4d26-b672-6da8ab20f617", "value": 14299157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062327, "uuid": "8cd25073-e3c6-4d9a-8507-cd816c309a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062327, "uuid": "c688865b-8f53-46c7-a41c-476d23fe77db", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c1907-7f9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784043499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043499, "uuid": "b364c9b8-68af-4827-b26d-735d6ef8f928", "comment": "Malware payload (PureLogsStealer)", "value": "773dda7eb9d848d9a3491ec2b61a9f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043499, "uuid": "27ec791a-6583-4d9e-8b65-937c14f5e6f2", "comment": "Malware payload (PureLogsStealer)", "value": "b366811f3f74717395eddf884e59b329cf192d2a310cf47deadbf4102ef71e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043499, "uuid": "4a4e36a8-8b12-4f2b-a002-b1febbff338b", "comment": "Malware payload (PureLogsStealer)", "value": "b6b659b8e152bb1f8d9fc954b68b4542fe256530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043499, "uuid": "aa1397f5-940b-4acc-ba12-0a3cfeca41c7", "comment": "Malware payload (PureLogsStealer)", "value": "73123ffe02154ede37676e1e1537f9d136bb2781d346c14eae81cc8a6220d73f290c6af37ac7ebdfa5c5b4a256df45f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043499, "uuid": "5dc5bdd2-f81b-4d93-888f-9b523cdce203", "value": "T1AD05BE3B32A18F25C1864373C1C3590197AA8A4B36EBEB0B35C513D619467FEDE4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043499, "uuid": "ae5785d5-f480-4cda-ba8c-83b2951d4997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043499, "uuid": "975cacfd-8201-49ce-90ee-f853ba091ef2", "value": "12288:AdbczmATrCby9KwYzPo9SgCEix/QAh3TgN+18ehFlP9HR2IVY5xd:Us+by9VYoRCEi9ddTgcKedP91yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784043499, "uuid": "41134069-6187-4ec9-aba9-7c5c59367faf", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784043499, "uuid": "cbf8ef4c-44c6-4cdd-928a-ea56712b546e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043499, "uuid": "1aeb9b23-dbf7-4323-91c0-971283d9039d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.18549979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2073a3fb-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "de620c99-c296-495e-92fb-1cee5d055d36", "comment": "Malware payload (Mirai)", "value": "229fa23ec3059c675b599c6eacc13bc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "0439ee48-7bf6-463b-92af-021dc790dcde", "comment": "Malware payload (Mirai)", "value": "b3cc3627542bff9eba8db31986e1ea867b72a7417b45fac6e7ff6c9369bbb00a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "1c718d9c-5b5b-4941-890f-3f4f7ab2ea02", "comment": "Malware payload (Mirai)", "value": "41fbb3d77db09d518f63613b531e788e3e3ff5d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012183, "uuid": "f739be16-4eaa-4bd2-9a2c-0596b1fce624", "comment": "Malware payload (Mirai)", "value": "366b07e16f295196864827dbb78b4bde3b3c2be992d7cb3d807f8013e7caafae8ffb991f7273bf3a600d39759074db6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "6424dbd6-6b3a-47e8-a44a-40e92ed5dc43", "value": "T10603E0F39176C2B9D15255B06E7610F4B637E8D92F325B73026E39FE88D7DA06012B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "058a0f3b-06cc-4479-95ff-56a8a3db4e29", "value": "768:gUeuV9Uc+jflBL4cOkVPvKKYdkdgG6P9TJI8grig1x0K3:gGLl0flBL4HYbYdk6nMr5P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012183, "uuid": "d3b2ffa3-cdc3-4519-8570-ef06544e598e", "value": 37948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012183, "uuid": "a1de657d-f748-477a-aff3-63d2dbc67d7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012183, "uuid": "d178aa5d-3e16-4b85-8d3e-0facc626c741", "value": "zombie.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31f2049-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015409, "uuid": "1cc49dd5-1112-4506-8f9f-90fe8690b571", "comment": "Malware payload (RemcosRAT)", "value": "3e940bc62cf79df31df03b78b78ef65d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015409, "uuid": "ee5b5db5-ed2c-4a0b-9875-c82597132b52", "comment": "Malware payload (RemcosRAT)", "value": "b4245035f67513a64a197c4168ca5468ec5ec16e903700780e94e7cfb24e10ba", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015409, "uuid": "b1f7f2ac-aee1-4b7d-9bbd-675d07a7ca36", "comment": "Malware payload (RemcosRAT)", "value": "28ae0186dda6b9241a3a3c146aa8cf5bb08d3a38", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015409, "uuid": "bfaf505f-95b4-464d-893c-1e2a61a17c87", "comment": "Malware payload (RemcosRAT)", "value": "7bd3dad39209393d7620ee492073a00a32345927d69ed5053b025a690b970c28e713667e4ab02f70fb196b89c223e7fb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015409, "uuid": "c3285761-2250-4c87-bf36-a3f699f76f35", "value": "T1F8052391FAF7DB6BC1937970AC945CC9022FEC99962AC68F3120B33E64317E490DE415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015409, "uuid": "25ca6232-5c18-4df6-ac7c-d8a45a864056", "value": "24576:WofwI/77dWXG/59nFaGXcDaU/heSuSJBPDuT:WofwIj7UEnFaGM+UwRSJBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015409, "uuid": "f5632f8e-0ce1-4eff-bad0-c898da4b141e", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015409, "uuid": "1f24066b-def6-482e-8935-fdf0cc8383e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015409, "uuid": "7aa270ca-248e-47a8-b525-b11d522bcbb9", "value": "Details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c480206-7f56-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784014351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014351, "uuid": "171ad8a5-b3a0-48b9-912a-3438b50d22cd", "comment": "Malware payload (Mirai)", "value": "0b980fe13f76c70f5f35ff9eb51cb476", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014351, "uuid": "6ee59ebf-32ce-4c4d-bc51-2a3a5497fc7c", "comment": "Malware payload (Mirai)", "value": "b46e0f56ac76e1b12f03fd1e13fa3f61acfd40e974f5aa031c969aec6a6309e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014351, "uuid": "c1cbf484-9141-4f44-b923-a13ac42d6c18", "comment": "Malware payload (Mirai)", "value": "7f130c9bbf06d9d00eb3e871d49c93eb66b99f70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014351, "uuid": "33dc5ab5-5f62-47de-9cda-7b07ab89f292", "comment": "Malware payload (Mirai)", "value": "4f1bd7ad903e52aa96bcfa4ae17d274b38d6b4014b5670f0418a59cbc754122997d2b0ba3a3b0115983672d769d76f33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014351, "uuid": "3ff0a3e8-869c-47db-b54b-4ac8f1031896", "value": "T1F351C6F8A9A397F39FD9CF4460615A19B40BAAC634B28EDC9C9E34F495BC484F830516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014351, "uuid": "b2551c6d-9922-43a3-b01a-c0365ed914cc", "value": "24:r05pELMk0aC5EMy0MBswdA3jKXRCxx3V+o7TgHqgH2vJFKXVHIKRJ55DfCizIKXH:rMpzaC5663jK9HVH2LOKTBLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014351, "uuid": "fea2caf2-d1a4-4a91-8409-7c33bb295bc0", "value": 2768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014351, "uuid": "1a9f32db-ad74-4c0c-8dbe-f1242f8ece2e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014351, "uuid": "9e5375f0-7211-48ae-b160-c604914117c2", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5708560d-7f55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784013993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013993, "uuid": "da4ab209-9d40-4000-b660-ec44bb1d0e8b", "comment": "Malware payload (Mirai)", "value": "1d0ac6be287144b0bc70f4e2841ae545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013993, "uuid": "89e00c70-6678-4fb4-9166-5c70eaf2612a", "comment": "Malware payload (Mirai)", "value": "b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013993, "uuid": "04cccdc4-3e1d-41d6-8f1f-9f892932a00b", "comment": "Malware payload (Mirai)", "value": "2362a74c3fa54980ab322373f6f0bba139240a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013993, "uuid": "7d72ce9d-105a-49f2-8a37-4fdc9250be17", "comment": "Malware payload (Mirai)", "value": "9b568b4551f8ff85606dfe51f28da18c25aef769460dbaa99c3d11bebb40a85cd4c4e54158e32dd2ea38eeaa44a198b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013993, "uuid": "104bee63-0b9c-469b-9260-67d085a6bd4d", "value": "T1E4B3A61A7E219F7EF36CC2384BB74E25935823D627E1D6C5E25CD9001E6438DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013993, "uuid": "6e21b7e8-604a-4cc1-9185-46b8b05c5fa0", "value": "3072:HCZSGLt5205MWFx7ZyW//38r1FEz657R6dLl8wyZ:HCZSGLWWFx7Z73MEz65FYMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013993, "uuid": "d40ae544-9c65-4753-ae62-9c78ecc8b84b", "value": 109488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013993, "uuid": "efb6e0be-f769-40a1-a009-17654af6ce64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013993, "uuid": "c0ceb87c-f478-4cb7-8b93-5ae85aa3e1ac", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea773bb-7f22-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783992101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992101, "uuid": "8b68a1d3-87c8-44c0-9c1c-8a3beb797097", "comment": "Malware payload (Vidar)", "value": "124dd264fb05821fcbbcaba2b4b30a0e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992101, "uuid": "4d38a6b8-28ca-4945-bf0a-52d33ae12c3f", "comment": "Malware payload (Vidar)", "value": "b59d2b3abdd4ddba0f35d200324f1fd55998b76f55e1692c66829b5d49808534", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992101, "uuid": "1bb99c7b-baa6-41b7-9ae3-7a1e5be12691", "comment": "Malware payload (Vidar)", "value": "873c12124d7d95bd232aa3493b84bcc2a87c49d2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783992101, "uuid": "83dab25e-1971-4412-accb-1c445fe869d9", "comment": "Malware payload (Vidar)", "value": "ba49fe6aa45512a99b65707e5d21426c27054f421d27b79954f2a6d89e390c6e98862b1cb387e7102566d38b8c520c0a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992101, "uuid": "d94d3fdc-9a5a-41a8-ba27-14858a5344a3", "value": "T14F953302AEECC4A1CEA096B54CF86467137A3D918EF959873384BDDE3C392D495B0397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992101, "uuid": "dfe0acb3-1287-456a-a5da-6301cddce392", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992101, "uuid": "7af67691-8042-4399-bad0-b79c2a0b8b74", "value": "49152:5vc+/gQBs5fLQpWrs5Ud3bNRYkCwkGRLJa2Qc:By2Wrs5Ud3bEwdL3Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783992101, "uuid": "06f6fcea-afc2-4a05-a08d-d939ee6c6959", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783992101, "uuid": "c0670097-102d-4701-83c5-4e2f40764202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783992101, "uuid": "e2dbbc74-e23c-45db-b8c9-f856115db61a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5271e9-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022622, "uuid": "47d200b2-57f3-446d-95e1-80a16cdcacb6", "comment": "Malware payload", "value": "fcadd402313fa98b4012da4532637f07", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022622, "uuid": "01d53bc2-87fe-4103-8d58-774779caef91", "comment": "Malware payload", "value": "b5afdf7d2bd35e0b61c315ebb78164a785326cc12fd8e1c0b601ab9525101094", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022622, "uuid": "f93a2597-81b9-49d6-a182-6b6d9d073084", "comment": "Malware payload", "value": "9160580be0bf22761dff39bf10085264cdc34e68", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022622, "uuid": "302eed83-bef8-4234-b432-0f81c59e0dd2", "comment": "Malware payload", "value": "6d31a293af967ed02c1f46994071dbf4b7ea23a6c6e9d704340d95aebec74bf7abb936bb6ca25198d5de03824610ac50", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022622, "uuid": "09b3bc1e-e30a-4203-9422-a2325434c7a4", "value": "T11547DF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022622, "uuid": "8c0ad381-8cb0-4e4f-91c8-9972cbb640de", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQP:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022622, "uuid": "aa90d4d5-1b1d-4c66-b8e2-a2d42588e83e", "value": 24608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022622, "uuid": "fe509683-b3a5-4603-952e-5c514381ddf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022622, "uuid": "377def84-7f22-4cdd-a0bf-d50502d45a4a", "value": "b5afdf7d2bd35e0b61c315ebb78164a785326cc12fd8e1c0b601ab9525101094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fed355-7f72-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026311, "uuid": "9d478d66-1e15-4040-a912-a7e2d1900c6c", "comment": "Malware payload", "value": "3ce4319795b2ee551f7c31a1e47502a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026311, "uuid": "ff49aeb8-3be8-49d0-9193-340a5d80de02", "comment": "Malware payload", "value": "b68526afbf20b678d3baeb9260c7c12f12d3db76bff2d2a3c51a7deaa8bdcd02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026311, "uuid": "3dc6fd84-afe9-404b-b3f9-94ab26c6bc7e", "comment": "Malware payload", "value": "9a1ac4b83c17fb6148324158109ee76b25b5b78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026311, "uuid": "a166e22d-6027-48bf-a8c4-8c4ebd00d0e2", "comment": "Malware payload", "value": "b1d767bbe0e976f62ef30e26a85564d86748d7492181927f3840ab62f96568388657a03d0f2fd7636e43cb37c592ef87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026311, "uuid": "55fc5ca5-b63f-45fd-a4f2-4e910283bcd0", "value": "T17733C0034AA86036E835DB36B4E25963CBB5AF471992CDEB710CC0896F533465F533EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026311, "uuid": "db151f7e-76e0-4273-8536-0505f4e95f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026311, "uuid": "f06cef0f-0f29-4df1-85c5-e4d07af3cd7c", "value": "1536:06Uu5p/nvT4HMVUu5p/nvT4HWnLJr8tNqv:06Bf/VBf/znLJ4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026311, "uuid": "e7f5ce84-790f-4124-881b-7b02e01def65", "value": 52176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026311, "uuid": "ab807ee5-4d97-4a36-996d-fcd67225ea23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026311, "uuid": "eb92c6a6-60d2-47d7-8af1-715fea759184", "value": "b68526afbf20b678d3baeb9260c7c12f12d3db76bff2d2a3c51a7deaa8bdcd02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c3bb6e-7fb5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784055217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055217, "uuid": "13232b09-a169-4490-a67a-5db6ef8ebe0b", "comment": "Malware payload (Mirai)", "value": "ed7c6573aed306cbf4c3fddc77e5c400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055217, "uuid": "8aa243ec-ba7f-4b25-91e4-63cca179b618", "comment": "Malware payload (Mirai)", "value": "b7a973918dc83e4fda18643592e3c660b0bc64add0ce9d7ffd6e7e04ccba0967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055217, "uuid": "6ee417bd-7a7e-4802-a4e8-865a746ebe33", "comment": "Malware payload (Mirai)", "value": "265e00bf1681402c0f6fa2a07fb02d7b6d3c9527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055217, "uuid": "2565483a-9ede-4109-9474-6facf0ba83f9", "comment": "Malware payload (Mirai)", "value": "3d038fe316b2d4e8635c299a84cba84da274e0b72e635d73f7061d99886f0ec2e94b465f8c3f19b2f21ca13b102e7e11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055217, "uuid": "59358e7d-2a36-4103-bb9d-e001a7c8d91b", "value": "T166E3E60E6E358F6DF379C336C7F74A259B98738216D1C649D26CF9122E2024D241FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055217, "uuid": "a83732c8-b5e5-48ea-a763-6b64492dc46f", "value": "3072:xbo+kGIP6HvsRwsGk4d4ySi8PoqDdRNAVRwdNP+ZBmu8BOjUF0Qv1C8iucFa1NJu:xbo+kGIP69oHdpAX5g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784055217, "uuid": "87b3be79-972b-4441-82ab-6969a2026772", "value": 156448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784055217, "uuid": "fb42a83a-cc13-4e03-b39d-f59808f80685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055217, "uuid": "4dc9dd74-baee-43c4-b6a3-5ecbb5e0d181", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001670e4-7f72-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026302, "uuid": "0e40df15-95e8-41db-b627-72eb50f7bda1", "comment": "Malware payload", "value": "d7bec55e13a607a2d53a56e1d93886af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026302, "uuid": "be4cc14e-3b48-4969-af7c-c2e5aedce124", "comment": "Malware payload", "value": "b86bfb8cbe1d3216e0f910a7307f45c01ff48ba10104682c2a8e2dfc7475e072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026302, "uuid": "b495fc1c-5043-46b0-b2e1-74c31b7110e2", "comment": "Malware payload", "value": "62ea17dc8ee7ebd0bf5a3d3f8abbe4feca392d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026302, "uuid": "6758d09d-ea42-4a87-a8d2-d59f92286f1c", "comment": "Malware payload", "value": "44bc90d19e7bfa450aa8439ec1f28760c75f45b739621f3850e0af81285551e19b859754b6230be707e04a1eac7d476f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026302, "uuid": "f1b6824c-1487-4043-ba0e-c635c411a308", "value": "T1DAC37C1278C0C471E5732A3559B4CA714EADFD700E75DEAB6398027A4F602D0AA39FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026302, "uuid": "6dc67200-b6b9-46bc-b945-dbe40ce91523", "value": "c3afe98a750f2d4f1ed5d2ac323cb5e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026302, "uuid": "ff9f04d3-30e8-4386-b3b5-c85568e02791", "value": "3072:1VbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl3IMU:XPrwRhte1XsE1l4MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026302, "uuid": "c8d8e918-41c2-4170-b18f-ed4eb850151e", "value": 118224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026302, "uuid": "68d384e9-2dce-455f-95a5-a7c7f4f5e066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026302, "uuid": "89bb91d8-fef1-496b-811f-3716145677fa", "value": "b86bfb8cbe1d3216e0f910a7307f45c01ff48ba10104682c2a8e2dfc7475e072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8215701a-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022226, "uuid": "672cdd80-6647-4d5f-a3aa-2f964ab7f858", "comment": "Malware payload (AgentTesla)", "value": "1c56aca36f2350698d745e2a7f088873", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022226, "uuid": "ff6d38fb-bd82-44d4-b2d9-c3644a47ca9b", "comment": "Malware payload (AgentTesla)", "value": "b87f7b38f087592979ec3a441c54dc45d31e8071736050c40aa31aa5d85a3275", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022226, "uuid": "f23f571d-a194-45b9-a2c3-06c59fb2850d", "comment": "Malware payload (AgentTesla)", "value": "53a8c2384512efe911a3c151eb3d8603291d64e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022226, "uuid": "a3a2f849-d396-4212-acbc-60f2cf5c5351", "comment": "Malware payload (AgentTesla)", "value": "d9874daf0980a194d78e56c8a0157a9fec24151a76230d40db6d720fadaf42f8a0807086a6b85b545349f3b4d04377a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022226, "uuid": "5b813698-5f89-4941-b4e1-606734dad04b", "value": "T1187641310354C631E3545FAB26A9B128640D5DCA98F9EB067A5EC7B0127E833E37B7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022226, "uuid": "014a879e-bcea-4f3f-8395-24880985425e", "value": "98304:EgbQz9aTVoKcJaKgCNobPn5hQxTU3gJhmLgJZTctqv32+anj9hx:zf5o28NobP5GxTUQGLgJxQhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022226, "uuid": "84064b9c-c505-4551-9d2a-eed9d7c37941", "value": 7198846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022226, "uuid": "f7d1a84a-479a-49fa-9dca-edb5c1e08a3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022226, "uuid": "404cfe8b-89bd-4ad4-baf2-9828a5f1ec76", "value": "\u8acb\u6c42\u66f8.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea66cf4-7fb6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1784055560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055560, "uuid": "f6f36f26-cd53-4f35-9803-7de3775bb341", "comment": "Malware payload (ArkeiStealer)", "value": "188ca35330b8df8e91d287e51e8da85f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055560, "uuid": "2cbc26e2-17c7-47a0-8068-353f0c724035", "comment": "Malware payload (ArkeiStealer)", "value": "b96e72fc8af7ac854ea39bf288b45e0675dc588b1925b151548d1843c80ad000", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055560, "uuid": "2073464b-852b-4134-b3ab-dc3de4f0f6ad", "comment": "Malware payload (ArkeiStealer)", "value": "1b6600825d9d3779f6f21b7a2ac5916700caf7d2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055560, "uuid": "b125012d-2f72-4849-85da-c8e6ed7d7c30", "comment": "Malware payload (ArkeiStealer)", "value": "a23a74137543865fe7769c9deafb267b7c1a639cd61449300b4c6af171b3833ef806ed3c02252ee31fd5b16ac7c77a80", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055560, "uuid": "335fb8c4-a7f2-46fe-972a-e7af9779ea09", "value": "T16EB5418ED68207B5F3DAE7775229D62A5DF6314580728A31CF463D354F0BE20A029EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055560, "uuid": "29804adc-9cb9-4591-b2f6-4877941621c2", "value": "67139503bd6a6e2010992d4f6e08368f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055560, "uuid": "ceda3eef-7608-4795-a916-019ca630235f", "value": "12288:njudCuw8n1Ed4CG7qPGXMASMfcD9V0krZYo:nco1d13d7SklYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784055560, "uuid": "2fc7f530-f5e4-4559-b533-89783a1d0680", "value": 2306560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784055560, "uuid": "152e5620-4293-427d-8f89-396a3c5c8f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055560, "uuid": "8ae9cedd-3dfb-4d6c-bece-20507d21c8d3", "value": "order_37335536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf18794-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022027, "uuid": "45e33b97-8294-4d6c-9d0a-b74867d8ac46", "comment": "Malware payload (AgentTesla)", "value": "013081a63b3561182855875975b849ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022027, "uuid": "d30e6fe4-67fc-489e-b594-f1653622e62e", "comment": "Malware payload (AgentTesla)", "value": "ba368193363e2f907a667c48ebb1335aab4dcffb38a6843687a3a46bc9ca0b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022027, "uuid": "7c700e91-50aa-4f13-a774-4a030545c700", "comment": "Malware payload (AgentTesla)", "value": "828547dae1fcb05f9e12cdec3faa9b8914eec7ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022027, "uuid": "c951f1a4-18ee-4c8d-a8ad-eb2079cfb4a8", "comment": "Malware payload (AgentTesla)", "value": "1397ae21f209780fe54c974ea89c266e61d98d454220d45d1d286b8abfeb332db9ce6dc4d70a9aa7c5c6f4072b866a3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022027, "uuid": "12a29fd8-c7c2-4dc3-9b3e-b2fa030faf36", "value": "T1FF3400027F88E715E1A93E3782EF6C2453B2B4C71733C60B6F49AB6524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022027, "uuid": "e837a0fa-cf6e-4768-ac2b-95ca4ceaa331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022027, "uuid": "19b6150d-deae-486d-823f-f1db62f17af3", "value": "3072:INBayiq6lEAKt9sOW1IkTHo9rG8KaG5jnThJq0ufzz:Qayiq6bA+Zsq8KaWTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022027, "uuid": "4bb1df35-0d85-4135-9ca1-706ee71e2eb6", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022027, "uuid": "490a288d-e966-456e-8bfc-9cc3c1ed4572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022027, "uuid": "9dc00fbd-1621-4d0a-a831-b2dcd7c29e78", "value": "ba368193363e2f907a667c48ebb1335aab4dcffb38a6843687a3a46bc9ca0b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf3f9e-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784033677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033677, "uuid": "cd9fa3ac-60c3-41df-963a-233e057dec2d", "comment": "Malware payload (Mirai)", "value": "0cddabffbb5722a3514eaaaa3ac4c9dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033677, "uuid": "86d33051-b824-44a6-b8c2-9983dfebcd5a", "comment": "Malware payload (Mirai)", "value": "bb06e66ece348de8f2d419923d5567a6ae2c49e08c6208cc17dcd4adb08a43d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033677, "uuid": "ea27f566-d60f-4c11-98e3-362d92d0843a", "comment": "Malware payload (Mirai)", "value": "f22540f15d71ca2c013d993c5705752c8a68bcdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033677, "uuid": "0fa602e3-24e3-4255-8492-7a293a2bd999", "comment": "Malware payload (Mirai)", "value": "f452ad8ac8a1edede9d90f39859156e10249924d32e157a8b9e721e406211925c0b18588ae9363ef20937ee05da2feb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033677, "uuid": "368ff6a0-6b0f-4362-8efb-6599a2a44051", "value": "T1D673075AFD81AB11D5D625BEFF4E014933534B6CE3EE7212AE209B2523CA91B0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033677, "uuid": "4ccbeeb6-cf69-444d-b6d8-6e8b3b354493", "value": "1536:G5njBso3xpba5PYevMam5aEmUBS8+llZcitefSIdQqtpkZt14gRV:9GpbS7vMam5aEmUBsPefDdQqHkBlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033677, "uuid": "961e90a1-53c4-4450-a60f-1fd78e5a999b", "value": 76540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033677, "uuid": "33281c16-c058-4c3b-9511-66d95426444f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033677, "uuid": "c1d5c88a-3bf5-41d5-92e9-9a2832a5adbc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ab7aad-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021970, "uuid": "fd7c4a01-11db-48a6-8458-01934cf82f82", "comment": "Malware payload (AgentTesla)", "value": "8f6a945dc91d75580db5d82d0355afb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021970, "uuid": "82d353f7-612b-40ed-beff-373bdc81a143", "comment": "Malware payload (AgentTesla)", "value": "bb52887a2013478c31dd9b9e8272e4702212b1163877bea8602eb6eb761067a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021970, "uuid": "73c31b41-e6e3-4719-bb66-04fd91b23fbc", "comment": "Malware payload (AgentTesla)", "value": "86317c98e8ec19cdafff5f3e9054a57a766b48a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021970, "uuid": "2ad5bb38-1d90-4156-9130-549a04eacd69", "comment": "Malware payload (AgentTesla)", "value": "d7b5602bc57547bebc6f9a38a77f37d56a88096591fb1043d3b52a6eec21ae753ca76c2dad61e3e695d48da52b9e4e65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021970, "uuid": "1667fc2d-6679-40d4-b35d-e470b1cb3c38", "value": "T1496533DD0BCA802321FD2332339A9662714C85AC217FBA81DA375313D299556EFE5E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021970, "uuid": "a6357496-c9a3-49ce-ab83-b1a156ffed2c", "value": "24576:Pe4RUaJFw+R/Zq2m8aNEq+BH1rL3FHv19uHgb9kE5+Zz0zBPUpag6yBV4ghsSICk:PeyUmw+NYi7BHBL3Fd9rL4qBe7v4ghsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021970, "uuid": "9b0cb728-628d-4f3d-a93e-4d04f0c8c613", "value": 1496806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021970, "uuid": "ae983280-fb78-4f97-a57c-35dd7bb1287a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021970, "uuid": "e4982708-354b-45d9-ad5c-5a8ca3317897", "value": "bb52887a2013478c31dd9b9e8272e4702212b1163877bea8602eb6eb761067a9.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ddfca0-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784024037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024037, "uuid": "246ea62c-5f5e-4db6-a536-7d056564f658", "comment": "Malware payload (PureLogsStealer)", "value": "4e14ebb6c20ceb6ede78c864b1eb42d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024037, "uuid": "1beee9d4-5110-4b60-9513-7021e933e4fe", "comment": "Malware payload (PureLogsStealer)", "value": "bc5fd2c7cffb56f7e59844f0434076c3084770cc3146094bc46a86538e05e8e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024037, "uuid": "aefc21b8-858f-4e0a-8fab-8ab31cf5fe8e", "comment": "Malware payload (PureLogsStealer)", "value": "2fb9da2f384f24f275645b421166bef8b2afa7c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024037, "uuid": "f6151ae9-4765-432f-93ca-0957420ededf", "comment": "Malware payload (PureLogsStealer)", "value": "520f8327acd387480c3a32046b8041b7daf36e677c38a9442a259f7ef877e1aa655c2aac3fe62c48c7092aeef4603a47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024037, "uuid": "925e9361-db8c-4d13-9415-a06cb12a0080", "value": "T1E69583749BC9203554E77290BCC4F825922E7B6227EFD7CA01B50DDF1B523486A78E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024037, "uuid": "f79e2c61-1ee4-453e-9b25-1cb79e26e671", "value": "12288:hlMDnIm4N4Awt2LXjy13qRHc5vMF85ZpevDYCvyE8JSzwuzmXFu6uP:EJa7zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024037, "uuid": "5adacff1-8b4e-412c-b631-4b5f785f651f", "value": 2030744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024037, "uuid": "07d154c2-e32a-4389-a1b7-9b756f1f9a6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024037, "uuid": "93d94ed0-1bf0-40d6-a0a7-f59d0865ce7a", "value": "MT26_0714_Technical_Specification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885ed5e7-7f61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784019230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019230, "uuid": "ac96db73-d166-46f9-81a8-cc4f91804465", "comment": "Malware payload (AgentTesla)", "value": "183573ffe3b0c5f9188c5fab6b80ebec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019230, "uuid": "61e0163e-6d29-4226-9c96-1a7a1411c4c3", "comment": "Malware payload (AgentTesla)", "value": "bc6d86cef1b7404823c1d830387b2c9b1289c453620482fc1749dd5d2ade3897", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019230, "uuid": "b626d96e-0b86-44da-8783-17df92331718", "comment": "Malware payload (AgentTesla)", "value": "b9308e6c91b64f4695a5418276a25f35e6eb18ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019230, "uuid": "63bee222-27ec-41fb-bb87-2963a1802163", "comment": "Malware payload (AgentTesla)", "value": "bd7b8c33d9d37948e85187d0bc80ac9624719cc4ade08f2eb70d1cb7f873f684c83edd5cdc91dadaa37b902d115fbd98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019230, "uuid": "6c8960f4-1884-4608-8130-d415466a274d", "value": "T19955F10822D4D688E8BE97364950D83987F1BC5B9616DB2D7ACD3CEF3B76B424406723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019230, "uuid": "80c75b29-744b-46e2-b516-dca6e060eda9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019230, "uuid": "fc2668b5-ed83-4b4f-93a2-eee166c482e4", "value": "24576:4XS2UxAPqGcv/+Duyx4QIPOr+e4ggVqAXOI6+wF2s0O8BD48rWHFDW+1RUr:w+qPRcvEryggdXOI6XL0O8BD48rWHFDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784019230, "uuid": "f2087281-4926-40f4-851e-5fa908c45699", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784019230, "uuid": "52307a63-33aa-4714-a1c2-02700ab47fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019230, "uuid": "d31d42e2-12c2-481d-82d5-cf10955b755b", "value": "CTM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0e1f9a-7f5c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784016875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016875, "uuid": "c3b0aa45-37a8-4a3f-8300-8de73d2b75da", "comment": "Malware payload (PureLogsStealer)", "value": "3be61931b79ac519b0d0f0935c54f67b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016875, "uuid": "d7b0efbc-49b7-4ff3-af89-e88fa8213780", "comment": "Malware payload (PureLogsStealer)", "value": "bd195a5d90edbe3a6c10ea336573aec277c199ebf797aed58bd10d7c46d805f1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016875, "uuid": "300cb88c-88f9-44c3-bda5-8d6334f92af9", "comment": "Malware payload (PureLogsStealer)", "value": "a2ab5a2fd3e06bd448e327501cbea973d9368f2b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784016875, "uuid": "48977420-2835-4976-ae8e-44cc6138d835", "comment": "Malware payload (PureLogsStealer)", "value": "9848c6bb4153e81a55e5398a44ccdbd1cbd2c7eee734d5bed29e6b8825edd1632d15458a4e2ef360a262501ae76725d3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016875, "uuid": "e666920d-2102-4d03-8bfb-e5e09a094924", "value": "T17803E96BC1CD81A26BE2CC595C94849429AB4727A240EF273C2CD3C1DF66972EDF2707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016875, "uuid": "8482751a-c32f-4c33-b087-0ebb3f26f339", "value": "96:q0aBRkGCvQCQ8CZCJBRAFiC0CB8Fo03Av103WFuBRpNBRqiXRDo+BRNBRjqBRy:u+K0Q90XLnBnVI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784016875, "uuid": "51b13b37-75c1-40e9-b4ea-edf16e8022f6", "value": 38119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784016875, "uuid": "9f006e20-dfc5-432f-8cac-d0452279a596", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784016875, "uuid": "4c61414e-2858-4f64-bad2-9ad18a76e2c5", "value": "scc.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30489a8a-7f73-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026813, "uuid": "bcee427d-4eb3-40a3-9f0f-b6c28768939c", "comment": "Malware payload", "value": "dda94e41f727664fbdc7909ccec4bec0", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026813, "uuid": "13b29d35-cb58-4d80-a367-f18eac19c4c0", "comment": "Malware payload", "value": "bd351668df5a59faa9cdb73d41071a77b625e094954aedfc9f695d33915f2ae4", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026813, "uuid": "6dec6f7a-923e-47d0-b680-83c7b709926b", "comment": "Malware payload", "value": "4b8dde7d85c02556f1600d1f86f3afc130e368c8", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026813, "uuid": "3a2a4d8e-e639-4d7c-a594-314f0402d3a0", "comment": "Malware payload", "value": "5e360db342a3cb2cd44918081b4dee6849f648905bc8e2ce3c892d1d3a67cbba70a7f6d3dacc0039a6f79fe8984b7831", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026813, "uuid": "85f6ad25-6bfb-41fb-8def-12cdafcd0c1a", "value": "T12801DDEB65B0AC3078798A3CFD9746B01047141768051D0D709F7E04FF2CB4CF6A1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026813, "uuid": "faa28215-d4c0-4cd5-9301-4a3997bfc889", "value": "12:Izzfsx80+aVLeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TaoHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026813, "uuid": "dc21d363-0394-4a2d-a483-782f359784e5", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026813, "uuid": "a7cee94f-a274-42ea-868d-4331f36b9862", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026813, "uuid": "36f20a2a-588b-4de8-b9ea-b999db1dc61d", "value": "bd351668df5a59faa9cdb73d41071a77b625e094954aedfc9f695d33915f2ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cd524e-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015419, "uuid": "4c3046d8-28a3-47c5-a252-5b0407c0377f", "comment": "Malware payload (RemcosRAT)", "value": "f26edc9118871a666fa431df7b2dd97c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015419, "uuid": "ba2a1d2e-dab4-40cf-a115-a022213c0592", "comment": "Malware payload (RemcosRAT)", "value": "bd6be9c6c1266a0efb350d3eeafb5f8530768b3a2ffa13aaf553d38f86e21375", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015419, "uuid": "6e3d0a1e-3d90-43c4-888f-5f275ba714d7", "comment": "Malware payload (RemcosRAT)", "value": "3e178811443d00fa3f47dcdd7b1cc5160151242f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015419, "uuid": "799eba73-c93a-4bec-b895-56e0baac02f6", "comment": "Malware payload (RemcosRAT)", "value": "5895ff910177f6fa98ae9e11b9ab1cc86b933e25edf8b2fc78163531046b95601a7c943a5dd67516d83d6f25b9d8c276", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015419, "uuid": "c6b2339c-52ea-4c97-9fe4-29a0122f21e8", "value": "T1C2D27E2431A5C016D594C8728ED8E6DB6B22FCA2FE5B8B0B33C5330F9D359919917B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015419, "uuid": "805bae9a-310b-4877-913a-ebf32b5e52a7", "value": "384:82IhUahwnOpzi68CT8EUt/WtwMaI/K9JccTX2NX:ophEyziftxFrZX2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015419, "uuid": "cd4d9ac7-9a7c-47eb-a7d9-db0b5822ed56", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015419, "uuid": "f9abac3e-bd93-4804-9856-3dc94be48cc7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015419, "uuid": "d5485396-1853-4629-a25a-4528573ee259", "value": "VTS_PL76679765657.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3319facc-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784023811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023811, "uuid": "bc2b77df-f510-451d-8be9-1cacb112171c", "comment": "Malware payload (MassLogger)", "value": "01abca3febcbc0ae661ae467ffc51623", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023811, "uuid": "51111774-a68a-4994-9ef2-ed01e93b455d", "comment": "Malware payload (MassLogger)", "value": "bda828c196603e74f8cf5edd2fc03cf04e26a76a1ea6935fdc7e57133894b9f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023811, "uuid": "434448ed-3764-44aa-b571-0d53dc2a8a9c", "comment": "Malware payload (MassLogger)", "value": "775d69317a6af07b87ac1f6314c8104e72d6f917", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023811, "uuid": "f5d96795-4da0-4b36-8b00-ffa996d0e962", "comment": "Malware payload (MassLogger)", "value": "8c96bb308fd7c31a630151e2c19015cc6396d3025e7024e0a71fcb871810bb6344fea10b41671f1660b326458360d8ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023811, "uuid": "8046f7f9-7890-435d-8cd0-65437b74bfbb", "value": "T1B3D5E74583A46273B764E35D913AEF3CA44E900325E9DF08395ED628796CE879348FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023811, "uuid": "cf601933-95f6-4247-a45a-6f6649ffeb5b", "value": "49152:JZDSpi5DnJJooibyZ9tVkGNvhk4ygW08lnU/mf4/zJ3rVOjPfuUmBE2oVEn:JRSpi5DnJeoibyZjVDFzygT8lnOvNbiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023811, "uuid": "deeb8b68-be21-4d89-a531-57fc97eef390", "value": 2939748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023811, "uuid": "d8b3dbb4-051f-4957-8bbb-10e7f65154ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023811, "uuid": "565b73a5-332d-4aa8-b43e-3090c53d2529", "value": "PO 26004697 OP.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435627ca-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039730, "uuid": "91fb2497-24fe-418e-930c-01a62ccef806", "comment": "Malware payload (SilentNet)", "value": "7bc779a75183e2d26af10a259e325329", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039730, "uuid": "62269753-573b-4488-9d46-a63b4e6de374", "comment": "Malware payload (SilentNet)", "value": "bdde28f3ce13b9919f25a812a6aa49a2024a94428c33ad062a26bf41c97d4e6b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039730, "uuid": "c3464302-36a6-4cea-a5df-6da98d2a93b4", "comment": "Malware payload (SilentNet)", "value": "91d58984a8eb32b6bd87aa87558a1718debe55cc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039730, "uuid": "c3906ef9-1820-43d6-8162-b048405d6a86", "comment": "Malware payload (SilentNet)", "value": "006c1c081675b0cc5c9650c29d015e706e10efa525e0afc0716cf8a60a1b20c12c68466594ca8b37243ef7bca976d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039730, "uuid": "f6f266b9-42b0-4768-8b99-422a63c6eb00", "value": "T17C9302139FE86F4CDC12A47FD265FB82D46B6771C191A2AED9B2788105FC0670262E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039730, "uuid": "be7fcc0c-68bc-4317-b78f-b69f192f5b82", "value": "1536:InYhbSnxSHaty07E6F4OEfAOkE0zTn5Ny2vIRUAVcIwq4ChAd0UNwO0cP3EIaRdd:I2bSnxSY7EY3OkE0zz7RvI/CIqChAWUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039730, "uuid": "04396843-df3f-4bde-acc2-31f90537a215", "value": 96543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039730, "uuid": "eaeb9962-1cc5-43ce-8723-0a16fa2c9830", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039730, "uuid": "21ef289a-37b3-4388-8fc8-2eb0935f8f27", "value": "Kryptoncrackedbysigeon.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907e1811-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "ad4be9e7-5536-445c-806c-db693cc4919d", "comment": "Malware payload (Mirai)", "value": "a4e9e49e57fb5655b57d6c95c993abc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "23cafe6f-094a-476f-8b38-53c5ff85b163", "comment": "Malware payload (Mirai)", "value": "bebcde77a8ba21d71a58117a1827b6dca4184939853d6f0ccd574ec08886257c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "822e73e8-e8dc-4ffd-8954-c6ca92791cbd", "comment": "Malware payload (Mirai)", "value": "9adbc63f9f0bea23b454c05c11ce0bb8b370d42b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011942, "uuid": "cacf85cb-52cb-4bcb-8c44-6d7c45746f0b", "comment": "Malware payload (Mirai)", "value": "d5810dd726539587104d59bfd0f67a1180b6e630858d408c03f0078b8ccdd7211c5864161f0ab155bdf9d35ad3dea91a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "5fdf6228-1b3c-42a7-95a9-2c54b9de504e", "value": "T1E421FC0EF2592D8FD9A7117C141F06273030765AE4138423E3768E7FBA7B2A8121A28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "7fa5151b-ca81-42d0-bc3f-2483dc1008c0", "value": "24:3oSa8DzSWPpbP78Pwy74+CiLHd90VhHBJIFD8ECAfGNpiodxqpNT16w:jpP3hb/mZqhhJIl8DAfY0c4Nh6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011942, "uuid": "4c1f9242-f016-4ecd-9b76-30ccd8998e29", "value": 1260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011942, "uuid": "57f81176-b1ad-42f6-9af7-4a320fcd9f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011942, "uuid": "6cd33fb4-d3ff-41eb-9617-e0c95bfe60a3", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e4a2a0-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784033805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033805, "uuid": "ca779a15-3e8f-478d-b88b-1a4672f5cb04", "comment": "Malware payload", "value": "6e8fc346dab3c754388ced103851e880", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033805, "uuid": "a3cf0702-12e4-4d03-91a9-ee2248f80bc4", "comment": "Malware payload", "value": "befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033805, "uuid": "f860efc8-555f-4c0c-9ef5-9109fa384275", "comment": "Malware payload", "value": "e5090e3c4ce43eb9f150c1c273ef4bcee2e33677", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033805, "uuid": "03fbea98-479f-4e55-a58d-44efb42a7542", "comment": "Malware payload", "value": "7b20555efce62f433e0320afa3ff0d97468ed0a51128c4db41f03865e5afac6603676393215c681eaac1835b52eb6a0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033805, "uuid": "d162934d-14c4-43d8-854a-191c04c38265", "value": "T11101AFCA8540A900429D9A6C22A75498F821C3CE1A460F25BFACAD7DEB84D14B02AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033805, "uuid": "3265b42c-3aba-4f75-a41f-4e0122eaf8a4", "value": "24:kXCKysE2hi0ziQvZoha+j/60FRh3EtGN6WU0EX:e9Qp+Ms+b/f3E0dfEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033805, "uuid": "b54d5bf2-414c-4257-8870-4065a7dbc095", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033805, "uuid": "4eef379b-8acb-4540-bb47-c7197bffc6e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033805, "uuid": "c6cda288-2c82-45ff-8450-02756e34e0c1", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd82b5f-7f63-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784020229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020229, "uuid": "c38c3d80-de2f-4707-aff1-519559b62480", "comment": "Malware payload (PureLogsStealer)", "value": "4cb5a2230cac58ef90b6897505fdd1ce", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020229, "uuid": "7df68b85-ca5c-4df4-b2da-618b74cf1330", "comment": "Malware payload (PureLogsStealer)", "value": "bf6e8773e9606583582280b35bd9199daa77b91bbfece22b39ee3dde5fb2781c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020229, "uuid": "46fd3c75-7183-4dc7-8adb-4cbcaf945b37", "comment": "Malware payload (PureLogsStealer)", "value": "98fe65defe54a4632a080dcebcb2f04bbe46111f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784020229, "uuid": "dc4d8447-3e72-4605-9fad-f1b39f601bac", "comment": "Malware payload (PureLogsStealer)", "value": "efb2bb8e271ac9d6e41713846170c9d6c9f7b6c906919a04ac65516d1d0cecad8606d769cb2ee6d92c49a793eb65559e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020229, "uuid": "44611850-ef36-423e-acb7-81324bf27e51", "value": "T126031A39C5D65B434A8F95CD99CF6E2130F3C9592465321E32BDA28FC74022D1FAE62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020229, "uuid": "a2efcfd4-ba22-445a-873d-6de0bdc7e1ed", "value": "768:EnCH6HNHpyVHxdyNVy10D+DXHWMwHmAf5jHfj:OCatJERdyNVy10D+DX25GA1/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784020229, "uuid": "bd2e6c51-700c-4a7f-9db6-fbe60822d572", "value": 38562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784020229, "uuid": "e66513b0-d5e9-4c92-b7a8-d4566a9f28e6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784020229, "uuid": "c4d62305-3546-484e-9d3e-c7f4f17e07c8", "value": "goodwayforbestattendingthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2563a19-7fa3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784047620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047620, "uuid": "29796ba6-813d-4f23-bbf9-7ea5a71c1b7a", "comment": "Malware payload (Gafgyt)", "value": "44ac76fd5a463c06a2c19303a1c08a4a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047620, "uuid": "b95ff237-1deb-468e-889c-a1ad345b02a7", "comment": "Malware payload (Gafgyt)", "value": "c0111291f4dfeba09099cfcbd07930830cb13360365404152b18fc85d77e1ac7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047620, "uuid": "c51384a6-34d0-479f-9276-dfb1b0a74d0c", "comment": "Malware payload (Gafgyt)", "value": "3543512e50821eee49aa0df6bfcfbca6ebf17bb8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047620, "uuid": "3f69d687-2db5-452d-a71c-a10105c3f703", "comment": "Malware payload (Gafgyt)", "value": "9aae94922d153426e29bb6dab4917da842b7564edf0bca1e5d6c4fd42467198e6f906c2aa43a7d09b47253ad71641106", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047620, "uuid": "e40d77be-f7ff-4272-87fb-40f7364e56f5", "value": "T14C733A96F8809B12D6D1157AFF1E528E3313077CE3DE32129E24AB2477879A70E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047620, "uuid": "50067bd0-2056-42ca-b530-b9332ecd7855", "value": "1536:6InBLgdjV+aPOfQTMaYiL0t3lavG9dk5W2OHYSr:fgdJ+aG0x0t3lavG8/oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784047620, "uuid": "55392d86-4fdb-46a5-9668-c9927d359a02", "value": 75728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784047620, "uuid": "fd1076d7-a8ca-4142-978b-d17aca573f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047620, "uuid": "06f18826-66f6-4c80-a2a1-951b73b32155", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbec202-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784031637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031637, "uuid": "a2831311-673e-4be4-9efd-bc8bb6d142df", "comment": "Malware payload (Mirai)", "value": "f5e437b1bd4f9dc4a156ac3daa67f048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031637, "uuid": "5f7611cb-0153-45e5-82ea-92c1ceb69938", "comment": "Malware payload (Mirai)", "value": "c0e324a17bb92a43ac07dcd305033ee869e36aadcd751cb0455eb9c33f0f44e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031637, "uuid": "2c1c0acf-bf75-4292-9f77-61504a7b2dc8", "comment": "Malware payload (Mirai)", "value": "b4e4810624146c769e0a6c8288639fc930ef9552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031637, "uuid": "efc4643e-5097-44a4-bdc0-fc44632a23b9", "comment": "Malware payload (Mirai)", "value": "f1a5c8764bb6c7ac3d68868b4c16252bdf9dc018df97b857aa271e67b213d4c01305665b8418f9599e71a9f0b345f7f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031637, "uuid": "adb681d6-9ac0-4a9b-a4c3-4c0ea13f2cee", "value": "T192D38E9C9D1E7DC2C2C2F2FEAD450F66312675744A68C3F6190062CEEB9ED9698F1432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031637, "uuid": "123f2805-849b-46a3-b954-4cc14eb24450", "value": "3072:6OJzHMJTgzf4Kph8TIdthqYUl8SH9jzNVXCKhR2Jc:68AV09ndrqdlZ9tVSKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031637, "uuid": "f90f5c4d-7789-45aa-ac5b-bac3ec6eff1e", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031637, "uuid": "2913beaa-afd0-47be-8fdc-23a7f968a88f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031637, "uuid": "cb84679d-33ff-4432-a4ea-06aa0944eac6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d579744d-7f49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784009051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009051, "uuid": "e2c14cea-cd4f-4b3a-8405-c6c702020aac", "comment": "Malware payload (Mirai)", "value": "6dc6af36c7618ec58a9e8674b113e4bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009051, "uuid": "4cf34e81-c799-404d-88b3-9da1a9a378a2", "comment": "Malware payload (Mirai)", "value": "c1e10c76b7d4e44295fed50313d692899639e1b486d92beb78100ca36952144d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009051, "uuid": "56f134b2-5ec7-445d-8f00-020b7654c548", "comment": "Malware payload (Mirai)", "value": "f6d7dc7576f93a864d44485e0a4202bfae0fed78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009051, "uuid": "72fa6b35-45c0-4fe7-91ed-8f651e760f29", "comment": "Malware payload (Mirai)", "value": "296e22d66649ea4eb3e3ec63d512c2f1b80ad3c9d1349c0155809dc525c1654015b1fd9f4dde3d60c99630638942c340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009051, "uuid": "dd5ed0a8-e889-4d3c-88ec-de4ccf59a1f4", "value": "T1D8B30806BF615FF7E86FDD3746A91B09259C541A12EC7F3AB630C828F68A14F09D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009051, "uuid": "c50d5f45-9cdb-4bfe-8154-1b3d4075882e", "value": "1536:DVtTuJDFkspuW6haSRVtSf+VJ4tJBcphftgoUdoSs7eq4CwSGB:DVtTs4h1jtSHeUdox1wFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009051, "uuid": "735d5a61-82d4-4437-8742-f13111a61ee1", "value": 113520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009051, "uuid": "121aebe9-e54d-464d-a7cd-302a3cf2c8ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009051, "uuid": "78189109-af0d-483f-b96e-69490998592d", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86290405-7fb9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784057022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057022, "uuid": "7ba022fa-74e9-4aa4-814c-015de88adcff", "comment": "Malware payload", "value": "e47e0ec8d199b47c1bd4bcbd9d35d4a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057022, "uuid": "2b870983-6b5b-44a4-b841-0130105c6a06", "comment": "Malware payload", "value": "c283269a23aef3509594c76e0819fcd45771e092408dd6392dffc730939fa9c7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057022, "uuid": "21ef11ed-1a3d-46a8-a81b-05e8bf660368", "comment": "Malware payload", "value": "42aa49c51493732b5b5ade455457e9c25fefa622", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057022, "uuid": "3a3fd01e-87a0-4e6b-8900-b7275e8f2e4a", "comment": "Malware payload", "value": "d6fb309d0d173d4fba5e33b877b8c8db56298a436b3cee05a69c7adc9484d9a23c09b09fb951918cd4691fb124f2cddc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057022, "uuid": "df79272c-7285-4cae-bf1a-9081c342e68d", "value": "T175137D6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057022, "uuid": "9bc77ec2-d3dc-4312-a8e3-2d8b3cadf078", "value": "768:tXRWNGxVp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Xlxocy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784057022, "uuid": "18db4afe-8921-4b63-8e75-ac5ba7b8c9b7", "value": 45538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784057022, "uuid": "4c78dcf2-8691-4404-9716-24c815e42d99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057022, "uuid": "3eb2c7da-d330-44a1-8e9b-9932483eb9da", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a096f8-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046584, "uuid": "ec035269-c407-45ea-aa08-b1fdf8a06ef2", "comment": "Malware payload (ConnectWise)", "value": "5f191045009ed1d703132acbf3d5d9f1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046584, "uuid": "8acc5336-93c8-4b34-8139-54889184a6d4", "comment": "Malware payload (ConnectWise)", "value": "c361c144166d68555ebee186ba47d4421e6ab4c3330739e1ca3e57f38a438832", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046584, "uuid": "053a2da2-243d-4b9f-b90e-8de8c985f557", "comment": "Malware payload (ConnectWise)", "value": "efd6981731b666e5b3931931f7cdc3e0072f74d4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046584, "uuid": "1ee68ffa-16c7-4e33-b1d5-9b5a10bd4b97", "comment": "Malware payload (ConnectWise)", "value": "5173af4d686c30ea38e9775b33cfac5926f9528789eaa73a520663edf39d4a6b50613701fab7a2ca535795145cd1f123", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046584, "uuid": "64ec98bf-ba77-4243-ba8d-fd5e84c57abe", "value": "T18546E101B3D695B6D1BF1638D87A52656734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046584, "uuid": "012b1f13-9240-439b-8653-02b8ed78d5d7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046584, "uuid": "8702a193-2b1d-4a79-9cce-42cc56b4e4ae", "value": "98304:LzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:LhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046584, "uuid": "0da47d61-a813-4f35-baf0-123965f8ef29", "value": 5662256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046584, "uuid": "90271ebf-dbfd-4eab-99d8-11a591dfa20d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046584, "uuid": "270f66ae-5a86-4053-9a02-2168a84948e7", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e58e484-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784023803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023803, "uuid": "81070276-9be4-427d-9dbb-128731fecb5e", "comment": "Malware payload (PhantomStealer)", "value": "ba927e2546f4318eb6442ea49da394dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023803, "uuid": "f13b82bf-fd05-4029-b740-b220f804642b", "comment": "Malware payload (PhantomStealer)", "value": "c38fac4c1542919b07863d01391f75bd22fbfb1694f394b55efdc1daeb71a371", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023803, "uuid": "72e6dd5c-c5e9-459e-a1a2-abdce2aa0e5e", "comment": "Malware payload (PhantomStealer)", "value": "94a226bcb2d982ed4aa077c633722ae3b285fc84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023803, "uuid": "5e686e39-997b-46c9-8c77-cf5e0a774be0", "comment": "Malware payload (PhantomStealer)", "value": "46a11e78974a9027ad9338a4e673be0f5d9f508b4ca19b6726bbe5d39a1a5c95dde8da17bd1991a443775a337fa5d8a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023803, "uuid": "b710192f-3887-4efa-81ce-9dfb62f71cf4", "value": "T1900619515724A172A568D79C963ADF385A4E701325DACF08316EC228BA5CE4FE34CFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023803, "uuid": "a18144a8-3545-4330-a42f-9efb40b2aee7", "value": "98304:iMxY3xts7Hx1E71F59CEkRICQuaHvk7p/9pgSSu5e4lrvyF5QxNfeGIykPFpAhNy:xxiqXo179vCQzPkrpBSu5e4lrqF5emy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023803, "uuid": "e490366d-5d6c-485a-be72-53d82aa316cc", "value": 3837983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023803, "uuid": "538543db-36bd-42c5-bccd-bbc366990cd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023803, "uuid": "65f092ca-2b19-4216-9c2f-a8410f0d5b9f", "value": "Purchase Order_FMD2026_UNIVERSITY OF SHARJAH.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20875ca-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015434, "uuid": "eedcddde-6b56-4d68-876f-e46cd265047e", "comment": "Malware payload (RemcosRAT)", "value": "12382b12e49c5da310c68814fbf0967f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015434, "uuid": "21695c18-6f57-482f-a330-cee5def13387", "comment": "Malware payload (RemcosRAT)", "value": "c3cfc16ac5676769ad4a3295d907a7acd828b4d565d24318f83f737586bfdb98", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015434, "uuid": "73cbdd0a-25ed-4457-8344-6ebbf45f7078", "comment": "Malware payload (RemcosRAT)", "value": "019741cbcf8c4e00869ac77d62b5dc7c577f84fa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015434, "uuid": "3c4df190-a2e4-4e9e-9418-66b5a29f0bf8", "comment": "Malware payload (RemcosRAT)", "value": "f78302f7ee7c70a23372221787de55b6fa7e5f922fbf447ddb834b265993af4afee2ad2eb4a2367d9c295b35a7621e6e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015434, "uuid": "7ebedb2e-7f83-4762-8947-44ba80f5b52d", "value": "T10ED27C0033A6C026E5999DF25DC8D1CB6A61BD92AE568B07B3C9770F283E6C1D543B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015434, "uuid": "afbc5994-52a3-46f1-9ac6-0d1712049de1", "value": "768:sbxBxiux6NGhG+BLX/C8s27vcDkw64xZBva:sdTiugkhGg7aT2ln4xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015434, "uuid": "4281662b-899c-4ab8-836d-e806c535a26a", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015434, "uuid": "f4db4dd5-bcfb-45f3-b091-66f9825ff4c2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015434, "uuid": "55607a28-7878-4334-8335-82095537fa83", "value": "\uc120\uc801 \uc11c\ub958(BL).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8019dcac-7f3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784004613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004613, "uuid": "772317ac-e27c-45e9-b9f9-5c3337d4ff7d", "comment": "Malware payload (Prometei)", "value": "abfbc064add7c7674f1a332a9279dbfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004613, "uuid": "f9544b26-cd92-4c36-8236-44ac841298bf", "comment": "Malware payload (Prometei)", "value": "c3fa96a0a213bcd2abdd386feedd4169ed6d172b7cd497880b1d0cc4c58a78db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004613, "uuid": "38c34127-7d34-4960-95ca-ef1d6a1cbcb6", "comment": "Malware payload (Prometei)", "value": "9da204abab4f7d6a5548474959cf9c16f39e0f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784004613, "uuid": "bf50285b-b962-4943-9dce-7668f3980a51", "comment": "Malware payload (Prometei)", "value": "e0bbf02c241998ca4ca0a426a61618a4a604e838a43c4aca3be498312a538e9e5ea086c11da562c26db6bcc0648ae937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004613, "uuid": "3ee493b2-7e29-4d99-b1ec-a6561566e17c", "value": "T1519423FA5B8EF3FB49127F7027A0980181A47470F99E775986CBFD9A0FA52639CC4118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004613, "uuid": "7363dd8e-d503-4315-a037-8825637f6bf4", "value": "12288:4a6aYYIX2dWVxeJAaLYxAOfUhjXb44UfhlBeLc:V+2WejYxUxsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784004613, "uuid": "34d64b2f-ce91-4877-baa0-e81683e123a9", "value": 428716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784004613, "uuid": "2daa821a-848e-4461-bd4d-88c49963a373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784004613, "uuid": "3c5f98d0-92fd-4ff3-b319-32234450c21e", "value": "c3fa96a0a213bcd2abdd386feedd4169ed6d172b7cd497880b1d0cc4c58a78db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098f3f52-7f9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784043498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043498, "uuid": "506a4144-fc3c-4a9f-b800-839704492b76", "comment": "Malware payload (PureLogsStealer)", "value": "15742024eec468767a0b6bdf96085c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043498, "uuid": "704a2dfc-7d10-47f0-b897-fbe35218b14c", "comment": "Malware payload (PureLogsStealer)", "value": "c42130f2f9f1fc1a1c4189b6cc3bc5ce0207d21620e20cc4119ae86951105344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043498, "uuid": "c07e050f-62e1-4b38-93cf-7777ee05e2fc", "comment": "Malware payload (PureLogsStealer)", "value": "05ac6fa423372e3095b06adb6712178b888b2c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784043498, "uuid": "3fd8a9f0-cddc-4bc0-bf85-365df18ded11", "comment": "Malware payload (PureLogsStealer)", "value": "0c372461112078132be2154725d9f567147867fc8adc71d2cddcf508f890fb9a8270cf7ae26b4879c88d12fadadf6a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043498, "uuid": "c2ed8fcc-e8c0-4918-a1d1-c0597b77599f", "value": "T1BC05BE7B32914F21C24A2377C1C74900C7AA9A87B6EBEB0B718503D61D067FEDE46697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043498, "uuid": "95efc2db-9991-4bf2-a409-93cd0cf0404f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043498, "uuid": "dcbe0611-6e9f-48e4-98ea-a9bee521d5c8", "value": "12288:krkBxIfN1V/tlP31P/CqwsFwUT6j0c0VapxK2zbXSLQv/Hdk9aJrjBuzj8aSIlTT:qD1B1nCqdT6jBZHzL/Hdk9Ijcz6Izh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784043498, "uuid": "1090ce8c-0078-4226-8e74-f87e7d1bbdf0", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784043498, "uuid": "f628f50b-dded-45ea-a1a1-98a060bc460d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784043498, "uuid": "ddf95b3a-6bbe-4a76-a0d2-c227c6915f8c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.59841585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e135eb8f-7f71-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784026251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026251, "uuid": "a49643fd-bf67-48bf-9c8c-1c839f255315", "comment": "Malware payload (RustyStealer)", "value": "c675bb64f1d89f4a1c2ccc5818bba942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026251, "uuid": "0464c957-6b21-4d48-9fe0-c6b2e849a78a", "comment": "Malware payload (RustyStealer)", "value": "c459fdd1f0a39b4de680a45f20a822b204ca897437b4aff99f088f0067a11327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026251, "uuid": "3503e024-0cc1-4866-b269-c142b631e683", "comment": "Malware payload (RustyStealer)", "value": "6fd020314552b3b7b161e9d92baeb31de6492d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026251, "uuid": "d15b271d-1a3f-469c-9316-e392f1fa13d3", "comment": "Malware payload (RustyStealer)", "value": "551211fc725101fea57d221d8171f32a1fa3dcd5d3857c88a4f3e90fa722d47d5aeddd5fd7d8eb8944555a22376516a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026251, "uuid": "9f9e0fea-7f42-44c4-965d-3683b971a439", "value": "T1AB7718217B9A996CD09AC4B483474A725E3170DA0B35BAFF448492393F7DAF46F38358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026251, "uuid": "05a5d392-decc-4dd4-9803-f7f358b034bf", "value": "35af1cf41c4ae8e6d1e268db1225d14b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026251, "uuid": "99a28366-d292-41ee-92d5-a70d57a49c4a", "value": "393216:tnuYyVxHhf1GC6+uzT357NV4PDENcHkSBDha0Kx:tnuYyVxHhf1GC6zzl7j4PDecHhRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026251, "uuid": "9ce0c399-d4fb-4831-b7c3-c3c67897d698", "value": 34139600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026251, "uuid": "3c43cf87-27b2-48df-8153-5af907d503c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026251, "uuid": "8e62ac22-7fad-49bb-a92e-b27e49d9d9c4", "value": "c459fdd1f0a39b4de680a45f20a822b204ca897437b4aff99f088f0067a11327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712eb703-7f60-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784018761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784018761, "uuid": "25e9f0ee-d70c-4585-b6f9-2d5de8b46211", "comment": "Malware payload (RemcosRAT)", "value": "15ff6b69fae0cba9835a159281c794f1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784018761, "uuid": "dba9fcf8-2fbf-43b6-abfe-e4bd8309c141", "comment": "Malware payload (RemcosRAT)", "value": "c478f13eefa74178e585ec29988ab6bc045077b3db9dea930109793716928fad", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784018761, "uuid": "bdfd4211-b24a-4d6a-9e25-50d0c131fae1", "comment": "Malware payload (RemcosRAT)", "value": "5eccd7a84ab8b4051b160b012ecc0082fa6c65e1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784018761, "uuid": "7c775716-f2e7-427e-afcb-d272938ebe16", "comment": "Malware payload (RemcosRAT)", "value": "966f6071c98f8c0e7a1b0504a09e659e2fb55512a60efd8a967c2a7490e8b5c51cd74cfa259c6e5913b52a5ccbf4a6be", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784018761, "uuid": "9bf46ef0-1973-4946-baf5-c2587bf8fc16", "value": "T17003EBA450E8BDB9496E29FC9001F266541241CDBA15812D70EE5EE35F3239DAE1A3FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784018761, "uuid": "a0cc9c1c-441a-4338-b41d-62166c720d43", "value": "384:KqnrfqnFBbAQAdAAAYA5A4ALAphARAdqnB4kT7qnoqnu:Rnryn8nB4kT2nHnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784018761, "uuid": "f143a21d-946d-4053-b6b4-6ca1cf89346e", "value": 38562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784018761, "uuid": "44c53a0e-454b-47e3-8420-3a7b363bc06b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784018761, "uuid": "5853410d-4966-4f5e-bc82-1bf260fb20b9", "value": "weneedsuchakingdomofnicepersonentirelinkingforebst.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faefb2dc-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021999, "uuid": "2becb8fc-25c4-4dc6-9660-f23fb58c7a5c", "comment": "Malware payload (AgentTesla)", "value": "30c502ded0262fcef7266948147d963d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021999, "uuid": "83782a4b-379f-4675-bf69-30e7d4611082", "comment": "Malware payload (AgentTesla)", "value": "c5b0a5ab88c4530029bc900d9f3a3a3e7868d5cd3adde5a479a302fed2d50fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021999, "uuid": "73b7a9f8-808b-40fe-8e51-e1f2ffcc34df", "comment": "Malware payload (AgentTesla)", "value": "248d7c09262684327d785410a5aea70158cf5147", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021999, "uuid": "04e940f4-c938-4a52-a8b3-95279ea31ce3", "comment": "Malware payload (AgentTesla)", "value": "a4f6eb53ed5b9043d03521624e821ab7ae135f2bb710fa3524dcd013ede2ed03efb138a009d4ae3eef8648da7a3e33e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021999, "uuid": "cdcf02c9-0e2e-4022-abf1-1b7dcaff6222", "value": "T172340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021999, "uuid": "81df7f4c-5a51-4212-bfb0-e0775047195a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021999, "uuid": "05db94fb-4cf4-4259-8c61-82e957c3b176", "value": "3072:LPLdNyKayCB+FI18Gy4gETHo9rG8KaG5jnThnqwufzz:LDPyKayC0+C+sq8KaWTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021999, "uuid": "b9e56ebc-f12b-4402-b6c5-b4be114fca1c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021999, "uuid": "b362237c-c4e1-4d8b-a002-c900862f5087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021999, "uuid": "278fd1aa-d038-4c11-9e59-9aeebf99e5cc", "value": "c5b0a5ab88c4530029bc900d9f3a3a3e7868d5cd3adde5a479a302fed2d50fb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed484e0-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "143a4366-b393-49fc-ab00-6880e995df9d", "comment": "Malware payload (Mirai)", "value": "8d323552341001a86d631e29e2d373de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "3bb39a50-d018-4f52-9388-ff8e6666edae", "comment": "Malware payload (Mirai)", "value": "c6447444e4ec5a26b839db0d3dbb4942465a68641cd997c9b1ba8b45e92bd192", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "aa020e0d-c1c7-4d91-a21e-c445f552e429", "comment": "Malware payload (Mirai)", "value": "c9cf69b2b40f06a9f7317606020f7fc423f24590", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012181, "uuid": "7f9e162b-7d93-4e91-b184-3a10b7aaf32b", "comment": "Malware payload (Mirai)", "value": "c299c43b4acde554947360d20fee05faae0bf7b21620de9751b24ea3809a6911e50dcc60a49c4789ba69561ca6c7a2bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "81b4a015-f602-4e90-888b-40bd21677eb0", "value": "T18603F1DEE0A996AFCE7DE9BEE35D05D015835091B6162A4E92314CC973AD48FEC0A02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "0f944562-4290-4f98-bdbd-b27023c74587", "value": "768:q9sF0vkyjXlTTTKXUrmWa5OOFLU2xP9JVshwq5rWUv:AFjXlD/mWaUOFVP9iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012181, "uuid": "27b9af63-266f-4fc8-b86a-4b3296d7e457", "value": 39776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012181, "uuid": "00ff1a9c-6268-4941-b2d4-bb195441a582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012181, "uuid": "2aa08c9e-d49d-45f2-9cdd-3c28190d4a15", "value": "zombie.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99295d4-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015474, "uuid": "dfed3454-f1b6-4e02-b792-38848990151e", "comment": "Malware payload", "value": "d1867bf21e3fd663d3dea9159db8790d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015474, "uuid": "26e4791a-5906-4dca-97fa-7fe68df54122", "comment": "Malware payload", "value": "c6d159486e8452306f029888d44d19458bbade642a676d4cee9253102cce3c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015474, "uuid": "64a58889-1add-42cd-9fa0-1f94ac0eba45", "comment": "Malware payload", "value": "72a0e531eb70d0e1d38af8eee7bf2a214dd53c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015474, "uuid": "966d9edd-7527-4e0d-afaf-2da10199a13f", "comment": "Malware payload", "value": "abc1642a8d8c34f8292ee1f79e03413bceb7d317eb544ae3503eeec58b0df44380504d5675c0c1e87335154761cb1acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015474, "uuid": "fbe2dbb3-7594-4802-8172-bdf738675193", "value": "T17166D027E7A744ECD26BC138C75753327A32F8451A302E7E9A16C7206E66F10A61EF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015474, "uuid": "641c7bbe-111c-4fe5-9cf6-d4de9f731009", "value": "4e796f974defc311491445c221c111b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015474, "uuid": "1a60043e-7339-4d39-b85f-7fad9ae2bd30", "value": "98304:ozb1nUEb93PuYlG+3uq7ukPjA54CDosfZVa3BOE6:k1b9VlG0ukPjHCMMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015474, "uuid": "c3f3a28a-afb8-4e8e-a23e-ec1cc4b59b71", "value": 6520832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015474, "uuid": "7ceba085-5f83-4bad-abdb-47ffe92f987e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015474, "uuid": "e0d13d21-22da-4410-a822-a0294b8b6181", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb208a05-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784012094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012094, "uuid": "48845638-1f4f-4366-a764-48a052df9cbf", "comment": "Malware payload (RemcosRAT)", "value": "213f06f8be791378ec619fcb17f7ff90", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012094, "uuid": "01dea19e-f84c-4ef2-9d10-29a703e6ffd2", "comment": "Malware payload (RemcosRAT)", "value": "c730cd6bf03eae343899fbde12a1b113f3a2b7833e7c4e7101cb609bd29df041", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012094, "uuid": "dd2f01e1-df9d-4d92-8dd3-b7abd8998afb", "comment": "Malware payload (RemcosRAT)", "value": "93f30b486e8788e94cd1139031d673c036856f74", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012094, "uuid": "47f3b1b7-c5d7-42cb-b6db-c79b5affdff5", "comment": "Malware payload (RemcosRAT)", "value": "e339135d3379cf645873a33f30b5d3b906f3fe4ed965e7d879baae053ce77741c40a921d8badc07539e196b4be8bf8a2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012094, "uuid": "e642428d-d6a2-4a84-ab91-6e123f6d5174", "value": "T138B533585D485ADB4E20F7FA762BBC48B6DC938BADC21303026C87B572E44B88B77C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012094, "uuid": "063b3214-4352-4bf3-b471-ee42eb682096", "value": "24576:EVRYpnMG4peE5wGwdBO9cehwpBR5binOSGh8E950Je2jJm3BcBJ7dZ3Hr3QTgR1y:2WGvDKWwHbuOEEDcRdBMsDofp+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012094, "uuid": "1625c867-b4a6-4afd-bf0a-df6ef7cf2bf6", "value": 2374455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012094, "uuid": "2b1c3c23-3340-4c01-abbd-81e82cc207c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012094, "uuid": "39142e34-f5c8-43d5-8c9b-073baa8fb698", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe0571e-7f84-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034301, "uuid": "8dda3817-5265-4e9e-b901-a95f1399a780", "comment": "Malware payload (Mirai)", "value": "68ea5f4a363fee9cece4cb0b65390f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034301, "uuid": "98533a84-e3d0-4837-9367-a7bdd554dbd0", "comment": "Malware payload (Mirai)", "value": "c741bf6518df77ae3d67c36e31c1bf1abde254d4b19d24b1f0e51da6f3c41d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034301, "uuid": "8bda72fb-567c-4391-98cc-e469da3211c4", "comment": "Malware payload (Mirai)", "value": "7d055e1dbc422dd8c36458de1441467c7b6a54a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034301, "uuid": "a80a782d-31c3-4515-94ac-7dab9249677a", "comment": "Malware payload (Mirai)", "value": "06e643996b8cd381ef271d99c1a44e28fb8cf9e8beffcadbb58b70a9c554de203e517f1dd8dc90b0217e2df1da7f9827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034301, "uuid": "52d2fc97-2f49-43f3-a832-892f852decaf", "value": "T13714124E354883456EF8E8B3B67F6543AA61646F0F6CF39709B0DB60E2B26AD7C10147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034301, "uuid": "1f7602ff-2c5f-48fa-a96d-17b29ace4fa6", "value": "3072:fE15Ed+hyzkSpLYxu9gq7ZjkRaEK0M+UwuXzCGpaP3pmW51VSSCtY:fk5EdOyX1j+JUbOG6jGtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034301, "uuid": "47af637d-b37f-43e6-9d80-b0e909681534", "value": 192640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034301, "uuid": "e52dbac2-9690-4461-ae62-377a2af542c7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034301, "uuid": "9ae32eee-2270-4e41-89a5-0139eb3459b9", "value": "lkchngqsu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93450278-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011947, "uuid": "e52c821a-1a72-4cbb-b7c6-727f213c6e13", "comment": "Malware payload (Mirai)", "value": "ef1d3522b5906efe6f230780e4ad3f14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011947, "uuid": "03416c09-0e60-421d-b856-149e88b4c34a", "comment": "Malware payload (Mirai)", "value": "c84d04e3a6968b17b1b0b96233a659a390d8efb845e58d4cd540da1df84b9816", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011947, "uuid": "44c485bf-3a3e-4684-9abe-147855136e46", "comment": "Malware payload (Mirai)", "value": "291478a78ac9b6c2ce0115759d10ec5db50567db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011947, "uuid": "a6f466c6-1430-4f38-888c-d4e44e1c8177", "comment": "Malware payload (Mirai)", "value": "5ec3489c9de6adc51d37413b36672cc4cab0fd1b1874cdd23fd0c8f43b6eb5117dda5d2652738a1147bffdf690e7d0ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011947, "uuid": "6074456c-999f-45d9-a5a4-b6aae807d779", "value": "T1862125A2A5DAEC71C73210F652866F971721CDE62816FF0B8D610812ED3D2D1C133339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011947, "uuid": "a3a4d965-7dae-4720-b75e-2fb66a5e03e4", "value": "24:FlsMHCFHxgxk2ZO4l2ZWZPG9dwvMKn4NphGu92/4DruQFxqfNfS:fsN5wOewWZ+9dwkKn4Nh2/4fHFEN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011947, "uuid": "3a263acc-3e61-416e-8e2e-b5f89d6f7d33", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011947, "uuid": "b882a261-5c4c-4eef-8e87-16f7742a38f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011947, "uuid": "ed2d642b-266c-4192-94e1-4beb1f1fc77d", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455e72fa-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039733, "uuid": "4bd551a0-027e-4833-9dd9-d955bba17c91", "comment": "Malware payload (SilentNet)", "value": "de599ce4bd68a451fce537e0714f1e41", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039733, "uuid": "2953d798-4997-4652-88f6-4f4e3ff15764", "comment": "Malware payload (SilentNet)", "value": "c879f1d791f37c349ad5c8ddca39d8deb44d844f0375f47fdd2578c50c33babc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039733, "uuid": "c6c102f9-624b-420e-a248-93fd8a2f4c0c", "comment": "Malware payload (SilentNet)", "value": "d2c163b225d0076e6fe76b004939cea6bd39e82d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039733, "uuid": "6ccad0a9-53d0-4ccf-9978-c947a1121258", "comment": "Malware payload (SilentNet)", "value": "7ed0745c3e194ee041dfd7f432cf62a145af2e809a34c5c40e9c725954044c9aa21c153a552cc46fc913d36f698f6c6d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039733, "uuid": "39eb7455-516e-4ac9-abba-501b745866f7", "value": "T1A9F533EEEE618A665638FFFC68F51B54203880C62D35D0E8FA2397D4D1CA05EB4F5909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039733, "uuid": "0d14a92e-4097-4cec-a5fa-a42e79120bee", "value": "98304:Tjt1h/QAZLJ32FuOG2bssfyUSlu/2pOPNAcylHbg6J:Th1h/QABJmFH7wcytU6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039733, "uuid": "fdc18f7a-f471-431d-90fb-91421943d64b", "value": 3493673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039733, "uuid": "45b5dc53-b8c8-49d9-9b8e-7fbc498a98af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039733, "uuid": "1e3cd267-f342-4d6b-9398-bba8f8b38ca7", "value": "dupe mod donut smp.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8b57ee-7f56-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784014349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014349, "uuid": "06a5aa75-9db0-41df-9808-4c9ac46441d5", "comment": "Malware payload (Mirai)", "value": "6311cd41aa8f19b3d24c1c326ea411b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014349, "uuid": "de43cb19-680a-447e-ae09-e19134e48ba4", "comment": "Malware payload (Mirai)", "value": "c8c57243b9998b103dc9c46fb4ded2f046b961a81c531775c94931e33e901266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014349, "uuid": "78a533f7-f43b-4e92-98bb-dc6db951d568", "comment": "Malware payload (Mirai)", "value": "ae122221cc90445394bfedd16df75c8c25baf8ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014349, "uuid": "eeaab778-095c-4c4e-b50d-f4f1b0333f2b", "comment": "Malware payload (Mirai)", "value": "1eb6dcfaea6b39af6d44880dab4133b316f38c5b8e2f0b854a5e78a84643bbeef9344100f63a79ec4e409cac5e2821f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014349, "uuid": "ddfe23fb-a7b4-4a68-8003-973c71f065cf", "value": "T151137B46EB53E0B6F85B06B6507B67428332D93D10B9D786CB365832FD23601A72B79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014349, "uuid": "d7b42c5d-92b7-408e-b22b-82137d6453aa", "value": "768:4TECc+BjHbP55yBEuDGVvncbr1AO8nJVnjA6oz+gJcS8oIt:4rT9HzxVvn61ANzebcS8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014349, "uuid": "75115f04-6dfe-49dc-8df3-3836fb4ce070", "value": 43344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014349, "uuid": "ded09a50-c6c8-41da-8948-2c1c7728f400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014349, "uuid": "e97ecfba-6244-4d3d-94c3-699d1059d5dd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbd7459-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012310, "uuid": "ef883ed5-7ffe-40cb-8692-529bbe621ee8", "comment": "Malware payload (Mirai)", "value": "f13a63c21c65d0e7949f7e1f2498a4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012310, "uuid": "970b12df-bcaf-42c5-9fb3-436202539d0d", "comment": "Malware payload (Mirai)", "value": "c9dcf90fffd4086580b436f35d050435ece2e9a7a59b40fd103187511061414c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012310, "uuid": "bdd0f4cd-f965-4a85-b836-5e5186b1e528", "comment": "Malware payload (Mirai)", "value": "d73af0f4f7a65e32e62d6703ce8b8a7bf4c03604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012310, "uuid": "1a001d15-2127-40b1-8a67-b8221e7bfe55", "comment": "Malware payload (Mirai)", "value": "c90865042af4567fff3732aa5873aec27ac1ca24e7a97c83e38b338c3f99a78eb13e5dc4835d98f6310f9a9c16a1422f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012310, "uuid": "ccb313c4-e5da-4e8c-8dba-6b7b2ee1955e", "value": "T15A833B46BD81C912DAC4537BFB2D41CE371623A8D2EE7203DE15AF2232C6A1B0E7B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012310, "uuid": "bdabc2a4-20de-4054-9499-a4e58bbda645", "value": "1536:k3MDOJjyh9TLdjBCQKFP5HqM8EjdzVRYpAg5L5vKV:kcDOJ+j4HqM8+9YygDKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012310, "uuid": "69750af9-c09a-4f88-b6cc-17bee95afb57", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012310, "uuid": "dcbf3a4b-f050-4044-8bc9-1e8709cd3642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012310, "uuid": "1f599c13-cde4-418c-9a6e-e9368950b7ab", "value": "zombie.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcc1f09-7f46-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784007723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007723, "uuid": "8fb9b0e5-cc15-4a46-85ae-d438fd16e792", "comment": "Malware payload", "value": "25298d3472868d79f398b6a662c55d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007723, "uuid": "48086ef7-f3b5-4f56-a813-a6b80d4d6111", "comment": "Malware payload", "value": "ca62eaee96b21666111206e19016ff55975cf6da5308a48a9a0c9d7f8cc0b517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007723, "uuid": "7d9916c3-4b3c-4dd6-8221-32de86d4be6d", "comment": "Malware payload", "value": "f4c535248629f64ed589576e91248d595fde6450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007723, "uuid": "416af916-1c3a-41d6-bd31-c793a0244f85", "comment": "Malware payload", "value": "14e5eb67dfbad69f9f987b0b93ba701ca1a513d8b7132936d102da095c007e1147936a25d2df4a0951a7d33a46ebc75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007723, "uuid": "c57f8003-83ab-4596-ae12-604f11d024ff", "value": "T1F396D6AB32D5555AC12D813EC09A9F0198F2FA770F22C5DB029107E88A736F7CD7A935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007723, "uuid": "08d6d88d-5b21-4999-aae4-9e93c3687d9b", "value": "dfde74035e2b508c0bb75e969d759925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007723, "uuid": "414fcaa7-4490-4645-a150-9ef6b544bcf8", "value": "49152:Fenyl7oreExacEPVfPkmljSCSGqA5S9+Q0+fL61zR6YjnZp:FeoNxELePFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784007723, "uuid": "1dd46c3a-c880-45d1-bc07-c303cbd4e89b", "value": 8960560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784007723, "uuid": "16fc6629-da6e-4e12-bb42-35a783f55929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007723, "uuid": "5143ebd6-56b7-4ce2-af6b-d24f4cefa947", "value": "Setup64x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360be22f-7fcb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784064618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064618, "uuid": "8dcfb86e-b28c-454e-a67f-0acc22ed27e2", "comment": "Malware payload", "value": "2233235be785152e63b1f7972a3532a3", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064618, "uuid": "76d8b990-0842-4e9e-8e3b-5d37319f2ada", "comment": "Malware payload", "value": "ca631ce69ac6e03a639fd2bacb55087bb6e1fb1a29556cda9fbc1dd022e54228", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064618, "uuid": "63d250e9-f939-4f8e-a242-b9fa7fdd72a2", "comment": "Malware payload", "value": "e2a784c3c9bf2c80196f6b51c350c022b899ec22", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784064618, "uuid": "11c3bf5d-9223-4c25-ba28-1668e1f649e9", "comment": "Malware payload", "value": "e44d8c6908cb6e745b4adefb8eab8e597eb7137cd407b0c2fe289a35fd370c44026c43ca1b81c592750c73334dbe46d4", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064618, "uuid": "7b5e9654-f641-4d4c-a5f4-89b2cbf61cd5", "value": "T19211E7DC5AA19ACE5A438649BB704188D99E82D2ED438F19E5B1056A20BC269377EB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064618, "uuid": "5353180c-2c80-4e43-8ef1-8b2e2387b7d4", "value": "24:HBGlUb8LAGyauHW40LO3pgRs89AI+22MtKvgCro9LGC6:styauHW40LO3pgRs89AI+2ztOkdGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784064618, "uuid": "bbb354bd-4707-4044-82d5-cabc66b1842f", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784064618, "uuid": "51da3801-e8f1-49b8-9d0b-3ad7ef1f2440", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784064618, "uuid": "526c3c6d-4625-4715-a161-5c0d54715268", "value": "ca631ce69ac6e03a639fd2bacb55087bb6e1fb1a29556cda9fbc1dd022e54228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658eab11-7f46-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784007575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007575, "uuid": "e65f5c73-aaf1-4226-855b-a677d668e034", "comment": "Malware payload (Mirai)", "value": "90a18a7fb8252635ee5747e2d4138287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007575, "uuid": "2cd21010-c4d6-4a89-89f7-807f6b53c2f4", "comment": "Malware payload (Mirai)", "value": "caa3b7ed6add5423d0c13ee2d5c43e959e9fc83018307f90fc38e0b97a84a600", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007575, "uuid": "18437fb2-b5bf-47e1-b82d-9d03f5b4a547", "comment": "Malware payload (Mirai)", "value": "148f3d6b9bfb1c0002d18b77a9a05f13be855d6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007575, "uuid": "f0351290-352c-4234-b923-befe3c40223d", "comment": "Malware payload (Mirai)", "value": "21ef421f63e6317196048e32919cda0bce43f160a4215f01199eeed9832213dbc8f4aff682cba88dec7524d91f7a27d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007575, "uuid": "db4f27ec-6ef3-4a61-8b12-a4ba460feef7", "value": "T19A94235A7237C98AE744A53E8877C8293B7DBA043E72E624F43DDD841E0C1DD9A44BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007575, "uuid": "5e3911c6-b3a1-424f-9a49-7c6e0c9e0ba6", "value": "12288:v++mkyh758nDqYkNxjW+YHHE1xGvz3llqLi:YFhunD6NZW+YHkOloLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784007575, "uuid": "d35da4c9-6950-4422-94b4-7722d3d2e7b0", "value": 430884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784007575, "uuid": "2849e84b-6161-47d9-9479-6658bf96d9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007575, "uuid": "90fd6fcd-1d35-41c4-a014-5a8e5560443a", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb869162-7fb3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784054642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054642, "uuid": "6c24b773-0f43-487a-847f-5653ddc0809d", "comment": "Malware payload", "value": "758afea95b818063536b6fd7a5a15a92", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054642, "uuid": "0d1d3152-9933-4f65-94b8-007220cf6348", "comment": "Malware payload", "value": "cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054642, "uuid": "453d06a4-5898-43fc-a0ed-6376c8bd3840", "comment": "Malware payload", "value": "227e61eca20d832241a1e152920c42bf049f2e69", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784054642, "uuid": "7ec0a271-7080-451b-bbf0-f39d7284e49a", "comment": "Malware payload", "value": "77cefba3b9f7a5acac16ec849f579c10289a09ee260d17e3dfc7a099ee8d214b6c5fc180d49337b448e72d0325563809", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054642, "uuid": "4c5a0883-2b22-4cc9-a0a6-c47da938e288", "value": "T108F46C11FD56C838CA62653ADCC106F23A707C024E0AED8B3518733E7FB79775A6A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054642, "uuid": "8393df1d-2319-485e-825b-ad0d4ffc89d8", "value": "12288:K17aw2vxK1HBY3EfIfRLWOK6U0x9CFbrD2iKmYhKmiOg:/TAhgCIU0uFfD2iKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784054642, "uuid": "13607d98-201b-4810-9e71-eef70ed7e405", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784054642, "uuid": "196c9d3e-9706-43b8-a9cc-58d07528f4d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784054642, "uuid": "3a3615bc-28d8-48bc-bc8e-c6a41b2e57b7", "value": "cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6466e581-7f46-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784007573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007573, "uuid": "bc95862a-dcf6-431b-95c8-1d68165fd2a8", "comment": "Malware payload (Mirai)", "value": "15970726a570e73498b1ae169f0003c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007573, "uuid": "3301bff9-cf82-48a2-a9f2-ca1da01efde1", "comment": "Malware payload (Mirai)", "value": "cc3fb9ce4d4134872205a9fef65f9e4e3b8bf2a9475bc7dfe928b7782c94f691", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007573, "uuid": "0490a095-e07f-4c13-95c4-b32aed851cf9", "comment": "Malware payload (Mirai)", "value": "1e56e37dbb9a5bb4534d302af62ac6f6cee58dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784007573, "uuid": "a9029778-95a5-48ce-896a-e49448b78eec", "comment": "Malware payload (Mirai)", "value": "98e57fa883c616a5646c1c7892012d0b638e75e7ce4f78c4c09d0f5f5e106962d468d40ae9327e26c531d99c29608c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007573, "uuid": "dd05c654-5535-4ba2-89fc-2cadf02bdb16", "value": "T15DA4234DD083B86EE1088536DFB7CDFE36AC2F123793D508D17CAA811ED95A5A1887E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007573, "uuid": "b71882b8-7486-4bc7-ad9b-3c84501019c3", "value": "12288:J3++32Ve2jamkBJvLqKvk6tjelrPf7N3KXw+m7wpoLYH:ZSe2nca6tjcnlKX7eSoLYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784007573, "uuid": "f2e8d21c-136f-4162-b8b4-c07c836fbc62", "value": 450804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784007573, "uuid": "dd6bd08e-9714-4aa8-a3b9-ae36d347650d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784007573, "uuid": "fa4b8dae-911a-46aa-8d3d-32745dacbd87", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da744a0-7f83-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784033868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033868, "uuid": "76ef9579-83b0-4cc9-b5f3-3bba832df465", "comment": "Malware payload (Mirai)", "value": "1bdbc9d9638fb6d27eff2cc2f8bb3f66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033868, "uuid": "98cf9e3a-69dc-4ffe-b7bb-7d98dbda8bb3", "comment": "Malware payload (Mirai)", "value": "cc87d09aac9bdfd20030f1a14c411bf1c9407ed31230e5ed356a2fff70ae0ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033868, "uuid": "bd102afe-15f5-4d47-b355-dbc3c8b5362f", "comment": "Malware payload (Mirai)", "value": "0815a531b81287d90fcbe954e25d30e53f624ebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784033868, "uuid": "f079eb86-3d42-4dcf-8c03-4952fa2f845a", "comment": "Malware payload (Mirai)", "value": "246e91fe98991761f4bdc99dd5ee8518d0a34f6807b6a9125eff534dd09471752154a0d193f7a7651a382084431dec2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033868, "uuid": "88b90b88-69bb-4ef2-a6a2-01917b408d0d", "value": "T126C43A4767218FA5F371C63206F347A6AAAE269213E3C551D33EE911BE5034C682FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033868, "uuid": "623c7794-4f0d-4a20-9559-21531c7f85f6", "value": "6144:HBo/yKareI28YKJKtrfQYGsDbl2FQCmVOLTi6HJ7cO1csngwFfzPSruNXLHhqqDh:HBBy8YKJKVQalzOxp35wAcqJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784033868, "uuid": "e3e4ba59-c816-497c-b0e9-c8b933486911", "value": 551004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784033868, "uuid": "9380eda8-9974-4ec2-8577-fac59bb1e758", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784033868, "uuid": "979453d7-8ed7-4d11-bf4f-05cb83d4d36b", "value": "ikydgrvum", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d65a33-7f7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784031495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031495, "uuid": "1dcef632-8684-427e-9436-a01a640fbf2d", "comment": "Malware payload", "value": "a2933db171f863abe40e96ecb3caf997", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031495, "uuid": "380534c1-284b-438c-bdf4-d7db52495e90", "comment": "Malware payload", "value": "cca1348574adbec17ae552954b595da6190ea15c2e1bb6b52f5592f82c196781", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031495, "uuid": "e6bf15e7-1155-4f01-90e0-2348c806f1d7", "comment": "Malware payload", "value": "cae28229285d02c86136a5e5bcb6c726071fe932", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784031495, "uuid": "a51f16be-2108-4b8b-936e-943ce9184a66", "comment": "Malware payload", "value": "963241237c9530def2198d954998824ccaefacb782730cf6f10dc3a3d4c3e561d4d66481282d7f76f8d16c5b989a6840", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031495, "uuid": "f9cb4eb1-3e68-4725-8d6f-e58439bac167", "value": "T114C02B976408A73C0E53BEADA777C55F8871242E61B48093FB30890D30092DCD319343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031495, "uuid": "c48c2d86-b39b-4e19-b9e5-bc1a913a5ff5", "value": "3:jeYcRm8nhr2SSJJFItGQqPJH0cVERvMXI3eEOD4o6cxpv:jeUqhrK80QO0ceuEs4oJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784031495, "uuid": "87200159-93f2-4c07-ad90-fc11fe7bee52", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784031495, "uuid": "a252c032-7118-4210-ac13-4f9445a25618", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784031495, "uuid": "5f86c4b6-ce4e-4cdb-9af7-6a6c06add877", "value": "ITF_LOGISTICS_GROUP_ONLINE_CARRIER_INVITATION.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9df1e88-7f5c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784017273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017273, "uuid": "90cb4be7-1e98-4905-aeeb-72e8d9cb1099", "comment": "Malware payload (RemusStealer)", "value": "d0a612c5bc14cb830954e6ba4dbd1e9f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017273, "uuid": "9851c35b-4a9e-4d48-bede-9c97485a3fa1", "comment": "Malware payload (RemusStealer)", "value": "cd362b63aa5130a6290d1326abc883309aa218a5869e82ecd2c106a80de61047", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017273, "uuid": "d42649b3-699c-4d88-a70a-4679c58dc555", "comment": "Malware payload (RemusStealer)", "value": "fd93e9618ec713af5483d30360f1d7b4f660d876", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784017273, "uuid": "e68f0294-9f48-4cdd-b39d-82b9af198a28", "comment": "Malware payload (RemusStealer)", "value": "1b0731ca6c8178286136a8010cc2ec6341075d0a5b5d65dbe0da1b03032eabc60a115a1feca81241ebfa9155753bbc14", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017273, "uuid": "751b0bb9-de22-44a8-b4f0-6d6a18ef8abe", "value": "T1FE943C8851A18F00FBD1A7318B71B380C61AEEBEEEE0C5695DE33DBF95715C648A1613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017273, "uuid": "c4821ea7-217a-4efa-b6f2-b333da220c3c", "value": "6144:57bQjbbS+kZm1H85ekw+x4dR6+zQdEUHQZIya+azAeHdXidbxS+I:tbQjb2+kZm1cgkw+xO6SUwZRmAewS+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784017273, "uuid": "7b3de391-0f97-47b6-933c-c55daaa3f338", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784017273, "uuid": "fe783a78-cb15-4a5e-a416-2424fad24851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784017273, "uuid": "77c79092-1ba1-48e3-9554-f0ced3b7bff0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3061575f-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "30382fbf-174b-4d4a-8c15-afbdcab04e1a", "comment": "Malware payload (ConnectWise)", "value": "765c50d86c02177d5479ae31794e8447", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "38de32c5-f312-45d0-b292-26ec0c055c34", "comment": "Malware payload (ConnectWise)", "value": "cd68d01fe8e57890fcbbe66833a8416981feda4d79148a661692fa364db66738", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "d504fc5c-0beb-450d-9655-96717404d268", "comment": "Malware payload (ConnectWise)", "value": "af959c3a23704bc5712f71031b848e0f2b286ae7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046570, "uuid": "2347c917-ec13-44d5-97ee-3c144bc2b399", "comment": "Malware payload (ConnectWise)", "value": "4b12f17693607e9d779d15d8358945ce6967faeb224d00102f1a658d18b2a6507fbc12ea5662618072ce2cf4857954dc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "3b6c6fd0-efd1-44a6-b172-c15dcfb28a51", "value": "T10946E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "4a6a466b-41da-4217-b7f9-bcaa5ac2040e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "4c04b8b1-de2f-4f3d-9a11-ca10eb0b4446", "value": "98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046570, "uuid": "69435d51-1166-4fdd-912a-43ffb5003803", "value": 5642920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046570, "uuid": "fcff2902-d108-4ac5-be23-f7be9cf42998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046570, "uuid": "0ba4d819-3690-4b27-946d-399cda7ade10", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e198675-7f79-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784029359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029359, "uuid": "160033e8-b8f2-4a5d-af81-9db399ea816e", "comment": "Malware payload (Mirai)", "value": "3b39888761c546cac24af1d1028e8f1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029359, "uuid": "b039e6e6-05e8-4066-9d0c-cdea5bb9de40", "comment": "Malware payload (Mirai)", "value": "cd91661fcf94fdf91c0ea179ca1ad2853c08228070a0caefa18aaf29baac7c90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029359, "uuid": "6df007ca-a74a-4952-a44f-8bc228ea26f5", "comment": "Malware payload (Mirai)", "value": "5c62dd0787f709e37f1fa511c89fb15612fc5c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784029359, "uuid": "013aa5f7-7f6d-47bd-aa66-b7af6504beae", "comment": "Malware payload (Mirai)", "value": "3ee394e943af59db3014d892ebb6e3bc4850abe41a1eed41990363897cb0f21782cd23b19c5a3e664894bbaa97a21f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029359, "uuid": "9d43f5b4-acbe-46cc-9dcd-ed4b6b0e0f29", "value": "T180D38E6C9D1E7DC2C2C3F2FE9D450F66312675744A68C3F6290062CEEB9EED698B1421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029359, "uuid": "eb8c80c0-f62f-40e1-be2d-6cdb50ed1e97", "value": "3072:quNTxTnM9qyJrfawGnejXd3h07i+/NPFmBdCKhR2Jjq:NNlwQUBLXdx0N/LmB4K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784029359, "uuid": "4bd34324-8acd-4dc0-a4e7-2eebfef3e7f2", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784029359, "uuid": "29d28b71-be8a-4aa0-852e-60ba052f913a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784029359, "uuid": "2077defb-ed8e-4913-8b5b-9e838ba20845", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba73b59-7f61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1784019128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019128, "uuid": "3ed9c5f1-1053-4975-8ee8-c9d7953f71ae", "comment": "Malware payload (GCleaner)", "value": "715d3af46531f2815ab9f67b47f2472d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019128, "uuid": "ec150b07-7289-4f83-87a4-ada28a406d4e", "comment": "Malware payload (GCleaner)", "value": "cdb4ac5717e2bfe3bb375d15e53fd8741c4a35e7db4f2389c29c77d66bc5cc57", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019128, "uuid": "c4182a5d-f1f4-4e95-9ded-915831331bd1", "comment": "Malware payload (GCleaner)", "value": "a912c5fa300ba329099d1ac7c71fa92452dae968", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019128, "uuid": "711aa9f5-9d77-4262-a6fe-414e6699418b", "comment": "Malware payload (GCleaner)", "value": "6193f7ea7e45b02ce4d9fd885dfba8764457fbee85c4ecdc8c28f5eb09fca010750615283ce499b5ae06ca12bfb9fbce", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019128, "uuid": "7bb8f0ae-460f-4c68-8cd7-0be40eb4b73f", "value": "T1CAF49F22A2B0D437D16237FA9D1B96B89CE6FE007D28B4492FE41D4C5F3B2917526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019128, "uuid": "b94d134a-615f-48e2-8d13-1800e4d16aaa", "value": "1b3a9b2b678ea18ea8f9582fdcd0a3d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019128, "uuid": "2c6cdb47-970d-43b9-b366-09fb5b817ebd", "value": "12288:mSfZEPofPrjBz1eXuP79Jw1emPhsZM2u9IT2ut+sWOQ9Y:hxxPrj9wa79W1Ki2u9IF6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784019128, "uuid": "d07b95c7-e0e5-46f1-86a6-c121bda93e7b", "value": 727824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784019128, "uuid": "4807c237-615f-4396-813a-33548a706343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019128, "uuid": "9006e261-30e1-49e1-84e1-8b5bcf93d2cf", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d84de4-7fa2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784046962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046962, "uuid": "6cf93852-fb7a-4f6b-b3ec-a864a6d4e176", "comment": "Malware payload", "value": "a26cdb421f012a5617ee9e7df2254fb4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046962, "uuid": "c52c7989-f241-4fae-b497-a11bde2a896a", "comment": "Malware payload", "value": "cf3dced525f0a3dd0e4047ef0669837671e655614441ed582084de9a03fd2615", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046962, "uuid": "cc5b8677-5eda-429f-a8f7-55b1ada055f9", "comment": "Malware payload", "value": "af28c720598ddc90eebd82e12f987d51f1a6fa25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046962, "uuid": "56f6d9aa-44d9-435b-bfe7-9d9a0bfd80cf", "comment": "Malware payload", "value": "4552e48dec69f3d42fe06b97b430458c2eec35652f4064bdcc3a6ab1d87de3ee056b3b71427ba9c0412d3ec3856c598b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046962, "uuid": "cf69a9dd-dd6d-4ada-8191-0f27015780dc", "value": "T104B13F91E947455681F746AB7F12A104F0C2013FCA0A6C06F2AC66963FB835EC6F2F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046962, "uuid": "98ac12b0-811c-4be7-99d3-98b409159126", "value": "96:Mh9rxdxtxTxkhQeLyDbSGxPv54HGT5uuPCk0Y2jYUzzr7V956/4S:8Tj9N7bSGxPB4mT5tPCk0Y25zDV/6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046962, "uuid": "37b60f96-6865-4fba-86d4-53cef80374ae", "value": 5145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046962, "uuid": "fb5f40ef-6e0d-46d4-9b93-f1ded533f4cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046962, "uuid": "47cb7e6a-1078-4860-a85a-c6f76f0fef28", "value": "dab.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96875e8-7f94-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784041216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041216, "uuid": "ab491f49-9360-4248-a61f-a13d93a2cebc", "comment": "Malware payload (XWorm)", "value": "0ba4eb098832e56c510956541a714114", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041216, "uuid": "55269565-b563-403f-bc33-63f08e54d343", "comment": "Malware payload (XWorm)", "value": "cf58d8b35860f544e31412542ac0fa1ec6f5f331dbbb20ea017e1d966860ba51", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041216, "uuid": "870a7584-fd33-4f40-9942-5adce39f715d", "comment": "Malware payload (XWorm)", "value": "a3dec31a1fa2be4fe4b645ba73b2362c9f9f8810", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041216, "uuid": "819b850b-e05e-47d2-a451-0657f309a90c", "comment": "Malware payload (XWorm)", "value": "875b0610cc801ca7c6b952aec849e18c67c4c4cbdf135815d535d443995f315e961dc6448a3cf836b57c17385ff60d2a", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041216, "uuid": "34589fa9-227b-4a96-8ae9-f6ba036e68da", "value": "T15BF423F53BF4D4EE96A68909BB82767B4573E100839D898FD30A1B06B240D066EDEF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041216, "uuid": "4c1c157b-db7a-476a-b0ac-861ae3040f51", "value": "12288:uXfy63hoE2MXvW1g18iiGpsZPHEwmjW/z1RxUn46MfhE5fd1ydco:aME2M+nbGpMkwSMzVUncf+5fry+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784041216, "uuid": "21dee165-bf70-41b5-bf32-fead9fba3ea2", "value": 780108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784041216, "uuid": "366778be-fab2-4a56-88e4-0310cd15aabd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041216, "uuid": "2cf918f1-b657-4f5f-aec9-57ee636f7dcd", "value": "nRFQ_OUR_REF_RET-402-14365.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51034409-7f57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784014842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014842, "uuid": "c9736ac4-ac4b-41e9-847b-04b93aa68b74", "comment": "Malware payload", "value": "66754290a4445989504a4f8e477dbd97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014842, "uuid": "851f0a05-bc06-485e-a39c-b0fbd30948bd", "comment": "Malware payload", "value": "d16ac2d831efdd58955ab62b8c52af1dfcd800e6074a3269b07be4b8af3e8bfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014842, "uuid": "35f78536-2540-4644-93e5-a855e5b08618", "comment": "Malware payload", "value": "4b5089b5b8cc2ab078315ed40cfd665cf8d0d9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014842, "uuid": "8dd8b2db-7ea3-41c5-93e5-789e29b833e9", "comment": "Malware payload", "value": "d791ec68242d72f291a7f917e6a3184419ee354df1a5d5f5258389b67a05fe4a20e5fee9d6543b47ef486188344a1c87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014842, "uuid": "62290513-eb47-4209-9e87-3cae2a2f57fb", "value": "T1AF456C17F9A214BDC6A9C534835E9223EA31B85943117DFB22D0BB202F29FA15F3D761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014842, "uuid": "260eb3a3-163a-48d1-9930-a891d61a8c09", "value": "24576:J+fb0Cbt98M+fhrMa+c3vB1CDFKBDpzf0W:IT0I8MmVMahvB1c8BDpzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014842, "uuid": "a2490219-5081-4206-9eb9-b526739393ba", "value": 1171432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014842, "uuid": "c5a950d1-5579-4090-a0f5-f0fe6101dab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014842, "uuid": "d579e34a-e75f-4ca5-ba6c-e6d9c8fb5b98", "value": "d16ac2d831efdd58955ab62b8c52af1dfcd800e6074a3269b07be4b8af3e8bfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454ee666-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LiberlyCrypt)", "timestamp": 1784035868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035868, "uuid": "df5f4830-a765-4e16-ab17-f67d889845d1", "comment": "Malware payload (LiberlyCrypt)", "value": "ad26c937b235a8db39468fb7a4dae4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiberlyCrypt", "colour": "#CFF34B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035868, "uuid": "6feb5dba-d33f-4a0c-b15a-f9910ae81275", "comment": "Malware payload (LiberlyCrypt)", "value": "d18e257734e43eb0c07ae7e8c97747744bacbabe0fc404f6943e59be7935ec76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiberlyCrypt", "colour": "#CFF34B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035868, "uuid": "915ac16f-26a5-4d5c-b182-189a7044b53c", "comment": "Malware payload (LiberlyCrypt)", "value": "ed3142a4312b880f546417c3412526d352c2f1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiberlyCrypt", "colour": "#CFF34B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035868, "uuid": "c87ae9d9-d79a-4b71-8302-03acd2b274e7", "comment": "Malware payload (LiberlyCrypt)", "value": "55090fa543adfcc9250160e5acd4a7973898dcc5b01028b171af420d8d846b2bbaf16e8d2bde4c354a35e6b5edba4b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiberlyCrypt", "colour": "#CFF34B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035868, "uuid": "20973627-1c39-40bc-94fe-6b9e70fd2522", "value": "T1FD55AA286DEA102EB333AE6D8BD4759EA95EF7B3270754B910B203860723D42DDD1739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035868, "uuid": "b953cd59-d0ea-46c7-aa18-ac17ebea304b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035868, "uuid": "89aad514-7d48-43bb-9cb6-603de53e8996", "value": "24576:kPDsRFeHa5bMTpnXe7sdA7RFaQpPRqiW1q8EspB/UyTUW4IoiQY/87LxPDsRFeHy:ksOa1MTpnXe7sdA7RFaQpPRqiW1q8EsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035868, "uuid": "9bf64f23-0dd0-44c1-802d-42b849914a09", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035868, "uuid": "f43639a0-0be6-4e49-9c7c-f08b9de04d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035868, "uuid": "291a96b2-35e5-4ac6-9ca9-aad636f46592", "value": "d18e257734e43eb0c07ae7e8c97747744bacbabe0fc404f6943e59be7935ec76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107a3323-7f72-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784026330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026330, "uuid": "b1feae57-03c6-42a3-aee1-b2606fa8f3d5", "comment": "Malware payload (Efimer)", "value": "bb4c905374d5e8c5506c6b6eb9859328", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026330, "uuid": "b872b2fa-9154-41b7-84c0-2655185618b5", "comment": "Malware payload (Efimer)", "value": "d1f43c0c7c2179f53a9eb0c8800ee2507375c3aa4dae4966e08c37472f254e5f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026330, "uuid": "1708fe29-4a5e-415a-abd9-f090e5bc2415", "comment": "Malware payload (Efimer)", "value": "4ceae2a8c8f583c9ad9c96da3a218c2a2b03ba99", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026330, "uuid": "f9a00914-58f0-4e4d-a72a-b63bd3d189e0", "comment": "Malware payload (Efimer)", "value": "9aa40029bb5f232c560fca05756fb38b5ffd37fd612907a3649812ae57829df66d484210e8384b744fbd9ca521128179", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026330, "uuid": "c7c1b28a-6207-4481-aa96-8055560c9f2d", "value": "T1F9E6335CA5F001BED6A7103CDCE215A9E6F470620731CFDB6BA843966D172E14E7E60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026330, "uuid": "92dfaf4f-cabf-428d-a102-6f1a92e4d165", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026330, "uuid": "913e65c4-458b-404f-be40-9885ff29252e", "value": "393216:ffZiWH8hg4XcD6oGbD3H6ca2XXMCHWUjXbcuI3/PGTAI:ffZzqgwi6ROcXXXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026330, "uuid": "db56bb2a-20c7-4aea-9d9e-c8840227524c", "value": 14325790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026330, "uuid": "ad7b5fdd-081f-414b-89d6-730fa7afa0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026330, "uuid": "db2f61f5-12c9-4a1c-b72d-c7c8d81c6b25", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f637c-7f53-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784013146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013146, "uuid": "02f7fd31-40fd-4c0b-814c-9474dccb248d", "comment": "Malware payload (Mirai)", "value": "43efa7599e521e4a196e94f1f3176329", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013146, "uuid": "38cc1af9-55aa-41c5-8521-e5f20392f61a", "comment": "Malware payload (Mirai)", "value": "d24d4356160ba56491bac687e5491f5eb6b63292d4ccaeb0bcae01209cf8323f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013146, "uuid": "d7138d7a-6017-4efe-a324-0730b27a41d4", "comment": "Malware payload (Mirai)", "value": "f370314ccb4b61bfc3e2714d40e76af36c77a005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784013146, "uuid": "fc372ffd-0ce8-46f6-b3c4-fc1365894e12", "comment": "Malware payload (Mirai)", "value": "eef218ec23e286494e460005a1c960e8e77d6ced518b44e4a258a0a4a8367197649b26dc70b313f0964b7873ada8651a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013146, "uuid": "a5b8c249-bd54-4ac9-a4b7-0c512e53914d", "value": "T114E3D50E6E394F6DF37AC335C7F74A209B68738626D1C649D26CF9121E2024D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013146, "uuid": "faecb91c-9745-4fdb-b3f8-a9f6082663a2", "value": "3072:cNgQfXka6/wRVnXzSn+DBedxnEgsCpsnlsJeWKyYdT/8JwYz04dDf6tEqT+8/Gzf:cNgQfXkl/6q+O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784013146, "uuid": "49449f07-55b3-4321-a9f8-de26e2a631e3", "value": 156300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784013146, "uuid": "9f66f071-768a-407c-bbee-c529afac9676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784013146, "uuid": "9797a4f3-10e9-40ab-b208-bfdc6492e6c9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71a788b-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015416, "uuid": "3b0b4cb2-afcc-45a0-bd04-113936627ff0", "comment": "Malware payload (RemcosRAT)", "value": "751822943f11796dd7f81fd3e9696d29", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015416, "uuid": "498e9d7a-a65c-4be0-b7a9-2b4b9da0058d", "comment": "Malware payload (RemcosRAT)", "value": "d26c2fb14d85c8d1d31bb271590c9c9d694a891e2db4385e6c7dc16bf6c9d481", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015416, "uuid": "ccc58fb9-3ec1-4867-ad18-a8a2c2fe8e63", "comment": "Malware payload (RemcosRAT)", "value": "6a1c199059827945852557aa9541a74677b2c1ab", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015416, "uuid": "33e518d3-0f16-411e-9e87-cef25d5c46dc", "comment": "Malware payload (RemcosRAT)", "value": "27562fc96c9ea95fc7f62ca706e4088feb4bfa3cef7a14629f7d9fedbe1e17875fa4a1b589470aaa6b6090d8a902ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015416, "uuid": "c8f1004a-1ba8-47d4-bd03-6983f6a0fc9d", "value": "T1220523A4BEE2E623C16279B018952ADA511DFCC88B6FE61F7131B32F25313E5C19B518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015416, "uuid": "279cd446-05b5-4e93-bef8-7b7597b56dee", "value": "12288:ySUGfwI82NBzTJSdXdw88AhUepk+G/799qdKFBaPNUeVoSZV6Ft28HEU2BFA8dA5:yofwI/77deXG/59nFB+oS36a8lm2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015416, "uuid": "a3cf4cea-82c8-4ca7-be5b-ce07eb87b01c", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015416, "uuid": "6ae96965-00d5-437e-97cc-66c63d123ef9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015416, "uuid": "896fa298-bf84-47e7-8f71-e062c90f8618", "value": "PO_EMG_20260714_95618.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b260a9dc-7f9c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784044640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044640, "uuid": "b36c52a9-898c-4715-ac59-f43022107609", "comment": "Malware payload", "value": "445ca07cd8910bf03f64b58c97efbad7", "object_relation": "md5", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044640, "uuid": "a65cfca3-874a-4ab3-9983-fbfe2aa4b074", "comment": "Malware payload", "value": "d44dafd48ec502e2512076ad1d66209059511292413123f87965011d5d96262e", "object_relation": "sha256", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044640, "uuid": "fe9da2e5-75df-421b-8807-a29b337443f2", "comment": "Malware payload", "value": "12afe62e0cdf124b734a57eb0c9aeb50ed841f16", "object_relation": "sha1", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044640, "uuid": "939471a2-6078-4990-b587-83da5d2c35c8", "comment": "Malware payload", "value": "c6d4b2dd8926f777c575290a1a7e40b82a7d31deb1b85d77867f41e587d201a499ced48634d1bf0b13ed6bf774bb9e64", "object_relation": "sha3-384", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044640, "uuid": "c7f92439-c2a3-40f3-a4a1-2c514506a00c", "value": "T111F23B46F3D90AA2FEF33BB02AB15349C5397D59C93BCF6C4458216B02826C89527773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044640, "uuid": "92572ee4-4c02-4f78-8153-44c7b1e4f9e2", "value": "768:gyecW4c/fxYe5fxynqwVyRaVcty1MRjCLuwyP1yFXspwbyd25UDT:+GeEqSjMRjCLYwbyNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044640, "uuid": "0cc7bc6f-8783-428f-84c5-1bfe743983f4", "value": 34566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044640, "uuid": "19d59016-27eb-420e-95ac-cdc5efc12fea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044640, "uuid": "62b0330a-1b24-4cfe-b0ae-1ce37248d5a5", "value": "interface.scpt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2862f3-7f88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ShyGuyRAT)", "timestamp": 1784035884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035884, "uuid": "506e21f4-7135-4915-a568-20ebdf95c938", "comment": "Malware payload (ShyGuyRAT)", "value": "6f95ed6c41a67d3ccdb5f5b0f9a86466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShyGuyRAT", "colour": "#F9247D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035884, "uuid": "e608ad52-bd54-4a85-8a53-aec3b7e89d57", "comment": "Malware payload (ShyGuyRAT)", "value": "d5330658c04e6b1b9b57374df216b0186fefb051ce3e868c404073be59dc7900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShyGuyRAT", "colour": "#F9247D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035884, "uuid": "34b15c36-4c2f-4ac7-92f4-a329dc7ccd62", "comment": "Malware payload (ShyGuyRAT)", "value": "7d3c0a4df9f5cf13cf852ee560bb1acdae9bc336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShyGuyRAT", "colour": "#F9247D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035884, "uuid": "74b2653d-f17e-49c5-b818-a43d686f59f2", "comment": "Malware payload (ShyGuyRAT)", "value": "f2964a65fb18a1235b0d1b0353c957c951642f1c313edb8461cd5385b07e65c7c53f6885cfacd314a060c5b8746cd47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShyGuyRAT", "colour": "#F9247D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035884, "uuid": "4ed8e61d-44a9-434a-b89f-54f67835efbb", "value": "T164A54A47E2A350ECC62BC17487679772BA30B4694134BE7F5A94CB312F31E605B6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035884, "uuid": "1f9ac456-a93f-4a13-b4f9-37b2ef9e1a3a", "value": "e58b51e27d2643a337a4088c9c7809e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035884, "uuid": "74a68086-7b31-40a4-b27c-c3703c73c160", "value": "49152:q4eVYjlduNe6ug/frVi+8BWnhdsODQuMoNLqmAC/:qNVdNeJg/ZTvsODjNfn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035884, "uuid": "0b1fa72f-6418-4d36-8f4e-48c29faceccb", "value": 2187776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035884, "uuid": "1f52b608-fa3f-430f-8c96-b6769b9e28b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035884, "uuid": "374929fe-6b6b-4337-9506-ce4d77b25f18", "value": "d5330658c04e6b1b9b57374df216b0186fefb051ce3e868c404073be59dc7900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ec8ccc-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015414, "uuid": "b544a408-0193-4bb5-894d-761b97842fe5", "comment": "Malware payload (RemcosRAT)", "value": "c6b1070c0a13309f47c23d19d20545b6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015414, "uuid": "8a964a59-45d6-4c24-ba9f-88cb435086bc", "comment": "Malware payload (RemcosRAT)", "value": "d6287df4ae15ed248d50a7bad892ef0d3900691515e76660e1c353bbe7f52fbc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015414, "uuid": "7df85b33-9a56-4d8b-b364-83e1d127e731", "comment": "Malware payload (RemcosRAT)", "value": "6f0ca2daba2a7326d2fc8689fe40789da989f0c4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015414, "uuid": "8804a0b7-7d13-42ce-925f-3359145a8721", "comment": "Malware payload (RemcosRAT)", "value": "f09685056b73856e4351fe0df58997a080f3518c029831c904c0714ea26b7669f18cfe9779de62167d4ffb7c99b4a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015414, "uuid": "8303b92d-3351-4892-9a57-c6c7b2430d8d", "value": "T189B41261B1C3DF5BDD03187898D029C20319FCA2CA5AE75FA578B32F2D3A3DE505A909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015414, "uuid": "15cfaebe-02d6-4552-9a11-77e2672caffa", "value": "12288:b+FBzTJSdXdw88AhUJgNCK99qdKF10laddcsnke1T/RKrkcnd:bG7dJg8Q9nF10lyaAXT/Urkcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015414, "uuid": "a02fb8d8-da0e-4683-849c-dbb2109e2de2", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015414, "uuid": "0571dc23-a0f2-43ea-a7fc-65dc8b9dc0d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015414, "uuid": "4eff2c77-b4a9-4c79-8eab-f98585173651", "value": "MPCC Purchase Order MPO-41720.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38824101-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039712, "uuid": "6023c43c-7638-4763-8707-59b8d298e4e8", "comment": "Malware payload (SilentNet)", "value": "ed807dbf0d5c51cde9043e62895bb9b2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039712, "uuid": "88455a5a-d160-43af-8abf-bc94ba25ecd8", "comment": "Malware payload (SilentNet)", "value": "d6b722bddef2077b09ed146d2ccc4472445a35c5a9e5ecc32143b047548a13e7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039712, "uuid": "d49fce5a-fa33-4cc8-ba87-b307b29a3aa4", "comment": "Malware payload (SilentNet)", "value": "352fa0fbbc6b16d923aec16a7bb532227361a632", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039712, "uuid": "4eafbae0-71d7-4cce-b558-9c32ac762847", "comment": "Malware payload (SilentNet)", "value": "3803125600f477eea650def8cc6f2c9efc1728e26f5d12fbb5ab404ddfc391cc0b1087c6ba81214f8c8180710dde384b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039712, "uuid": "05f449a1-ec76-4993-93e1-80c6e41c9c75", "value": "T1883633CF255E0161850EC9CD0A2BCDD77D35BF900B42678E49A27D26AE45FA8F8F8913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039712, "uuid": "ccb82421-d29c-4b2f-b8cf-359533754db0", "value": "98304:ZuccP65i+Q295x8ppeiWdpa+lalpZk31+MevOSSK3zwyOPAGJwcNue6uJ70W7l:Zc65i+9LQoLdpa+cVvOv+zFtGJwJe6ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039712, "uuid": "ea91c703-fb7b-429d-97e5-658186694f56", "value": 5266447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039712, "uuid": "507f2f78-952c-4d4d-a283-b71b2c76777e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039712, "uuid": "d2ecc366-6ec9-4305-8fc4-eeb7095777c8", "value": "Krypton newest.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a2a27b-7f71-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784026235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026235, "uuid": "d3b0e394-4fd1-4edc-a85c-adeca3fbdc27", "comment": "Malware payload", "value": "58195a8f99848bc329bdcdc087740399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026235, "uuid": "a08d48df-dc5c-4d60-bec6-3e0c234f81a7", "comment": "Malware payload", "value": "d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026235, "uuid": "a0813a5f-34d3-4ce7-9b24-e66337ea5af7", "comment": "Malware payload", "value": "be458a104c592ec41254e531902bb8fa8062cafc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026235, "uuid": "59ded449-4ecd-4b42-9302-dd71c008b924", "comment": "Malware payload", "value": "e482f4e8e59a9b8330d8a9dc0c6132840e9eb57dd1aa12c1eb39ee9ba95c4a8e9a294232868eb4a4990fabc6b39a3dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026235, "uuid": "608a902e-b24d-458c-9b4e-02a3c33762bc", "value": "T1E3E72333E606803BD8550570A96FB79A903C6B37173898CB73C82D2D1A726D3BA35E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026235, "uuid": "33245fcc-a860-4aac-b34c-f8c8e4c6744f", "value": "bf58c3b2d7c203d059420f61a6e7afa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026235, "uuid": "e60825a2-cb42-43a6-ab9a-b402806f488f", "value": "1572864:yp8X8wxFlNNxci8qU92n3Vz2M1Iha3MqoW0sdlanRl:nX8EFlNNxCTwn3Vz2Da3jNdl4Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026235, "uuid": "aca371d7-42ff-4f9f-a65c-cfc0f8710cad", "value": 68847216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026235, "uuid": "4ecb270b-ff89-4995-849c-18db905e0f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026235, "uuid": "099c9bf5-7a03-46df-8f94-8fbc4e8e3f87", "value": "d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3726bee4-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046581, "uuid": "c09797fe-cebe-4e23-b094-36ac3e3f57d4", "comment": "Malware payload (ConnectWise)", "value": "ff7b13f301311cb21ee7592ff1f09947", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046581, "uuid": "84e56e20-7167-420e-872a-fe5c2909c6b8", "comment": "Malware payload (ConnectWise)", "value": "d92594e95e83004ab04ac3eb9fa30d1f9079d13b9df210714d24c82c398e31d2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046581, "uuid": "99ec248d-d42d-421d-9bea-bd5bf2b6e417", "comment": "Malware payload (ConnectWise)", "value": "da3c5e0554f51f93f1c229c13fa26e914e60f236", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046581, "uuid": "c1e6628e-76a8-4037-9892-dd104109c65c", "comment": "Malware payload (ConnectWise)", "value": "b028044b51c09a4daf4232040017b8e5a3894fbf706fe4a0339ec128ae66dd78207ed494095d7663f7c134b6a27fbe94", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046581, "uuid": "556c51c8-aa80-42fe-a143-61b09fcf01fa", "value": "T12446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046581, "uuid": "009e0cec-fcff-4309-966a-84d1f60eeae3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046581, "uuid": "138a7b21-f285-4dee-9735-02463fae4116", "value": "98304:yzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:yhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046581, "uuid": "428989ad-e6bf-42aa-89f2-6acf6522350c", "value": 5641488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046581, "uuid": "4c682356-df10-4ac0-8413-0a87bf3847ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046581, "uuid": "e9725660-c253-4988-9121-d709a9b86a3f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5eed50-7f17-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783987588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987588, "uuid": "db759f01-efa2-4ebb-9b18-bc95dc4f698c", "comment": "Malware payload", "value": "11d9c26f611acf1e1a95d597bfda7fe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987588, "uuid": "6c0fea64-bd39-4968-8897-a358652b1415", "comment": "Malware payload", "value": "d9414d5407b92d58f72222063c2f39c49c33ee5eec7ff00a2a99f2ecca2866f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987588, "uuid": "c62f7a72-4c9e-4a0e-bcdb-e71e16574fe4", "comment": "Malware payload", "value": "bf1570ff09199a3f315d22a58b39ef3dfd59a827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987588, "uuid": "ae3f829b-cdd6-4b3e-afb5-1bae4870488e", "comment": "Malware payload", "value": "af34dda744291ca0d2fe3aa386039aafeb3c27f7cac8c2059fa041cbd4fae7d666113f982b7739e2600b06b62ba75ee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987588, "uuid": "0b7411d1-9369-40ea-b1de-88cc22ba0e7c", "value": "T149A31265EF58CF09C8B6517786DA7843370442CF976058B7ACCAA4EF948EB191D30376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987588, "uuid": "908cc68d-29c7-462c-bb33-cae1ccac770f", "value": "3072:Te8GSZ+TnZ2BN5OBs/CjsSfPFBG8xHnuy+m8T5FoSpouty:q87M4BN5Qs/CI4xH3z8tFrpoSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783987588, "uuid": "98308c81-e252-4091-8831-4c50edf4c337", "value": 105124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783987588, "uuid": "14b411da-f089-42c3-99f7-e17673a3f67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987588, "uuid": "f286fe1f-0eac-426c-81e7-674d6f57216f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de019bb-7f61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784019132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019132, "uuid": "94045108-0dad-456a-90ee-e4e7dedd8a3a", "comment": "Malware payload (Efimer)", "value": "684060325606206e6547f97e6cc8e423", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019132, "uuid": "bfbc4e9d-0f90-4ff6-b58f-df059f92a1e1", "comment": "Malware payload (Efimer)", "value": "d9c0b912f48061c64b6603bc3d1f2958bc3d9752bc4934a5a9e1dceb3b90fe72", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019132, "uuid": "3af20159-0884-46f2-a0b2-96cd90d8e759", "comment": "Malware payload (Efimer)", "value": "3e20757561ad9ebd3141199994a3057a9eaf2eed", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784019132, "uuid": "367f1374-4ebe-4e43-ae4c-8b6a4b2e06ab", "comment": "Malware payload (Efimer)", "value": "5c4ecdd79d53f6992dc24338408780f2d594f65e4cb418185b036a17779ab4a185791cd76a159512dbb68125dcc02a4d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019132, "uuid": "a2e870d3-64b6-44e2-abe6-230796dd8061", "value": "T1ECE633087AE403ECEAB7803EDCE24592E05174774775C9DF179897616CBB2E08A39B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019132, "uuid": "2e0476b4-fb8d-4921-bbe1-0bb01c82ead7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019132, "uuid": "04fe1e29-c006-4699-b01f-c1a262b9237a", "value": "393216:1SH8QqMDgrcpvpBdtBb8DtVup6/XMCHWUjXOcuI3/PGTAI:1I8hMUABbOk6/XMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784019132, "uuid": "c75a198f-f8c4-4b3c-b684-662efc209701", "value": 14326463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784019132, "uuid": "6eaf3982-1717-48e6-8a7f-bcc72dbc9408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784019132, "uuid": "273b2ae8-685e-45a7-95ef-468e3099fd85", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d11c6-7f52-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784012728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012728, "uuid": "de82d5ea-e723-42ff-8d3d-6065c140c29f", "comment": "Malware payload (ConnectWise)", "value": "018669315fa61b7c7a64c8298abd5971", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012728, "uuid": "d8d8e524-9308-4178-bc6b-e2b9359ad808", "comment": "Malware payload (ConnectWise)", "value": "dab128d1dba2feeb8762b300bc6ba32eb976cbe33274ac29c2c0d4c4eda5e6f7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012728, "uuid": "b2782853-a4e1-494d-a426-7f3f58eda4a5", "comment": "Malware payload (ConnectWise)", "value": "7f082fa8bd8540595bfcbc719dbcdb19ec7b2ceb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012728, "uuid": "0872c5d6-8f12-458a-ac29-94b60947b409", "comment": "Malware payload (ConnectWise)", "value": "0388dee6ece600b5d3ffbb61ef71a5c4ebf14ce0f7225c2fc9b125e078c069983b8ae3e075daec7a6647533cc5cb0381", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012728, "uuid": "1cfd1933-2219-4c19-9583-202cc4480a47", "value": "T195836C13B5D18475E8B20E3118B5D9B4593F7E120E648EAF3398426E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012728, "uuid": "aa915452-8f9f-4b3f-9b82-8757b69114a8", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012728, "uuid": "c7061f3a-48bc-4ee8-aa6d-2d5f61ccd7fa", "value": "1536:xazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY47RFS47:vFNpo6rIKlUE8fbkqRfbaQlaYY4NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012728, "uuid": "ccd955d9-ce65-45cb-a229-99b5d0f45603", "value": 86296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012728, "uuid": "b49c619f-e067-4b45-9890-805e8f12bbef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012728, "uuid": "5fceede1-1e4a-4691-a199-2918191b72e5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc2c5b0-7f9d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784044955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044955, "uuid": "8231a017-ff53-49c2-9afb-158089ffbcfd", "comment": "Malware payload (ConnectWise)", "value": "27a888a3dbaa952dbb432ef33815fbec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044955, "uuid": "08f3e278-7557-4e09-8bc4-9d67af23ca34", "comment": "Malware payload (ConnectWise)", "value": "daca7dff705d30c7f81ae424b54ee528e5559d7d4160eed7ffd357e294bf411e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044955, "uuid": "754f13a3-a72e-46ff-9b4a-3aba777774d3", "comment": "Malware payload (ConnectWise)", "value": "083ea9ca81bc01c51d55a276aeb1fed9b3717ad0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784044955, "uuid": "0c1bce73-048f-43ac-a9b4-3981bd5df6cd", "comment": "Malware payload (ConnectWise)", "value": "4ab277caa4c4c2391098f2255e850cc6e72707f594fd6dfdf00f948ed1fa9671f136089449d4d7b10f947eaebe93d345", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044955, "uuid": "6aef9f6d-9394-4998-aefa-e43640217657", "value": "T1DB46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044955, "uuid": "b33afc74-43bc-40e9-b334-20d62ce4ee5d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044955, "uuid": "4714cb96-66bd-4330-b461-d4b0cf7c4834", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ihfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784044955, "uuid": "7aa666f2-80c0-4d78-9fe4-9ec5a89b4428", "value": 5641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784044955, "uuid": "8d939e35-34b4-4482-9dbf-185b04407f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784044955, "uuid": "7d07c571-86fb-467e-b7ff-46475fb57005", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9901dea1-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011956, "uuid": "0b2c761f-eb88-464e-aaa6-db5cbb1a3601", "comment": "Malware payload (Mirai)", "value": "cb6fb1aade7c5a1b69ef951be6e3587f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011956, "uuid": "10847261-a760-482b-a376-19482603434a", "comment": "Malware payload (Mirai)", "value": "db61b341b00f8c9f74d0267cb5b655cd5407c6244dc87c6e8db686d27085b8b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011956, "uuid": "3367918c-4ee8-43a1-908b-56596b093bd7", "comment": "Malware payload (Mirai)", "value": "dea96e78441cd3f468a49d33f50240750218bc63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011956, "uuid": "1bcaf3cd-2fdf-4eca-8627-ba40728e0bf7", "comment": "Malware payload (Mirai)", "value": "5146132b2d0d308a83d13fc92d38617273de0e2747117f49bd8861b17104a706458f994f7eab97f7b906693afcad6fd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011956, "uuid": "fcf1cf1b-4ab0-46cd-b79e-523de211d045", "value": "T15CD34B07B4C184FDC8D9C2748FABB13BED76B1691238B16B27D4AA275E89E305F1D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011956, "uuid": "13f377c1-69c7-4ab5-931a-e4d592a6c646", "value": "3072:xYeLBug78AJT5UDpPpQZYkqY4egg+MCufpy92ilE:xYeLBug78ABiDp3YiIUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011956, "uuid": "6cee5c6c-cd43-4514-8b67-95c94ed5a3c9", "value": 139432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011956, "uuid": "7ff92b8d-624b-47dd-8941-597e55b3c017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011956, "uuid": "894103a5-fb06-41ec-88c6-71443897cd78", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42441bfb-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039728, "uuid": "00018da0-135b-4678-a65b-ba5c7599f965", "comment": "Malware payload (SilentNet)", "value": "98db820fbd497d37e1015efbe53c875c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039728, "uuid": "7644b6e0-cba7-46ab-8f99-b4e29c6593d9", "comment": "Malware payload (SilentNet)", "value": "db82da00eda13f472d231374d0d6f7bc43e913dde50a1d6ec4ee723d930b99a8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039728, "uuid": "0712981b-b293-4386-9a9b-79ee34425ce7", "comment": "Malware payload (SilentNet)", "value": "a36cbddabba301b33c521fee08a8ea7ac37d9ce9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039728, "uuid": "143669db-a0bb-414b-8a92-9a11bebef918", "comment": "Malware payload (SilentNet)", "value": "da966263b2a0c9db756632572c34f8fa0018067c574a8fb28d707c5d72f1270633b5eaf505c81de5c405e05816360fb2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039728, "uuid": "9d341f21-8b67-4357-b8da-083c71ed7b94", "value": "T1F2963382B25736A4043F6D101D0B7A04DA77D096D6899B36601F27EA862F8F0877DAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039728, "uuid": "cffd0825-4464-407e-8b34-504784069b77", "value": "196608:jpVq8ePYhsYIHIAVIqMkaZsAvyK+z6rAFN3Km/e60lu:jp3ePxpIRkaZs0EzCAFN3XV0lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039728, "uuid": "5b9f1e43-b35e-4597-a9d0-bf16af6bf324", "value": 8674897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039728, "uuid": "d869a602-ce03-46ba-871f-8bb2f4f783bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039728, "uuid": "f896e28e-2bc0-40f0-b278-50d66b0f559d", "value": "NopushAna.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4981342e-7f7f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784032009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032009, "uuid": "4f178106-3f7b-45cc-95a4-52239bc8180b", "comment": "Malware payload", "value": "c518d7d0b08b6a4cf4efab6e04424d2c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032009, "uuid": "f03db1af-1c5c-4c8a-bf07-eff16f19a0bd", "comment": "Malware payload", "value": "dbc68a93779fa617adf482d6eac48113d24a82d36ac6031955322257aac5b1b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032009, "uuid": "4c1baa69-c446-415e-893c-3b85c4aa8c88", "comment": "Malware payload", "value": "3e297bf4683e152190a008ca3f0de9a32ed5a27c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032009, "uuid": "86d475ff-5fee-4747-872e-afcd3ca15b4d", "comment": "Malware payload", "value": "0ea4fec5b00779a329076d161490c683cd7759cd55da52a918018d48069c1c8eb4566c00b274d65933279dc52711297b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032009, "uuid": "08f7eeb7-408d-4e3e-99ee-17dc3220cd7b", "value": "T1E2C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032009, "uuid": "ea6c09c5-9d2c-4a4e-a81a-2bae13471e5a", "value": "768:t8vCB+25j6es8R89FYpMSUpi+20qUpi+20YQX:t8l25JKd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784032009, "uuid": "67ddf03d-cfe4-46d1-803e-e49cc418e6bd", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784032009, "uuid": "6a20aa09-9352-4f3b-92b7-9718030292ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032009, "uuid": "5caa8e32-74e6-4506-9ccd-3cb3bc920a0d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900aa336-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "4e285fb2-2a13-4ef8-b83e-617938fe5a54", "comment": "Malware payload (Mirai)", "value": "cc738f0ef7d882ef749ed8191ee74cfc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "08c846e8-6401-4ebb-8c5d-703d1522c17b", "comment": "Malware payload (Mirai)", "value": "dbca1c3e503c01fe187eac505ff4352a62aeb368a769e5a093d3c643cb5f25b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "cf14b0f6-085e-4331-8847-78381005dc37", "comment": "Malware payload (Mirai)", "value": "4a51fbb88212af3365b72d0d12da3c88d80fa583", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "cbba2a8f-f0dc-450c-85d5-e61077366e8d", "comment": "Malware payload (Mirai)", "value": "6974677cc40f8cfed0c642c94e447822d908444a5f99893c76c6f09bee02462d9c4e139cb509a36e96e036d22ac383c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "b2ef9f1f-9f2b-4638-b6a7-9de7ba254e89", "value": "T11C31219056D05DBCCCE491BEAD460320B3649F40E0C77263952C6F54FD2AE7C5C2740B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "dce30ec5-7464-4234-b807-4730986756ec", "value": "24:FouKGpa7Urz/jlfQAXK1G9Vev3gRGRP9iMjBBunD8oVlxrR+z3LNs:fKGpa7UrLZQ/RlP9BuDzlxrs3LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011941, "uuid": "029adb96-ab06-423d-b35f-68ca35b2d837", "value": 1464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011941, "uuid": "7172347b-c004-4d05-a5f0-0dc9c8179c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "f73c5071-dd4d-4554-aede-38bfb4a3b2ce", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f6ae4b-7fdd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784072638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072638, "uuid": "74849433-ca1d-46e6-8420-ac30669fff66", "comment": "Malware payload (PureLogsStealer)", "value": "8241127f4521046c5b38a78b7f5c94ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072638, "uuid": "5d316941-ef87-47a9-815f-39030453d131", "comment": "Malware payload (PureLogsStealer)", "value": "dc6790cdf758ba93696edf19d490d1fbb59a4312d456c77a498ccf3b955e1572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072638, "uuid": "7faff8e6-fe6a-4c2c-b60d-98ba6d00d0f4", "comment": "Malware payload (PureLogsStealer)", "value": "8cd75c44d701bf536b73f2156fadcf843e8a101d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784072638, "uuid": "7a9f1ff3-ef9a-4c3e-b904-5f13d0675298", "comment": "Malware payload (PureLogsStealer)", "value": "0a257a766f515a5bace3df3b52223cb703c03ecd0e5afcaf9f3ca861e9c5cdc88f067a35bc8813cf40ae760f310e3b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072638, "uuid": "f7868398-0ec0-41df-ad92-cc5018306902", "value": "T15B059E3A72914E12C24A13B3C1D74A0093A6D65777ABFB0F31C913DB19463EEEE06697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072638, "uuid": "0622dfdd-9392-4bbc-ac52-dfe3a1ce6040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072638, "uuid": "59434145-5d3d-44bb-bc65-991abac6e06d", "value": "12288:U6r5wwNCBjbP8QkZBobbF6Cmu3YTHKu9IjiPJbw18HWKXx0mz:WlpsBot6Q3Y2u9mkJfH5xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784072638, "uuid": "402906fb-18de-4d1c-a6b8-ded4a8dbc9dc", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784072638, "uuid": "7c0b3334-8da7-437c-bfdd-cb03e00887ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784072638, "uuid": "b2fbeafd-b036-409a-bbdf-4a56256309f5", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.59112575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c814700-7fb5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784055126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055126, "uuid": "b2946714-29c3-46ce-9b91-a338a7a47084", "comment": "Malware payload (Efimer)", "value": "8095389bbb2b28ed85516e43ad2c9636", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055126, "uuid": "63aa8298-d766-47c5-91be-0247ef01aafa", "comment": "Malware payload (Efimer)", "value": "dcb9772a15cc16d9bed50c4be2724b30629f6c2437239a99327445840dda4185", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055126, "uuid": "5a82c419-b387-4c67-862b-055995709a9c", "comment": "Malware payload (Efimer)", "value": "5228a14d784ee65cfbf0753adaf7729bf906cfbf", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784055126, "uuid": "2e4f61ae-bb7d-408c-9920-6c0bec2ff98b", "comment": "Malware payload (Efimer)", "value": "f30d494677efad590fe232fe88fd7302b112d8be4f3ff25045e050698f7ada39f9810bb1ccfa1015d43fe2a9d19b390f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055126, "uuid": "c4a38902-90dc-414c-abd2-1efca4347950", "value": "T1EAE6334DAAE021FEC6774239FEC21315F86478750B76CBCB4AB4A3596E131C9493DA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055126, "uuid": "d382146b-736e-4a1c-a2d4-849f09966a1b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055126, "uuid": "889bdb78-68d0-4749-a7fa-06fbddd5930b", "value": "393216:agyswpdnQE1SghMi4783wXMCHWUjXHcuI3/PGTAI:ag6aC2B7+wXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784055126, "uuid": "d3f7fe89-1da6-4687-9ffa-ba27e4957e94", "value": 14281288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784055126, "uuid": "54ba26f3-682b-4646-9402-5fd2276faa30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784055126, "uuid": "f586713c-9d37-4b99-8bf1-c9abff90b0ab", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a80c49-7fab-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784050842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050842, "uuid": "c322797c-3f97-4063-8bbf-bcf439387791", "comment": "Malware payload", "value": "4f0d9b5c234423981bf8a825af8e6738", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050842, "uuid": "5b99a00e-93f2-4020-8e5a-3eee2cbf914b", "comment": "Malware payload", "value": "dd131beed1da6ccee24174b28153ff11d65f69be9c7dd92eb2efe683b017ff3e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050842, "uuid": "c5cced6f-2e93-450c-bfdd-ca08e2bfb3e2", "comment": "Malware payload", "value": "c00852244687d1b9d6f1882026966994251edcd5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050842, "uuid": "c6438fa4-9dbf-4b96-86dd-ae8d5ad8b7b9", "comment": "Malware payload", "value": "5adc2b265b129255b26e6e76a26a6a8cbc05cd6e12ecad7f2e2f8f858262a9920c9a413d7e23a7492d5b9e79101b2b59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050842, "uuid": "7e70c280-f3c4-4b2c-a201-3f95fff73f7c", "value": "T1C3136C652A953C25AE9988371C7E2F0CBDA983E1310851DDBFCA3CF18C49A9CE71971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050842, "uuid": "520a1328-524e-41c4-bb28-a8cee6b907fd", "value": "768:Hcsr0a1ldy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:3hXcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784050842, "uuid": "6f4a34c7-c6be-4f62-9795-f8e24ab2a57c", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784050842, "uuid": "f0911296-2b3f-48c3-868e-093b35abbfa1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050842, "uuid": "9189f77c-c569-4081-8bd0-870041268b18", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592e790b-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022157, "uuid": "2a3fa754-1203-4121-a8bd-0ac8cf5b9431", "comment": "Malware payload (AgentTesla)", "value": "a52fbb944b46f4bffd2c40ad34a2ef96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022157, "uuid": "8ceb29aa-dc4f-4012-a734-46afeb1d8f3e", "comment": "Malware payload (AgentTesla)", "value": "ddbdedcb74847b4e8ae0d9d0cd750cffcfac44d10833af23c0ab9829c6ba56a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022157, "uuid": "439ae97e-d1b6-40c6-a05b-21887605435d", "comment": "Malware payload (AgentTesla)", "value": "da5c31b6d2d0f5873f919f5e244a1412ba80b525", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022157, "uuid": "a5ca7c43-dcf6-4ae9-8780-2abfd5c6099d", "comment": "Malware payload (AgentTesla)", "value": "2d7a389e4ee7e8acd7afed3c5b47b4f75de7cef6419e064fb9afd39fe55e2915d67e8b3be34685ffda1945ea670cab7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022157, "uuid": "f1369fe6-fb8c-461b-8930-7a02102e8cdc", "value": "T180453344E24980A3FE159C8C51D872EE65F0E2A708B9CB02873796AE446FFD5C7C3A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022157, "uuid": "3ad3673a-1a6f-4102-abe1-a281db8fa960", "value": "24576:qAx7/bxXiFJfh1y2vLPF8/cCcBM9VTm+eGg6tYLWBMzBwZNZrXShgMGxOL2:5thi/Xjj9uMBMe+CW6zWZN1ShgMiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022157, "uuid": "a207d7a0-06df-4e1a-b983-2cb7a579552a", "value": 1202906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022157, "uuid": "7f63f0ff-3ed3-4691-98bc-e9db541818df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022157, "uuid": "b9986a07-c456-43a2-b5e4-9c12606b356f", "value": "ddbdedcb74847b4e8ae0d9d0cd750cffcfac44d10833af23c0ab9829c6ba56a9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f522de-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784024010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024010, "uuid": "f6a7a585-f719-4fca-a6a2-1db7c3c08b64", "comment": "Malware payload (PhantomStealer)", "value": "1dc640ac2c98c0416625cefd4bb52ab3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024010, "uuid": "e4a85e6c-04f7-4d5d-b3cd-366479cf4423", "comment": "Malware payload (PhantomStealer)", "value": "e0ef2f51891d03970f347ba0b81823d748ba4d1f973bb392af61e9e950a7a002", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024010, "uuid": "a0b01d25-a047-425d-8837-d980bd40d195", "comment": "Malware payload (PhantomStealer)", "value": "cd093a5a06be8278f206500add90cf5c9df3b8d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024010, "uuid": "5e2f686e-0506-48e4-aeac-0cb081e97065", "comment": "Malware payload (PhantomStealer)", "value": "df797ab0d1cd2472b4c7b6a6d289264f8d5b4f849febaab2af0564e0babbca2bd8356a6ca3d3ca9f05fd86b66cd4fab8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024010, "uuid": "959b72f2-7f64-4902-8e0e-b5ae3776373f", "value": "T1B726F1204FC81FBFCAAC1A18D0BE165EB3E106891567BCCAEF737D499FAA70051171A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024010, "uuid": "123761fe-3354-403a-ac4d-1b37ef73865b", "value": "49152:wlxLmqyaW4+2PF8G+kdKJzkPenOyhpCQaxS/XhW5PQbDTPaLs7L3Z:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024010, "uuid": "7105c9c8-ad7f-4a8f-a84d-08ec7e40e6f6", "value": 4824635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024010, "uuid": "a4591012-0bd2-4663-a1c3-d1cbc31f8103", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024010, "uuid": "c073acd0-2c3b-47c7-823f-6b2437f377e4", "value": "11032026MZQQQ62170011_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21739ab3-7fc6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784062436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062436, "uuid": "25e24cbe-8c29-453a-8c0b-e41f0d0f4eb8", "comment": "Malware payload (Mirai)", "value": "c8294f9361c29a8913bfe938bd967773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062436, "uuid": "188acb37-ec70-403f-80e4-913dd1d852d4", "comment": "Malware payload (Mirai)", "value": "e1d2d45b8f5c4fb4eb7ea1ca4833696e8fd87a706fbb8a89f614bd53d314cffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062436, "uuid": "9e9a2f87-b73a-444f-abca-932d7c73241e", "comment": "Malware payload (Mirai)", "value": "a4d986d2b87c96a541d03b2e52aea50767efda6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062436, "uuid": "22df0d02-bc80-4a0e-91c3-67cc06c10abb", "comment": "Malware payload (Mirai)", "value": "01cbae0ebe7b2e6cddb2d6173ce652a1733fd6818bc164fa117519c2eab7a1c1f3b95a83157e6b30db20f1e2851a727c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062436, "uuid": "00c3a4b9-fef9-44d3-b527-66c917e6b02c", "value": "T189148D68FE4F68D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062436, "uuid": "9143beea-79ab-4627-85ba-a8363311aaff", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxp:bOVfbEdxm4iubD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062436, "uuid": "2d3444d9-6ed3-42a9-919c-849c5c9281ee", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062436, "uuid": "84b3ec2e-b651-4eaf-b775-29ab35b212cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062436, "uuid": "a5c1ab1f-47ef-461e-8c38-02b9dbbd76e3", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23302100-7f52-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784012617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012617, "uuid": "8b1fed19-dd28-4d34-b964-22206db05a77", "comment": "Malware payload (PureRAT)", "value": "12be7a6c060a27bbed222ab8181ba592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012617, "uuid": "3316ae50-83b0-4c87-a6e8-dace82597104", "comment": "Malware payload (PureRAT)", "value": "e30c4e9e950ee26b0480a07c5a5128167a76b64dfac40ae06a0bb070a80838a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012617, "uuid": "fdf434ba-0e88-4502-ac38-68a7f0d0df7f", "comment": "Malware payload (PureRAT)", "value": "cf918f6f67e2f0eaf5aa329280199a0c4adc9f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012617, "uuid": "0fe4c6a5-8ecb-4260-aea9-4eab367c7df6", "comment": "Malware payload (PureRAT)", "value": "f5190940203472ded98b29886951eb7d066bbb1fc7f3a421ad551fe02c2b62d15fcf8b6439aebbcc40bb9b04fc1a8d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012617, "uuid": "8508ae2b-26b5-4b43-85d4-f24154aae079", "value": "T1C6C78E517602C67EDAB191B1CD389A2EC619DE550B9045C7B1BC2F3D2F368D22B32EC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012617, "uuid": "e42520ff-3af5-497c-bb17-c45dde40503a", "value": "e2c39c51a01eb6c331bece639d372272", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012617, "uuid": "feebd090-cc37-4f01-8361-7d493d4304d6", "value": "786432:XzPvUHPaEou1qbUIXt947aVqZthmDoHBT8jgvtr4:XzPcHPaEou1YJO8UT87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012617, "uuid": "2f5a3319-42e3-405f-b392-804a276599f8", "value": 53753856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012617, "uuid": "1b0e06fd-f17e-40c6-b566-68b284ffc16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012617, "uuid": "624cd1a1-8638-479d-8851-3ce3f08b5b81", "value": "12be7a6c060a27bbed222ab8181ba592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435a2b82-7f86-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784035005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035005, "uuid": "6ee3d782-2b48-4919-b0a4-c5c91daf572a", "comment": "Malware payload (Mirai)", "value": "f4462f28859929e1b26052519c2d3f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035005, "uuid": "7307ebf7-3ac1-4103-a319-68e5eb0bc0e4", "comment": "Malware payload (Mirai)", "value": "e33b85ce4d37ecdf5ed7c28bbc28af4de1681596f57766dd0ea74bda6eababc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035005, "uuid": "80c1e6ce-b3e1-4aae-9250-59a18938216d", "comment": "Malware payload (Mirai)", "value": "a10a65173e330936991344a03f2427b10bd5612d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784035005, "uuid": "3166828f-a67f-495f-961e-72ae1fea7516", "comment": "Malware payload (Mirai)", "value": "2cae12412952425e67c7306b6c2b77eb2ee0b3b68fb4531c3e3fc52cbf77607d9283e362aedb9243f033c2ce7625bf20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035005, "uuid": "2e0e6460-d2fb-4b33-8d08-a76e6553808b", "value": "T1D3838D68EA0F6D81C2C6E7BEBD5A0FA270333CB48364C1B25A01F65DD4E9ED48D95127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035005, "uuid": "3cef12cb-6ccb-4370-b7ee-32225c935026", "value": "1536:gOqkr4ipKKiCzMSSYy+3zfBLRrrckgKOC54L6CjIr:zqspYvAjfxREkgKhRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784035005, "uuid": "41344e2e-4460-416f-9da1-4b9d20d97b88", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784035005, "uuid": "85c296e1-a77c-4086-b155-7429df7623e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784035005, "uuid": "d687663b-0d28-453c-b0cc-39b9f95b9b8d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa44770-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022624, "uuid": "25ed0c4b-d946-42b3-8b9f-89932ae24157", "comment": "Malware payload", "value": "2e8607a5d2c62e00167bba86659f5230", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022624, "uuid": "63b4e171-645e-4963-a939-c79ff5043395", "comment": "Malware payload", "value": "e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022624, "uuid": "b5227b83-0382-420f-9ee4-26c627fc3ffd", "comment": "Malware payload", "value": "3f38da1cd2f10ec0cd4fbcceb90b0c886b4f5558", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022624, "uuid": "1193f2c7-d0a4-4f0c-9b5c-bd401f47bfc9", "comment": "Malware payload", "value": "aea8c17537e02346597c6da8bddd0b3d9ad01c7111f074b5f2fd75f65917ecdd21702e749c095afd12cb10dc2a665719", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022624, "uuid": "3474be94-b65b-4269-a677-4ef8751ab716", "value": "T1CDF0C903C75C98D4E95822B4842F0F701EB2F83E011A12034FF3E8617C0B881AD50144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022624, "uuid": "b5cab567-6fd7-487b-ab5a-86bb9d51c9f9", "value": "6:BnX//IPyOtSt22e/ta/VttqD7qGpnvC8:BvwPyOgt2LQHw7qWvC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022624, "uuid": "260d1046-c3ba-4509-9317-0b8fe7e70a0d", "value": 512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022624, "uuid": "e2e8805c-9154-45bf-978c-f105e53647f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022624, "uuid": "d4e9a8ff-e1b1-4d64-bff6-4edf9ff096db", "value": "e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056780c0-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022016, "uuid": "52d28799-15bf-4e17-9a92-c1706b30b129", "comment": "Malware payload (AgentTesla)", "value": "8951ce27300748d7b3d471020fbbd830", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022016, "uuid": "cd48d922-42ab-46b6-b668-b0a558f8b14b", "comment": "Malware payload (AgentTesla)", "value": "e3a7b527e98ba28056ccaf3c3504d067714782de35c5f5141781f12cb894c4b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022016, "uuid": "765ca0bb-fc94-42f6-b4c0-42f2ca413ce9", "comment": "Malware payload (AgentTesla)", "value": "e96244a68e280ef833f34ee984557ac35deb2c57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022016, "uuid": "49a3ed32-8fd8-4701-b716-e316141861b6", "comment": "Malware payload (AgentTesla)", "value": "3d9142331c11dcb44d3cce6cb6e4d8e7b455f4769263e8b08c798ad542850f5d083d74b5471b98cdd2965207ad583081", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022016, "uuid": "e8c14268-27f6-44c7-b291-939bee26f585", "value": "T198340F027F88EB15E1A93E3782EF6C2453B2B4C71733C60B6F49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022016, "uuid": "c405058a-c7db-4a31-82f0-d4547ac3abcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022016, "uuid": "85d79a18-4ead-42bc-9349-c2ef17ecfc1e", "value": "3072:BUxayCK6VGFwVasuFoIkTHo9rG8KaG5jnTheqEufzz:iayCK6UFyoesq8KaWTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022016, "uuid": "1d4e3fee-4245-4e16-8ce1-21c17a532349", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022016, "uuid": "da03180b-a275-4c06-b642-3d9e30851a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022016, "uuid": "1f88523a-af76-4986-8ce9-c8a1743d5ed4", "value": "e3a7b527e98ba28056ccaf3c3504d067714782de35c5f5141781f12cb894c4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3882bde8-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784023820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023820, "uuid": "3ff82e2e-f3c8-46f1-a07a-0114d0d17480", "comment": "Malware payload (AgentTesla)", "value": "2c22a2f44bc60d770a66e63767265558", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023820, "uuid": "c8bf2779-b046-4d53-a3e3-dd6bc43956c8", "comment": "Malware payload (AgentTesla)", "value": "e49a106bc6960b958ff9ae49c483ff636d3fdbc817229ef0c8c152c32aa3f611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023820, "uuid": "ea3056b0-27ed-4af7-9889-662f96df6a99", "comment": "Malware payload (AgentTesla)", "value": "adf06715f3d8412d03cee0ab58c109a34a4c6f53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023820, "uuid": "6f2fa1d9-75d8-47f4-98cf-88bc3a07cf11", "comment": "Malware payload (AgentTesla)", "value": "218090b17be0bbc17c2afc01256be95e5c7adf9e8528c04dd226de5ae4d2c86c81a7887f0bd14ddef0456660e8f17cbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023820, "uuid": "8880bf31-4e62-4750-a3d7-3c00a460d797", "value": "T140F5F85157A461727730DB9E9236EE38B40F605728EACF04356ED228792DD8BD348BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023820, "uuid": "3d429f90-244d-40ad-8a01-eb145a016e3d", "value": "98304:b3OCbcWq7YLIt7qFDtkGJ7Qkn5EXyVVOWhgQTI0Htlgcv8wfJlP4ktW:b3OCkYk6tkY5bA8t6cv8LktW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023820, "uuid": "b3c6235b-7de5-404e-bdd7-48ac4e6d7c7c", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023820, "uuid": "fca23a6c-b79d-4d1e-b420-4b339d9ae462", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023820, "uuid": "5bb85859-0783-4114-8ada-ce313ad4330e", "value": "FACTURA Y ALBARANES 20261004160348265.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c827c3-7f68-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022022, "uuid": "4a705102-d66e-47b3-8abb-24431e86db70", "comment": "Malware payload (AgentTesla)", "value": "4df01b918569068a3a0199826627abde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022022, "uuid": "02df65e5-7fbd-4d58-a97d-6a59813688c3", "comment": "Malware payload (AgentTesla)", "value": "e51673c5981d94544b0392939ce7c0ac0f31bad427b1ea6ea998634b8e443b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022022, "uuid": "bd16cbb2-b131-44e9-9ae4-4149f8b0f9b1", "comment": "Malware payload (AgentTesla)", "value": "65a8ef55ec58fefe4b376547e0779f003b05bab5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022022, "uuid": "49c27a82-affc-40d0-8f8d-972a383d5f5c", "comment": "Malware payload (AgentTesla)", "value": "d000b80fe8fd9983a8fb89bf06bf2c3b4fc03fb4e0c3aed31de15fccace8ee3eaea9bbed738154c591a6f7b72985360e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022022, "uuid": "22c7bf02-33a1-4959-8713-433204e56f40", "value": "T147340F027F88E715E1A97E3782EF2C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022022, "uuid": "6ecc4472-80e0-4179-87a7-046ddb9bec0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022022, "uuid": "752e3511-a522-4c1d-890d-c4ccd818c729", "value": "3072:NmUZ+M/yCK6i7InxrtAmEkEeTHo9rG8KaG5jnThyScufzz:4UZ+eyCK6i8xrk4sq8KaWT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022022, "uuid": "b4423f85-f40a-445f-a61a-4b713489cc42", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022022, "uuid": "047974ed-a3ac-491a-ab4a-26c56a9fd629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022022, "uuid": "6b0c8974-f6d0-46e4-8069-942dbadc227e", "value": "e51673c5981d94544b0392939ce7c0ac0f31bad427b1ea6ea998634b8e443b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cbbc24-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784024003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024003, "uuid": "ef9083cb-7a1b-43e7-a570-195e9171af3e", "comment": "Malware payload (AsyncRAT)", "value": "a4c9e8fcb341e16a15bb669b4668d07c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024003, "uuid": "f537a020-efbb-491b-932c-7fbc7db680ce", "comment": "Malware payload (AsyncRAT)", "value": "e5b838465187678ecd5392d4c7503ecf9f920c56cb2c537e46f2265aa6b9dc86", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024003, "uuid": "54ea3203-10be-4192-9d6a-cb7d625ba3d2", "comment": "Malware payload (AsyncRAT)", "value": "677e4c2a9daf21ff97b680a7e547d84d4daa7cc4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024003, "uuid": "e3f7d7a9-d561-48d3-a924-33980f560b7a", "comment": "Malware payload (AsyncRAT)", "value": "9afe5e9345b7f025a1a066de407717b73a4a70108dacd2b67c982e646d49a847043c346852b366e7b514c29b202d49cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024003, "uuid": "a95db6f0-08c2-4273-8267-9f5b6663f158", "value": "T1DEC4D0101FC07AA983F42F2B91AE25DEFAD30A8E60554CCBD791BE44E7A1702E573634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024003, "uuid": "191a94ce-9705-4ac4-83cd-e010ac4b6ea2", "value": "12288:hqqtpZiZ3Vdm1LKJQzQ8BX5Q5AxidKWYH8ybr+07LIAEii/QvZJ58:vgyLn8KX502isbhLIHiBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024003, "uuid": "1f27fe75-c848-4495-b098-d0d5a43b40d4", "value": 546551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024003, "uuid": "1191d749-b558-492a-a499-98c905dea883", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024003, "uuid": "4c3962e1-3e31-43f4-9937-a7163b630f28", "value": "Hesap_Hareketleri14-07-2026_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef101ad7-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021979, "uuid": "394e5cbb-1f86-45ea-acdc-2521f0bf3713", "comment": "Malware payload (AgentTesla)", "value": "f792efe46770c6f28b9acb2e839a8932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021979, "uuid": "c8b3eaba-a7f2-43f8-a364-805332429800", "comment": "Malware payload (AgentTesla)", "value": "e5c13f9e47e68438085c267221b492622e090901a250d6803b31b0f61677ba54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021979, "uuid": "14373cfc-9fba-4c7b-a0b9-0b0814a5e0ba", "comment": "Malware payload (AgentTesla)", "value": "2f9f03e738f5bb6c4bccaf729a4d9312946a6b56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021979, "uuid": "ae984c0e-19a1-44b1-baf1-00beb23b7828", "comment": "Malware payload (AgentTesla)", "value": "dcca4000990a82ea455dc3bdd1c5728a489ae60a1cc5cb25433c2dc99f33d2f23ec9a07189e2d5e6766821f7c807126a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021979, "uuid": "6492b9c8-2e67-4b19-b704-b11ceedce13f", "value": "T1107533158D6AEF422CBD5F9930E5E308CAAA803E36B5534A5B80BDC70262144577FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021979, "uuid": "6850a100-391d-47d1-8d03-9dc846f2c264", "value": "49152:aGO3BXWn2UvYZBBebj9H89Qj9BtJGjkk9d:ZOJ5UvkqZf+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021979, "uuid": "0f02a091-bdf9-4008-a8bb-5a1ae1b86a0e", "value": 1576754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021979, "uuid": "97ca4e0b-8e56-439b-9944-07ba81f8d131", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021979, "uuid": "696eb2e6-c64a-432c-b601-4225fee5f319", "value": "e5c13f9e47e68438085c267221b492622e090901a250d6803b31b0f61677ba54.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17325126-7fa3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784047387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047387, "uuid": "37c58da7-56ae-48ba-bdb4-dc548e9b3211", "comment": "Malware payload (ConnectWise)", "value": "8ecc5edc858de3a14cbefeef7f790877", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047387, "uuid": "17472f5f-87ff-427e-8d69-d0cc8b06bc7b", "comment": "Malware payload (ConnectWise)", "value": "e5ce25903af4383079e1378ab0a1b07275631aedcfe4e41df96c2431d598aebb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047387, "uuid": "ca9914e5-18aa-4257-a961-3d6b5ec2fe83", "comment": "Malware payload (ConnectWise)", "value": "2b28d2475238d31c8f7c55ea5a521a6117bd803e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784047387, "uuid": "c8145523-1bc8-4205-bdd0-16c24fc5c3eb", "comment": "Malware payload (ConnectWise)", "value": "cadd7bfd8fda30bf4bbe53bcd75b73e3569babb9cb057901997b2e9521e6d99f982b5647b7e62fa776cf4037f65c6d26", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047387, "uuid": "cbf1d0aa-bfb6-4f62-84a0-e8c28319551d", "value": "T1DA46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047387, "uuid": "4d6d4bda-3824-4c5f-a115-ee6db13a319d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047387, "uuid": "71c88ffd-a1c6-446d-b06f-40f5896cfd26", "value": "98304:4zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:4hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784047387, "uuid": "52a90434-8891-4a24-85a5-fd9ee3ecf4b2", "value": 5659600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784047387, "uuid": "55fe072b-a9b8-4781-b9fd-314d3b0886b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784047387, "uuid": "898ddcad-d875-4ce0-9e6b-2465d3cf4896", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80209bad-7f7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784030812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030812, "uuid": "807fb515-2e66-40b4-9f48-2ccead46664b", "comment": "Malware payload", "value": "2a6c80fb2171c9bb9c03ce8b511b55cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030812, "uuid": "f25ca744-cb7a-4f17-98a9-88a3a96181ab", "comment": "Malware payload", "value": "e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030812, "uuid": "9bbcb3fd-2bcc-4206-bcdc-24532dfab77a", "comment": "Malware payload", "value": "8755fd56ecbee23b66657335b233897f98281177", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030812, "uuid": "3f8118df-8334-4c6b-b95c-75957d9cc35d", "comment": "Malware payload", "value": "00bd8544fea7dc7e9df6d09f7acf2a79ea57be15d6d231087a34ad75e3dc636733e7bca892a8a83c5af8d09d9ce1dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030812, "uuid": "acad8f5a-c46d-40b5-a33b-34be987a51f3", "value": "T154016FCA4640F900421D9A6D62A755D4B821D3CE0A460F687FDC9D2DF798914B13AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030812, "uuid": "2cfb36d1-d938-4956-bc1c-11cf1792d6e0", "value": "24:kXCKysE2hi0ziQvZoha+jv7E0FRh7EtGN6lEU0A7:e9Qp+Ms+vNf7E0QEfA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030812, "uuid": "92ecb0fd-e85d-4e6e-bbb5-ddfc219039b9", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030812, "uuid": "842bab36-8669-477c-8e6a-ba16172cc622", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030812, "uuid": "b4a9769b-b906-42d5-beda-6618a8a0a872", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcfaae4-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "6b71a128-a1da-4d6d-a9b4-86c136f42583", "comment": "Malware payload (Mirai)", "value": "46a1e30dfa224844cd3447f37c29c5fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "cc965b9d-03f0-4c61-945a-efc344908678", "comment": "Malware payload (Mirai)", "value": "e6b21d5918650869d480baf010afeb9cec06ae932ab7732898e6ead6e084e18f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "efcea5fb-b4c8-4367-839d-df44bedbb39f", "comment": "Malware payload (Mirai)", "value": "56ea72d8c32e68222daa8275571d7f83094d850f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011941, "uuid": "efb74e02-eb6a-4c1f-ae2e-5aa46c1fbb4c", "comment": "Malware payload (Mirai)", "value": "de15ff0e9e1c03d7cb6ca715d293912328d76ec5090607c34883b60ca36012d233b6b1c07148d4b0d771a61cc3b4209a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "61c2656d-ecfb-430a-9131-9d0b7a19a0b4", "value": "T16921ABA697EB6D1ACC980277DC9F1710E322AE55C65EF817E7A116510C7F21A1F3204A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "669f5ed2-5bbb-4445-bfd7-51eb2370b8ca", "value": "24:Jysdht0gP9qD0at6EoWGIrUlFSs0VzLCkIdhUx2x1AQIE8dXNfO:J1/DFqDPthrkFSsCzLq5IEcN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011941, "uuid": "6296ed86-20cb-43f8-970d-b94ab9d77388", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011941, "uuid": "b72d14b2-89e3-421f-948b-975a84d608b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011941, "uuid": "ba9d946f-9818-4b0c-b22f-d8e89f13c15f", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a432ec0-7f7f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784032010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032010, "uuid": "37618c51-b26f-43e7-8d3b-42ec7c076448", "comment": "Malware payload (Mirai)", "value": "3a9e8f41e675d26aa37688a383ffb1ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032010, "uuid": "df08cd9c-eaa5-4cd9-b94c-ab84cab33b02", "comment": "Malware payload (Mirai)", "value": "e7165b38d987618392ab868df2a0f61d73a6924708cab7b4e9ba401fee5b2970", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032010, "uuid": "0cfb16c6-38c7-4297-a4d2-5908f60dd87f", "comment": "Malware payload (Mirai)", "value": "d5cc5bf77012ec7a849a0d0dbe36a0a6f03bf841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784032010, "uuid": "9810ada2-70dc-498c-a026-f7a1e8de4873", "comment": "Malware payload (Mirai)", "value": "3a1c89d4ea025b552dbc98e0321ad45e310cb0d4e9e3a34faa0b23e094d597c176dca21ad63d3177e8bd15a97d49de4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032010, "uuid": "4921897e-1c90-416f-8c50-7b74650bfd8e", "value": "T18BE3D50E2E394F6DF37AC735C7F74A219B54B39216D0C649C26CFA126E2024D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032010, "uuid": "a1d1c9c0-761d-462f-ad0a-cf031ea8240e", "value": "3072:8dUxNi8On7rOa8AQ1eN4lZ/vU0uXVtknRvept2ugRcXfFDIIPAK4eafUKPHiOv1U:8dUxNi8ZFuE99A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784032010, "uuid": "f29862f9-e23f-40fe-bb8b-ba039aa947b9", "value": 157296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784032010, "uuid": "08c2f8b9-4069-40b3-8b65-7d6e0ab54fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784032010, "uuid": "f1b788eb-0288-404d-8241-fbbfb7a1af20", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7419ed9-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784024033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024033, "uuid": "c34a2a8f-b1f9-49ee-9767-bba86777aff0", "comment": "Malware payload (Formbook)", "value": "72f0af6b612ce44d99e1f16158fdc771", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024033, "uuid": "bd231a9f-b2eb-4dde-b29c-f98954cdcac3", "comment": "Malware payload (Formbook)", "value": "e967a74505018f5a4de19d45bb69634ecdb8524f444f385f3be6957411095229", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024033, "uuid": "20c1b3b7-b193-40a5-8980-c613d6780946", "comment": "Malware payload (Formbook)", "value": "5ed43444acf13da19ecc6cbb6a7d75a9a8fa1f16", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024033, "uuid": "23e81082-390e-42b4-a014-4ee0aea7c887", "comment": "Malware payload (Formbook)", "value": "c20e93cb7da105342b41f6d04209cf8cb9332bfdc655ddce42f6b5081a843c30904cc724557ad11630ee8dc76b6c0196", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024033, "uuid": "e6455320-b44d-4af4-89c1-9c65294b6b8b", "value": "T128E5294557A4A1337331E79D523AEE38A44E905325DACF00349FD62C7A1CD4BAB68BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024033, "uuid": "c4df8fb6-ce50-4c42-aecc-7913acefe0c2", "value": "98304:j0y4JDlw3m1gmcGIxHJ65obqR6gl73Ctilscaj6YHH0hf3exMA:wJXAm1tchxpWR66CMl7aj6YH0puxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024033, "uuid": "c1240f01-66dd-4e3d-8f6d-7867ecdf2068", "value": 3235395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024033, "uuid": "13567381-defc-42bf-8a1a-f876604b9308", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024033, "uuid": "ef503509-18d6-4d9a-b298-17c96a414c11", "value": "swift copy.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78a95f9-7f18-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783987929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987929, "uuid": "d2a70222-3e1e-4126-8b56-5bc6c331b256", "comment": "Malware payload", "value": "07ab156cb87c710968fb7b0dd89c90f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987929, "uuid": "2cc8f563-12a0-470b-9c8c-2b821a608953", "comment": "Malware payload", "value": "e986c08a9dacb351fc1da3906edaac7fffbc813ed9d31460a6d9743cda8a29fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987929, "uuid": "25810e33-1abc-49b4-9821-5a5105ff2078", "comment": "Malware payload", "value": "fe21afd862f879e5e8fa45b0735338f2a713fc8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783987929, "uuid": "6e6ba509-4384-4ff6-b945-7e20087cd91e", "comment": "Malware payload", "value": "dea7063958a3ce4bbc8280ade40bf5091360d6fcda20b454cacf1a641397985db08a7a45258ee8df8b445eb5a08456f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987929, "uuid": "337e30bf-4f44-43f9-8e84-b26aed632553", "value": "T113B31210D20C9E11D8CFA89D43E5DF9A77FADF8A25F685B66011A7E282CBD146603FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987929, "uuid": "cda210bb-ae0d-4566-836f-eb2da26464e4", "value": "3072:ZUiAvPnyCHeIuQgRNf845R9pvVqYSk4BN4u+qgw2ui:Olvvr+RNp5DFVqhr7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783987929, "uuid": "a07ea8c1-be4d-426d-935a-9c82777ea057", "value": 108276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783987929, "uuid": "6c01b7d0-3b06-4929-bd83-d2badf5d91a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783987929, "uuid": "8a558301-e5e4-479c-8a62-8776851cf647", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9660c4eb-7faa-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784050606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050606, "uuid": "6830d958-9d0c-482f-bfc7-22297af942b8", "comment": "Malware payload", "value": "7a7f4e8113bea2b3f3523226ff33663e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050606, "uuid": "28da6a8c-433e-4779-bccc-a855dada2609", "comment": "Malware payload", "value": "e9c85fed4f8cd17535a62b2cd2832c3ca0e652df1c4914e96fb00f0eb1af710b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050606, "uuid": "1883fc55-1ed8-45a0-970b-20e442e62a22", "comment": "Malware payload", "value": "35b5b0cbcabbe7d08472ad4363a1ab2bdb630e4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784050606, "uuid": "652bd952-e15a-4644-aada-0923bca4a8f4", "comment": "Malware payload", "value": "ea663e45f053599e4cf8545c04bff2a2879cbf89d37c8d3d3b6577083bb746d3916c9f5dbc11c1f2c44e09a89961da81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050606, "uuid": "f0056106-2fd0-4882-b66b-65bcd7744ee8", "value": "T18E137D6926953C25AE9988371C7E2F0CBDA983E1310851DDBFCA3CF18C49A9CE71971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050606, "uuid": "b085681b-fb21-434f-82fb-44766d8843a9", "value": "768:bcsr0a1ldo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:zh1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784050606, "uuid": "5098159c-5f65-4f42-af11-ee99164522ac", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784050606, "uuid": "ca3d2357-7466-4c43-939f-e3be5458a8ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784050606, "uuid": "abf9577a-6066-4cdf-a294-8e1ed35d8ca4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40836b30-7fa1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784046597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "2984f123-4b64-49fc-a7a2-2dee977f6b84", "comment": "Malware payload (ConnectWise)", "value": "fb61a8f8fb611ec5f78343e139593ea8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "568a770c-2c0d-4f7e-8dca-87a2f57963cc", "comment": "Malware payload (ConnectWise)", "value": "eb4ca3c1757eb36faa00200c5ce0345a396724c195b33f36563d452d4abcddd7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "620ed2be-d3ae-42a6-a6a9-4ff6181de0ac", "comment": "Malware payload (ConnectWise)", "value": "33dfbfc68d3fcec6c99a994f85979ef765009caf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784046597, "uuid": "b0acb7b5-f7bd-4cea-8cae-963da1cff384", "comment": "Malware payload (ConnectWise)", "value": "27d5887a28417324d4549212cd9e694c6c919227da3f636785b2c77d3878ce67c923f58afef596821a9cb357a6063b24", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "3dae1d60-cd08-4758-9a53-82d234352c84", "value": "T17C46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "3681c863-d289-418d-8d0d-b66318ac28f6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "fc733afe-ceed-47e5-940e-f3a8c47dec75", "value": "49152:yfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:+qs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784046597, "uuid": "48c0ea0f-b14e-406a-9fae-65fa8c55a387", "value": 5647816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784046597, "uuid": "97683012-5e98-4d9d-8e33-16f44f36e8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784046597, "uuid": "3752f80d-add7-4aee-a373-877a745a99b0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fd3511-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039706, "uuid": "cdbf0138-cf82-44a9-ae22-55aae40ad8b3", "comment": "Malware payload (SilentNet)", "value": "c08eb7cbe473f7116a59b7b0aaa4280f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039706, "uuid": "a129afa2-725c-489b-838e-7962dc91c6a4", "comment": "Malware payload (SilentNet)", "value": "eb7631efd363903461609683205e215ffde4f8edda7659608cdba69ad98cfdf9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039706, "uuid": "fe6718ec-4c0b-4e68-99ef-d6fa310a5c29", "comment": "Malware payload (SilentNet)", "value": "91fa6914bcb96307da48f80cee25ef93917a9f64", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039706, "uuid": "fcd6a6f3-ea30-4f9b-8c93-34d345e794b2", "comment": "Malware payload (SilentNet)", "value": "f0fcc56a364d859565c7abc82eb9640ecac34327652b3274669460c85fea696d96e3d783e5c0593622d279396627c372", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039706, "uuid": "c24c780c-2df2-4268-99ad-60124a0723a6", "value": "T1C3C533F38C971858E5351265BC22DB0CAF502BB52300AF665DF94EA3C36E277A24677C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039706, "uuid": "3e830f17-befb-40ea-8171-585602c64c30", "value": "49152:IfeUfJ4P0zvck5MEw6KUV0CcFKXAVmGaykrl2rZU6dMVeOu8:0j4svcAD3+F+AVmGazQrZtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039706, "uuid": "6333a8db-c878-447b-b0d9-122cd793670f", "value": 2500769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039706, "uuid": "a9ec49e6-97b4-4b14-9510-ff1abdfdc7b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039706, "uuid": "f23b4bd1-cfc6-482d-b511-ae82137c2668", "value": "krypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e119d1d9-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021956, "uuid": "7990015e-8a6c-485c-be78-b4c203651adf", "comment": "Malware payload (AgentTesla)", "value": "20a1e61ca7c6a90fb95e094dbcb9f7b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021956, "uuid": "d972db4e-e377-44c7-97e3-aae6e7ffbe1d", "comment": "Malware payload (AgentTesla)", "value": "eb8ea776973850027c76e4cf567f68a7605b1f9d1db63d50a64b40d7a3b2e32a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021956, "uuid": "2e3febad-5f07-44ac-a10e-f676f4f90bc5", "comment": "Malware payload (AgentTesla)", "value": "c08aad261466ea6a981ceb23ba427d4065bb896b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021956, "uuid": "94d6975a-2c48-4a64-9ea8-83bca2519540", "comment": "Malware payload (AgentTesla)", "value": "7a005c7021e8e4b9bd461cde876364a69f75a7a0fcce958b0a108bece468c59e30375bfcf88636af0260d14c43a39bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021956, "uuid": "b66d709c-78cc-4267-93b0-b2496df732d4", "value": "T180F52C4666E861637320D7D9862DEE78D40F8453382A8F4079CFD638782DE8EE6447E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021956, "uuid": "d5bc58c5-36d6-4dfc-a611-c0b33d7fa65d", "value": "98304:ft2mi29RFCbFu6bUSnctUDc5OiUzY6+tNC9yN0hvFfrDj7m2Ctj5JWzHm26cD4na:ft2mi29RFCbFu6bUSnctUDc5OiUzY6+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021956, "uuid": "bf010e66-e67f-4e7c-95ef-ee2958ad1ef5", "value": 3469494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021956, "uuid": "37973ac4-9217-42c3-8776-901638af9166", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021956, "uuid": "190a03ac-3fd0-490b-a61e-83df31df205a", "value": "july and augst NEW ORDER.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b67a0a-7f6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784024644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024644, "uuid": "a7dd81fc-159d-4ec2-9588-c14b65ff7269", "comment": "Malware payload (AgentTesla)", "value": "2cdc31039ca26bbf2d7a80c3422312a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024644, "uuid": "5f3073ce-1a39-4359-af03-479a7953072a", "comment": "Malware payload (AgentTesla)", "value": "ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024644, "uuid": "054251d6-1ecc-4c2e-9929-1f48eb5dfbf1", "comment": "Malware payload (AgentTesla)", "value": "8a779a4b2e7f8de7c56c51c5c3aa576dc549ad24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024644, "uuid": "a8b4a87b-4c22-41a4-9f11-33c65c0fa954", "comment": "Malware payload (AgentTesla)", "value": "e729029f4be9234f667dc6f7d716864b3528c71558261ede60d7bc57cbfb69a9e2f7840a27be031f90ad1f33570ff58c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024644, "uuid": "1e31f42a-0fd9-4e58-ae81-dae937ae562e", "value": "T1C8E5E6119764A5727364E7AC513BDE38984E600329EACF4530AFC338792ED4B9748BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024644, "uuid": "73a7c2e6-fac7-4658-ab64-81cdac4f7aeb", "value": "98304:zJyJDn2NoohUcasuTCtOI0tGcvKtX6aPgkXh9HL6M1azr:zJgzSUcZX04cvIo69HL6qav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024644, "uuid": "45bbeee9-0b65-498c-b9c0-dc492ad6781d", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024644, "uuid": "a759ee16-2ae6-4ebd-a9e9-ea28596ad184", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024644, "uuid": "cc455eac-ce18-4142-b8ac-4bcd3b2d2c3d", "value": "Purchase order PN0001.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa5dc36-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784015403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015403, "uuid": "3c4989e4-49ee-43ca-a6b7-39e5b90e915e", "comment": "Malware payload", "value": "376f153d3f545166f7e0307bf6e4abed", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015403, "uuid": "62b5002e-b5cf-44e4-8d0f-2c75580f226e", "comment": "Malware payload", "value": "ec70579b3a73b3a798ae5bc940039d1cccbcee176551be6e4bdda9f10025f242", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015403, "uuid": "14f8fbcf-0362-4b4e-84fa-6d27cd7618c2", "comment": "Malware payload", "value": "9e7f5b18c034048f5b7f59c15d2dc3ec35bf989e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015403, "uuid": "305894d1-55e2-4d18-8707-039a70c200f2", "comment": "Malware payload", "value": "81430cb32512f3504ea022942dbc3e9971290867992ee09519d0d9371b9f00f4ea7f4f1aeb0a9224ae3447a1a8319c4c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015403, "uuid": "d299f67a-847a-4a2e-b646-e95b73572a57", "value": "T15D052350FEEACB73C6234BB8685049D2122EFCD18696961F3030771F6134FB5CAA961A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015403, "uuid": "90cbda69-fd01-43d0-9fc0-5c4674bc83a9", "value": "12288:PSUGfwI82NBzTJSdXdw88AhUgMsrvgPh9SkFaoLGfIT7+Dsce/zQHWDxvQf7I/W:PofwI/77dAzgp97FaoL4IT7IsDNDuoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015403, "uuid": "27987561-b863-408b-96a1-86a69ddc4d10", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015403, "uuid": "f4366c4f-b17e-4f0e-b3d4-3d4aaae33094", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015403, "uuid": "3de8d55f-736f-4d25-a290-5ecbc8f21bfc", "value": "QTN37665380.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a49b088-7fc0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1784059874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784059874, "uuid": "d783ed18-e2cd-4f0f-b9ad-4c0f5a919fb0", "comment": "Malware payload (KongTuke)", "value": "b9bccc0467b04fe9753b111a004210f2", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784059874, "uuid": "e551ee37-3257-4d5e-bc60-c608bdd5957a", "comment": "Malware payload (KongTuke)", "value": "ed107d285623a1b880b4f063d5cd8a2c2a2423e594c2f1da8903ca823bd49a4e", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784059874, "uuid": "2c03583c-29eb-40ab-918c-ac56b7a2981a", "comment": "Malware payload (KongTuke)", "value": "d2e86c2a6db3bab7d23327fda1c1437e85eb9dc2", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784059874, "uuid": "01cb1a97-cf71-4575-a8ef-5e3e8cf52f81", "comment": "Malware payload (KongTuke)", "value": "f5f14a95ae5acfa1610017f4334be856b23b7e63845267b1b52dba50b018ed58f669fd589d2a07c8fff2b8302ff77595", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784059874, "uuid": "7b3de2d5-02e7-4f4d-ab05-1a77025b63b3", "value": "T1E9D16D75339528B99ACB5E412F1394115EB30B0F692044C079AEE0F70F9F3A6E75A7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784059874, "uuid": "5fc624b2-e784-4524-b726-18918d1215a9", "value": "192:9dnF9HPM7isQnVlqgHs3LEb4WaiVJqWCF:jXPki9nVI7Ekxsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784059874, "uuid": "67f3880e-f77c-4170-85de-3d5bceb753ca", "value": 6277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784059874, "uuid": "bdeeafee-8a23-4f8d-b99a-6d36b5376468", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784059874, "uuid": "a8dc04c4-927c-47bd-8612-9ec2d6c335e5", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f704bae0-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784021992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021992, "uuid": "7d4d9979-704c-40af-8735-8fd4e72fefdd", "comment": "Malware payload (AgentTesla)", "value": "7156faf9838ae2e112edc129e74ddcd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021992, "uuid": "d8c8d678-5161-4bba-9e3f-e9e048c2b6f2", "comment": "Malware payload (AgentTesla)", "value": "ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021992, "uuid": "f0d83329-9990-43ce-93c9-c1c4bc3151f9", "comment": "Malware payload (AgentTesla)", "value": "68323dce3d42537559a4183619b528108222b0db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784021992, "uuid": "212480ca-faaa-4381-90f7-b2cc7e4da6c2", "comment": "Malware payload (AgentTesla)", "value": "656f2b46cb9c12b2ac36c492eb1cd46fe8de4a0dd7ccd210886cad0ac8c17c081cb027f0f0b15268344f6ca834e3f96b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021992, "uuid": "2ea67e98-506d-4129-a8a6-6508ce435ce1", "value": "T15DB533498B396C640DF6BAA493B3C4579D07F9ECD06BBDEF4B1F10A035209DAD768290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021992, "uuid": "46fdd7fb-f575-47a1-b059-2206b8bce4f3", "value": "49152:zyh2fzdTzMNG16lqo/HbhbI9JyiCOCz99hLBEAE9a:+hEZTzME0lqEbhEXy0mjLY9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784021992, "uuid": "fdec3fd2-8ea9-4adb-8b20-bf89c3cad998", "value": 2317809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784021992, "uuid": "8777b735-00b4-4c4a-87c9-d685f93dee04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784021992, "uuid": "78f5ce3d-7540-49f6-bed2-b4d8d49d6d46", "value": "invoice_2026 & packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cbe5a1-7f58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784015440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015440, "uuid": "b48250fa-5649-4fdc-bf75-cc43b96a43f7", "comment": "Malware payload (RemcosRAT)", "value": "4d4447b69b311851242fb991c0010f90", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015440, "uuid": "2709f264-070e-4727-b06e-f56fbc54c899", "comment": "Malware payload (RemcosRAT)", "value": "ede77467afeef133edd2beee2d407fa9918067eaf99b898569d564b390509490", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015440, "uuid": "358019fa-f3bc-4114-9b50-957943b8d14a", "comment": "Malware payload (RemcosRAT)", "value": "32080b241c738b5852597c9f490d118ada05c8dc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784015440, "uuid": "8f535427-4b94-4b0c-b0ce-2a5ef1914e3e", "comment": "Malware payload (RemcosRAT)", "value": "53969a6d35f4426227642dd4fa9c21b5bc9f0e8e8c1ecce093833085b45f8f586892f6b10b8369ce408d1b4991a0b074", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015440, "uuid": "ba31e260-61a5-4852-899f-5a5f8750ae5f", "value": "T16A052320FDF6DA5BD55316F588E85ACE411FFCA28B09D64F2130B32F6C35BA7449A029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015440, "uuid": "8db2c128-94c6-410c-92e2-41eac340a18f", "value": "24576:7ofwI/77dj+VzzjI9nFaGQcD6nq5Ely/8doBydb9:7ofwIj71+VzzOnFaGQ46nqM48dqyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784015440, "uuid": "633ffdca-b8ed-45d6-95ed-5853168e2d18", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784015440, "uuid": "8949cf1d-9be6-4b57-94a1-f56fcc84b20b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784015440, "uuid": "c91482dd-a509-469e-a7d9-af177f55ccf9", "value": "Met-Tech_PO008862920206_Product_List_Specifications_Drawing_RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7cea47-7faf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784052764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052764, "uuid": "3be1388e-b73d-41df-ba72-502c62140840", "comment": "Malware payload (Mirai)", "value": "673f2295a76361b85432f5e1dc7bc8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052764, "uuid": "e92c1906-4b72-4fab-95f7-80f7218ec13f", "comment": "Malware payload (Mirai)", "value": "eefd5fe077a3033d4c16c887c6894a92fdcffbb050aa97da5196702a424e2835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052764, "uuid": "40db47c3-cdb3-4351-8297-f86595d04eec", "comment": "Malware payload (Mirai)", "value": "6ad0cdb02aedb95d7630f85954c6a76d524c0226", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784052764, "uuid": "8c0695b2-5108-4375-a973-627c09cd9612", "comment": "Malware payload (Mirai)", "value": "eb9c8cc7bc29a69fe677736f8857018a675971008e0f3c3822853cfec8d8b9389b9a865ecf28a937e72043e918e04223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052764, "uuid": "f7f44885-151b-416b-bd72-a07d3fbc39da", "value": "T1CC457C57B2F364FDC053C430879BD6A2A931B42542226E7F66C4CB302FA6E641B5DB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052764, "uuid": "556d7f54-44e0-4c44-8904-97948b564dbe", "value": "24576:+wrjO4kbULQIQzVLaJjM7ayOdk3A2rKk2ub9qvF/eA:+w/O4kbUu57KAA2OE9qoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784052764, "uuid": "23a9c00f-65e1-49c9-802f-30d74edc08c7", "value": 1241952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784052764, "uuid": "cf6627ba-0a4d-47cb-85a5-cfbfe5283549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784052764, "uuid": "848d57d6-bb0f-4144-b1c7-7bf15d729601", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fb97c9-7f50-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "dc5b0b00-a39c-4a78-aa6b-c76f20585ad4", "comment": "Malware payload (Mirai)", "value": "d5cec1a6a2a191f697114ee7aa9b3ab5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "674b344d-33fb-405f-bed2-582d12d59177", "comment": "Malware payload (Mirai)", "value": "ef59d7e00194cdc0bce52bf0511604bfb438ef537a75895957577e6e0815019c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "db77335e-be46-4a99-8dc9-f180bda84a73", "comment": "Malware payload (Mirai)", "value": "cb9baf453aa983e42868abdcc414460794c6e3e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011948, "uuid": "5122a8c5-73a8-42f4-a4c0-506c292c884f", "comment": "Malware payload (Mirai)", "value": "1a899ca00269569e9324251b584ff070ca2695b9dbc88b0915d12b5b0a02d5c0c1f7c8f80fa10acb8e429a3077fdc9f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "3748fc28-e78a-467c-a904-b41a58cbcec5", "value": "T1EBC31B45FC504B23CAD522BBFB5E428D772A1769D3EE720399256F21378785B0E3B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "89c1cbaf-0fe1-4498-a0c0-f2a5ad475c9e", "value": "3072:K7IEKRsF6OIW0H4mWRMe9hO7GMiq9PYD:K7CRmPI5H4m4MeLO7Gvic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011948, "uuid": "c690d9a0-ee37-4b9a-9f56-7f09bfe708fb", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011948, "uuid": "3c3c0afd-07db-4f68-ab3c-5cb6580de768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011948, "uuid": "f94ee84e-1f3a-41ed-8f24-7919495f2424", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9119b9f2-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784023969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023969, "uuid": "ca474df4-4b7d-4b70-9260-ca0db6bf0378", "comment": "Malware payload (Formbook)", "value": "facc4d05bee75134a92a0edbd97492dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023969, "uuid": "5c86729e-9487-4ea8-8973-c37ab4225eca", "comment": "Malware payload (Formbook)", "value": "f0ab3929c25ab32c608a62d39a831f21edcb356cc3b55e3839071c14dacc1ac8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023969, "uuid": "5367d2c9-eb1d-492a-a6ce-0a7ae43dfe82", "comment": "Malware payload (Formbook)", "value": "95906e3c6dec47779f972d6a0ad7ef37400d01c7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023969, "uuid": "61eceeb1-78e6-4a9a-b61d-6c63b1abe921", "comment": "Malware payload (Formbook)", "value": "5a76e4e927e8fde43428f995dfa10d522d4e5fe9822f9b7fc78c0fa9399aef7221ff3d0c251c188b94cdb5266a485822", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023969, "uuid": "f66b11fc-d4b8-4be6-83a4-a9e9700532e7", "value": "T104851BF6C9F844F28373A3B8ED15E498F4A405614CCA0E5BBFBB4F8977B04569096932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023969, "uuid": "b607a6cd-c9cf-4851-9524-9f12d3fc64de", "value": "48:wS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+0CS+s:73YZGJNZc7cVwNqIE1/xV9b6IRkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023969, "uuid": "8c8fdfc2-2c2c-4bce-b977-5290080fcdad", "value": 1741514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023969, "uuid": "5525a196-6a49-4075-bf36-45afb691e773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023969, "uuid": "6cf32719-0186-4c2d-999e-5aeb0eae6810", "value": "Factura 21-603 Euro Plasticos.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e1b33a-7f96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1784041777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041777, "uuid": "76dc2cfd-2fa5-4608-8956-5ba23c653b1b", "comment": "Malware payload (KongTuke)", "value": "2989b69a9e68bb1a1faf887e90b3a9a6", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041777, "uuid": "a3fb95bd-f403-45f6-8bf6-edd3780ddbf2", "comment": "Malware payload (KongTuke)", "value": "f0b4fce23e3d10f41a48415946cdda7a31d656e0b484405eb815bd549521220e", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041777, "uuid": "367653e5-993c-4722-a05c-0ca5b636d93c", "comment": "Malware payload (KongTuke)", "value": "1ae815b323cde2238d3b5e5358861d77616a5dc3", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784041777, "uuid": "043eb355-888a-4fd9-8f24-ca495ea87753", "comment": "Malware payload (KongTuke)", "value": "9c53cc51010b2a2dd357ea04463a3f8d53108d7b95eefd904477993880f8a9a5f19c393f1585658853fd93fcb73bbedb", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041777, "uuid": "8a5a28a3-18df-4ff1-93f0-359a31896f5b", "value": "T195C15C23B3313BBC668F89631A414A31A322224BB24458C8F19FDBD54F966DDD3794B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041777, "uuid": "d6a9c1d9-59a6-4aab-ae8f-10a363da5ab6", "value": "96:fYJ8QbNAKKZVSzB64emvODryXn8Av13d9+X5w72HYR9q/xSjWrVLL31V6QLEb4Ls:fYKYAKKZVStOD+X869n+X5Xe9q/xLrVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784041777, "uuid": "44955369-45b8-43ae-8ed3-6bb3b1a8ce9e", "value": 6117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784041777, "uuid": "0443b063-4f2a-4765-8aa7-d868842d59d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784041777, "uuid": "5af18f00-17c9-41d2-abd3-7f70d28f21b5", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3eae2e-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784012176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "3b38511e-9ce2-460a-b79e-4586b010d6aa", "comment": "Malware payload (Mirai)", "value": "817f4cbe5efec33afef79ad698878f7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "aa209639-d364-4595-9161-d103478c35ac", "comment": "Malware payload (Mirai)", "value": "f133042d8d53d74a964ffd82fa466f9fa266161d3c177e1cb2d8e15155966c7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "89b006a7-38b1-42c1-a000-edb1c5f97311", "comment": "Malware payload (Mirai)", "value": "9629e6a0888ad949b55f5ca1b82d97f4c9ab1085", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012176, "uuid": "697cdd91-510d-4aed-8b46-e5307aa525f7", "comment": "Malware payload (Mirai)", "value": "3947fc1fd4feb68d28351b829604b6cf534fefde32e379567b3c832b05d939bbb1a90749df10796ea9da11cefa58cdeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "28ca45be-5251-47cf-be94-cfbe65deeaa3", "value": "T11413F1139D01BE73A82127F0EF9AC99F94C5DE7681FF3697DA2602E4ED944C44D06882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "79fb078c-7cd9-4e31-942b-d947c391f66b", "value": "768:c3Io3lMU4AhMN54VXdpGjs5IECWbf6Vm1y7uckk1kC3d+UR49q3UEL33:c4o36uGY5TNN1yydkd3d+URhLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012176, "uuid": "e60d6726-68ec-4742-8830-2ad46c0508a8", "value": 42112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012176, "uuid": "b6f7667a-c0c8-4264-98cd-61fd333752bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012176, "uuid": "58706222-c893-4684-aa25-c531bee0292e", "value": "zombie.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b056545-7f2a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783995424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995424, "uuid": "cca574b2-1c20-4932-8eb8-50d42551fee2", "comment": "Malware payload (Mirai)", "value": "531dca50d5fd9c6f6ba3e5d7aaf42a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995424, "uuid": "a6985ae7-a768-400c-bd85-930daefd2117", "comment": "Malware payload (Mirai)", "value": "f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995424, "uuid": "4457290d-7f2f-4c3c-9132-773145e918ab", "comment": "Malware payload (Mirai)", "value": "4c7b271348d729f72f776d9b6284d1b32f01b17e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995424, "uuid": "4cc19d76-fe19-4344-9b33-fdecb12717d6", "comment": "Malware payload (Mirai)", "value": "ab1350ae1c085c79ed2ea1284eae1a27b1ebe53ac05cab97118dc7264577fdec293f453b00691180e716637ad22e3762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995424, "uuid": "27166592-181c-4885-9681-35e9e787998d", "value": "T1D8A4231594079D8BFC19FCF90D7B01351E887E0F29D7A2A48024FD7E36BE9A64CD2A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995424, "uuid": "925bed8a-9fda-4726-b1ef-0ab438c96b13", "value": "12288:CcGbDx0EgHJ25HHUUZvRF14Tfr20lbsaJbah:5CD6HJmUU5HaTfr7sob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783995424, "uuid": "33ddc890-9b11-40be-a546-e9e79faa56cd", "value": 451156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783995424, "uuid": "b4704ced-3aca-40fb-a562-b5a109b51e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995424, "uuid": "db0b8f67-9b55-47e6-a46f-5a4e768d16a0", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781b5a73-7f7b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784030369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030369, "uuid": "92fea90b-061a-4f30-81ae-a938e0f78399", "comment": "Malware payload (Formbook)", "value": "a268c1f09f7c71bc14f05c5f8a2e3c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030369, "uuid": "1b1945f8-011f-4fdd-a0e8-450e963b2110", "comment": "Malware payload (Formbook)", "value": "f1a1c2a13764f2621ec0181696fcf7e6f74886ec7bf7f4ef4f56ba986c782b6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030369, "uuid": "d3eae2b8-7661-4151-876c-c50b602c19b9", "comment": "Malware payload (Formbook)", "value": "153ba9d6c864aef2041009cd00967b49f058deaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784030369, "uuid": "7a59cc02-b7c3-4f5a-9b06-b82d8fca2e67", "comment": "Malware payload (Formbook)", "value": "8c8dd8891706da6165fb2a3ec2c247036d34e09b3fff5367c52846dad7f421d389836f1be45a3fcbe062b5563aee7391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030369, "uuid": "3e5cbf11-02bb-492c-a2c0-f37e43d44023", "value": "T15B348D83BB03A0B0947A1B735E2B719DEF64049702340855BA8CB84A1F76FDDDA7729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030369, "uuid": "90a18bc6-f52e-40f6-8696-3ca99421b60f", "value": "3072:TEho15QeA6ahEPIr1xWhwiutwtNtuZYYFDtdYtY60nhJBI14ioPiky2eo7:TiohDPIewiuqI+WDK90hJB3ioPZy2eo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784030369, "uuid": "554f693c-652e-448e-a906-d92bd8747e90", "value": 233649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784030369, "uuid": "05a0557b-7962-4475-b78f-987958bd0f5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784030369, "uuid": "e2f488ee-6ef2-4ccc-b0fe-9129ad4872f3", "value": "711642.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53e9e9c-7f51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784012514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012514, "uuid": "4b73cd01-cf0d-4e94-9c17-5c7a28c75ecb", "comment": "Malware payload", "value": "6e6e07bb379bcf1eeb7d26572918474d", "object_relation": "md5", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012514, "uuid": "7d6e3769-208f-4c84-950f-5c30cd6695eb", "comment": "Malware payload", "value": "f24335b718f76034b90ead703c85ecb1481ffbe69c61db7879cd49774a6a85e3", "object_relation": "sha256", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012514, "uuid": "08a96085-f548-4045-a2b2-18c0fe08b293", "comment": "Malware payload", "value": "fc3af06398f9f124b4c6c0ab5810704918ac2651", "object_relation": "sha1", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012514, "uuid": "bce6eae9-215e-4537-9181-2b6bb097209c", "comment": "Malware payload", "value": "78d77fdb07432aa3d7e4d3049225b7373499ca8d90f55700f5c80eaaa4005089f9988b8af1df04c6cc22a2e930d33a2f", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012514, "uuid": "5b2ac8d8-a983-45a6-9d12-841b42da36cd", "value": "T17CF5335EB459881797364E5222F6C11385784DA8EA78E2FFD0C784797205AEEC1CBEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012514, "uuid": "e81a1f86-cfda-4acb-8c3c-b92d1a98cd83", "value": "98304:95i1aLT4MYb78VyqJFvcsEm8xd5H5QnjX3C:95i1RVYVySKKnL3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012514, "uuid": "dc7cdc0a-c96c-4d82-8de3-2e18ef09022d", "value": 3501324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012514, "uuid": "4a8d593a-5c47-47f3-abfc-be4047ec8cf3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012514, "uuid": "3a419659-9948-4484-a1a7-00c982f14a71", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e3b8a8-7f4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784011359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "61ae0158-2b54-4044-89b6-af478a66ad52", "comment": "Malware payload (Mirai)", "value": "fd2320c4336e8038d2571b00b147ce43", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "187d6bbe-4083-45df-92a9-5ace2446f545", "comment": "Malware payload (Mirai)", "value": "f27afd21e16c9bfaca4938dfbcdc7b4b8d7a3298e347fb9bf74089a75de68fbc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "35910e33-d128-4f45-9462-3b8df83f844e", "comment": "Malware payload (Mirai)", "value": "ca803358f5076b848a50ffb1afa969b0ebdeab7f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784011359, "uuid": "263bc979-fdc5-4e48-9077-b46823c397e8", "comment": "Malware payload (Mirai)", "value": "a1b89211973acd2a01dcf237802bbfe9b3f73fde7e49c1a26785eb4ef4eb041e371b18d69ebec959886d39bfe6b466bd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "54918c79-20f2-41a4-996f-22b0b5e0c347", "value": "T108E33A42F8918A76C5F01675769F529D336687F6D3CA3303E92886243DCB69E4F26F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "3f865db4-bc34-4f74-9014-3815aa337049", "value": "1536:PasqlLsVf62/B5by4jeNLq5OW7ETRU9Y0W+if+5afvSp6z6R:PaDlLsf9Z5LSi1xHWHftB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784011359, "uuid": "d0d233a2-a933-4eb4-a395-d4ac23c31601", "value": 147888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784011359, "uuid": "b567c15a-3f9b-48a2-a086-bc3c4cc26062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784011359, "uuid": "7bf3bd68-0864-4192-823a-76b111657ad3", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551221b3-7f57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784014849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014849, "uuid": "8e5edd57-25a0-4543-93b3-88a60eb0ec8e", "comment": "Malware payload", "value": "07b78edbf2e7a467c6ac180478b6d9ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld-preload", "colour": "#55FFEA", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014849, "uuid": "f096adfe-c329-4af7-8dec-fd78a61c1ca4", "comment": "Malware payload", "value": "f359c3c4617c876d887ac2e10fc3ee75981eaa2684d727eac2f84c71527d8683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld-preload", "colour": "#55FFEA", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014849, "uuid": "9b79f6cb-94fb-4c44-9785-64d631656661", "comment": "Malware payload", "value": "236673c82bd4e513696987fa0afed5fbd6adb09c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld-preload", "colour": "#55FFEA", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784014849, "uuid": "bd8ab180-633b-4285-97f4-72a7771ad1e3", "comment": "Malware payload", "value": "9a5c745e24123ce10e706871a3ce8976ecaeef4362f6c2cf02316cbe7308d296e0e132d421514da09169914cdc92db1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld-preload", "colour": "#55FFEA", "exportable": true, "hide_tag": false }, { "name": "project0", "colour": "#432100", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014849, "uuid": "d5c8ebf5-34d1-4957-8860-5fe8b66763e1", "value": "T1BCC1B70BDB439B59D44C00345057032623B2E42EE6C7936F1B5CF1302DA279CAFE579A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014849, "uuid": "bede52d5-7bb9-4022-910b-aabf04f40b60", "value": "96:RBVvB9qH70t+Wfw+a2UKhPCoMQC2kxG3i9JUT:RzB9i70tyihPCfJ2X3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784014849, "uuid": "6674d690-2895-454f-b8f8-cdf34295e2fc", "value": 5784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784014849, "uuid": "8f6d4718-ad45-4d39-bba9-3633936d91ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784014849, "uuid": "dba8c86a-f2cb-4ced-a91a-8261618fa2e5", "value": "libcommon.so_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f898e5e-7f6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784023483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023483, "uuid": "92158e35-ef2a-43be-8008-da696597ba55", "comment": "Malware payload (Mirai)", "value": "f7e6b7d1b1e83e70ea510809511339ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023483, "uuid": "b456ca53-1750-452c-a1cf-f4ebeeb40a4a", "comment": "Malware payload (Mirai)", "value": "f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023483, "uuid": "f775ef81-b610-4147-a283-e660f2c6c0bc", "comment": "Malware payload (Mirai)", "value": "1f866aac1a33d7fae14f01fbcae52322bcaba037", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023483, "uuid": "f274d8a5-47d6-4c2a-bcea-0100df5f0c1c", "comment": "Malware payload (Mirai)", "value": "457a7d973f44272baef16d708bd3a5f56630dd9d7651f0a4e08635862bc89d9c17091add99af4405e3b9d1ea53299493", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023483, "uuid": "b10b56b8-800f-44fa-bed9-7e872bacf861", "value": "T161F030EDB55257E38F88CD42E863465D7142BAC225304FCDBC8E74B655E8AC1F430E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023483, "uuid": "20b8131a-35c0-455c-816f-31fa2222abc6", "value": "3:6XZJXsAJSsFqRq+vfDSIQ1RsLA1KKgqRq+vVKzSIOUqKKgqRq+v3GN3zSICLKiQi:SXRJSrvMsL0xv3zxv3a0LKie0xWIbxXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023483, "uuid": "ca9e8721-d96b-4b28-864c-b4ba4529df50", "value": 442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023483, "uuid": "6eda170e-c84e-46e4-a723-1a715e1ef2c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023483, "uuid": "665a4e15-b119-42b7-8db6-06f915e7e40c", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7880b4c-7f3a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784002532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002532, "uuid": "5413b029-cb42-4f36-acbe-a84188362d3f", "comment": "Malware payload (PhantomStealer)", "value": "91436dbd9f20bdbf2b66cccecc8ade52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002532, "uuid": "eedf569b-d6ba-43bd-a7d8-7d76bac50b20", "comment": "Malware payload (PhantomStealer)", "value": "f52838f5f189931d25475e690bb9c91f0c841a6c5b7c4d119381af774995be4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002532, "uuid": "be0f10bb-ef11-4ee7-9cc0-517168fa44dd", "comment": "Malware payload (PhantomStealer)", "value": "1dc8a83a5fcc2eb53ad732cc2e420f97c1815536", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002532, "uuid": "7c23f9cc-f850-425b-9605-4c004d627709", "comment": "Malware payload (PhantomStealer)", "value": "bb56a43bb95f90d78dcd9a1b6b2a22f5769c576aa79c623d62cb97ab10bbfdf2109a4fa08f094b9d80206cf783bd62a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002532, "uuid": "948b86c8-f80a-498f-8068-360c482c002f", "value": "T1082456C5A6E86C4403976F7B379FB0E9FF6B0AD978444607C598F860B0A4A03F9E1935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002532, "uuid": "80ac0674-1116-41d1-932f-b27607e1299a", "value": "3072:MgF3bwz1rfq4UgOfujKKvn0JGg7R29oz5Ep2wL:kq45rjKKvn4Gg7WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002532, "uuid": "be2ff5cd-005d-4ee9-bd98-e9889808f87b", "value": 210234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002532, "uuid": "9fa651bd-1ced-43f6-bdbc-61c963537a73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002532, "uuid": "ac232bd5-ff98-4f10-9e4b-dd1bd6a0edc8", "value": "WHATSAPPIMG0017256.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3533f0-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784024014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024014, "uuid": "c5522bb8-a63c-498f-824c-922097d7a421", "comment": "Malware payload (GuLoader)", "value": "c82de3fbe4b3c9928a755a266cf579f3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024014, "uuid": "f705898d-6863-4f8c-86a9-b91a879f2a3f", "comment": "Malware payload (GuLoader)", "value": "f5e91e4b571064697aa93b0ea78a956b8602261dfabeb13f2352b296d07c7cb3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024014, "uuid": "5e820559-2444-463b-b938-ef68f9249ddb", "comment": "Malware payload (GuLoader)", "value": "efbb3d2163b1ebdfbcf7b0e2fe6466f1f2440c53", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784024014, "uuid": "ecf2d0d2-3773-481c-a8b0-d9097a7892c3", "comment": "Malware payload (GuLoader)", "value": "bd9f2407ce6b916e4bb5bde9bf1b5be8cc05d117cdddd7245123f234794e377ca0f5913f403ef20762755235ab82b8d1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024014, "uuid": "0686b97d-6af4-4c27-90c5-cbdb9118deaa", "value": "T12152C95ED1FA20D845B13F89DE23586784ADC12FCD72F924D29BF133BA6116482E3627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024014, "uuid": "ea60158e-b6f0-4070-bfaf-684bcb548aa7", "value": "384:DOyuEkgh8fT2qwtDoZocy1ucAkSab9QgiLyX51Rp8Uom2Tnu:DOyuEkgh8fT2qwtDoZk1ucAkSahQgiLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784024014, "uuid": "9c030976-fda4-4402-b62d-6a926db0671a", "value": 13999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784024014, "uuid": "d8971996-f1ee-4bab-9153-ef265baa4567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784024014, "uuid": "9d2486fd-7ae1-4f28-96fe-00eec2224828", "value": "Slibemas.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90b1f34-7fba-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784057563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057563, "uuid": "11e9229a-49a0-46b8-a893-fe3cbd82e37b", "comment": "Malware payload", "value": "b99e3ac29a8eaf4ae21aa0338b6bc209", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057563, "uuid": "316a8427-b0ae-4130-a02c-bce7647f8ce0", "comment": "Malware payload", "value": "f62519453afb691de16b4674927332cc8b28b4325c4e19892d31813b691652d0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057563, "uuid": "18c2d7d3-ceaa-4cb3-9b28-d42fb35b0300", "comment": "Malware payload", "value": "28df4f6678645ae10d203bdea9a671ff47a713da", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784057563, "uuid": "5adae439-49a0-4d14-a468-3f23e08cf293", "comment": "Malware payload", "value": "980c7e6c18e65e18d296e074a3e4e4c508a72a00329b2cda0b662914f3b1d6716e33bf76506a8e7dbc78ae12aa643412", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057563, "uuid": "5aca7b27-a81d-4760-a7ba-48e43dea0f5b", "value": "T128E02652001E869A0DA727E555D6484D8011A2E46E74A161BF40C8DD642D2ACA3B928E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057563, "uuid": "d84b2715-38d5-4db5-a0f2-5ddea900b84e", "value": "6:jw+7y0Px+yBpauBhNFvo0AgB8GFPuEs4oJXcviUhtpG9J9P9:dOp4BvNB8XE/oVcqwkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784057563, "uuid": "d17e9562-aefc-477b-9ef0-c55f96f9fcad", "value": 351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784057563, "uuid": "1c71d41a-63a8-4423-aa01-f146788047a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784057563, "uuid": "d25f2f6a-9469-4bf0-8484-4aea84ceed06", "value": "LADING_LOGISTICS_COMPANY_CARRIER_AGREEMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f2d1e5-7f52-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1784012787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012787, "uuid": "21060612-dc7f-43e5-9ffb-8a79e9727e26", "comment": "Malware payload (ACRStealer)", "value": "a0c487a2ddc4074675dffeb708ac4ebf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012787, "uuid": "3b5a5d12-e67a-4ddf-bd83-95de3888b785", "comment": "Malware payload (ACRStealer)", "value": "f698f7919b026700cc2a2a9166258b8770ab9412122207f7b955fb97d249b8b9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012787, "uuid": "9a889862-8b03-432c-b2c0-9b1ff5238e3e", "comment": "Malware payload (ACRStealer)", "value": "45fa87dd72c6ac9b8819b21838bf69165b72f809", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784012787, "uuid": "ab647a03-9679-4d49-967f-271094800a4f", "comment": "Malware payload (ACRStealer)", "value": "e50e3e3f18d348901e8fbcbd0fee4aa0d9a5f610f2422bebb0a73f933208cf286202c2b191ba3bb42b33b85ece95d5e7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012787, "uuid": "8ed40818-5957-4f98-b8fd-267c26f7b76e", "value": "T190165F670DE9F26EEC981D7C113A2F0689BDAA11F24C991B2CD5FCD65E0D9F04487A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012787, "uuid": "39661ce1-978c-4709-8d7e-6e77631e4e86", "value": "846c60b7415e38d769a8b7a0468ed919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012787, "uuid": "426406b3-097d-47de-a096-b1eff9e51e0e", "value": "24576:H9bW6AJeKsdORezUYwcFLcGxL5a97DrSESnblm6Z3K2cXjOarxmszHKxK2VS68:9dCclvx08JmVTO+mBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784012787, "uuid": "32e5e029-3dc4-4529-a45e-b88f8c1028b3", "value": 4376576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784012787, "uuid": "2fbfaef3-29c7-4ff3-b232-42d29e3d59cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784012787, "uuid": "5768ba55-bd12-432f-ade9-607af1b78d4e", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747e8394-7f49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784008888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008888, "uuid": "d90ceea2-f86b-4b5d-b1bc-8f07047bed35", "comment": "Malware payload (Mirai)", "value": "d4b12e12ed14dec47b13f9acd76108ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008888, "uuid": "2fd3c297-93f4-47bf-b466-2c3485cdf594", "comment": "Malware payload (Mirai)", "value": "f72ac48dc9763deba326900931a9dd8ea8b57b0b8d43ac786b5c4048c1f99e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008888, "uuid": "6aa16be3-6d68-4ee8-a1ee-14162dec50c6", "comment": "Malware payload (Mirai)", "value": "53e336c8d26f7fa9ac3df65556b50bd2f4f9b5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784008888, "uuid": "c3754e97-39d4-40c3-9f14-3256c46cf7ce", "comment": "Malware payload (Mirai)", "value": "d333ad38443f1a6fa667684d9706d2da2472768c19f45e08ff1e585f811f1ede2ad6c769d36ae67f244bced077bcfd88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008888, "uuid": "0f84a1a5-0864-4370-9463-a333eb094611", "value": "T1F19329C8BC90A626C6C1167BFF5F018D33564BE8D2EB32079D294FA1778A95B0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008888, "uuid": "be7d8c63-f446-4bb9-959c-ff361da36950", "value": "1536:h/b+uYUlXnOcqXuQOBr83i3Z+o8t45AabnJkttD8By+WeI76OwV+:h/b+uYUlXnOcqXOBI3sso84Cab6tH+lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784008888, "uuid": "d39cda31-e5d1-4778-a439-9ba396f2f544", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784008888, "uuid": "2f6e5f1f-ba6f-4375-b35f-38021845864c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784008888, "uuid": "184234ee-84bb-42cc-a477-4dbe1f63928c", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f0222b-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022626, "uuid": "550c8236-e4cc-4d03-aa32-f484a3ce2994", "comment": "Malware payload", "value": "adc19c0daa1716ab7a4d3b043415cde7", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022626, "uuid": "21059613-c493-42b5-88b9-8aa2ebb0963b", "comment": "Malware payload", "value": "f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022626, "uuid": "1d03f78d-0731-4231-8021-88bccd8d9d18", "comment": "Malware payload", "value": "ee385d35bdcaa0395ee8293c5992ba7bc957182e", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022626, "uuid": "8c164542-4b20-4012-9828-36b2b93c89ac", "comment": "Malware payload", "value": "b192c701a10583c3e1c2232cccd24a932ea01a93a31c103119184a324234ec55c3b79402efe686d1a53b38f796db8a67", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022626, "uuid": "99a2e760-38a1-4d6e-9b96-0d72152846c8", "value": "T1B3E0121383E8DC7BC82D2178240A97215730DD0A00064F031B01E8862D4F4E97D61688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022626, "uuid": "c306a078-95ca-478a-b24f-338b8d0b0367", "value": "3:Bkkk/tMlQ/tZtDh1tlr9zO/9a7ltz5rl/xll7Rl/1Ep7/ldk/KAyX/yvXqR4DLH6:Btk/tMlMI/MhmtkOvtqD7CGGUnDIvcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022626, "uuid": "25aaeb98-890c-47fa-a485-fb0bd4a562a4", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022626, "uuid": "f2e0e714-c274-4402-bc67-3931016f49ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022626, "uuid": "e81f513e-3ac9-4378-b04a-3709eee92f79", "value": "f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec8f9d9-7f69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784022757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022757, "uuid": "1bfd868e-0b8d-4d1e-b42a-a0c9a13dd4c0", "comment": "Malware payload", "value": "7c513c944bbd199b7b22880f9f472442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022757, "uuid": "b96838d4-9178-43c6-8847-ec344243b74a", "comment": "Malware payload", "value": "f7fa3989f5bdaf1ebd1ab549395fd754fece1e360cc5e7ce969429b75a44a06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022757, "uuid": "18d72887-c1a2-4555-9dc9-717cf7cb2d0d", "comment": "Malware payload", "value": "44aa8e24f5ba4bedb9114d3971f41e321398c5be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022757, "uuid": "ae05da34-b66f-4f54-a20c-9718ddf68d05", "comment": "Malware payload", "value": "4d17207019641a164990a35db8a264f80f788acb01be8adcfe7379e8ee1ec919a7eea3d095441390727b0b62df03a327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022757, "uuid": "a62a38e0-f618-44da-9d8e-b1da8ccfbf1d", "value": "T145130A02BA418E13C1C31B79FBDF47147B32A9199BDB3341A619BEB46B437DC1B2A614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022757, "uuid": "aeb855e5-dd7e-459c-bf94-ce46c2ece088", "value": "768:RvkwcJb8+iXMl4wSXquO36PLok42Y1fBkUIOaKpx5i3Sp0w4HF9eho9/oguT:7o8wluquO3iUkrYXH5aK75i3SCw4HF9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022757, "uuid": "9d4da966-e4d2-4b63-b5e1-ec042c919daa", "value": 44920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022757, "uuid": "1c607cbf-26ae-4072-a45c-d8ac22ad9aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022757, "uuid": "904e1ee9-a12f-49b9-82b3-293346b9c4e9", "value": "ab6d730ada254a2ce116414343776925d758105b29d2003792ec85b84df0c12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e92a776-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784009227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009227, "uuid": "dc1adb26-0bc9-417b-852e-f2ce93d597d6", "comment": "Malware payload (PureRAT)", "value": "0f13b3f54fe6e26d95f486aea7595f0c", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009227, "uuid": "31cd4de8-ea06-44c6-a1d1-1e9aae7deb5b", "comment": "Malware payload (PureRAT)", "value": "f816db030e6d4c356138d8ee3656a6defd98b1fc31c25b2060ff9d7342823016", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009227, "uuid": "50ca86cf-e9c5-40bf-8670-22eb355fc254", "comment": "Malware payload (PureRAT)", "value": "4db255c70670a89c20f1fe24ce11d483e3467198", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009227, "uuid": "5afe8e97-60f8-48da-b7f6-28951ac50e48", "comment": "Malware payload (PureRAT)", "value": "69c84315f57dca2de4904b6249409761d291e55e3c19b344b2a94ff0a340f2b85f1066a07f67030e2ffe94ce910d05c0", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009227, "uuid": "2a458c50-3b84-4554-a912-eeb576319102", "value": "T16C9533352A3E3832F9CBB601ACE3950851AF1ED5B4791211F2E76D3AEE4AC319D1E453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009227, "uuid": "2cd22a97-b009-4e7f-92eb-c00cb0e5af65", "value": "49152:HqtvoMcb776519PvlvhpcLQeZI/sFsQaWLJojlaRdX:KtxcsDvlv8na/msfeokRdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009227, "uuid": "d61ccebb-c24f-4ed4-aafa-38a0c18261dd", "value": 1887337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009227, "uuid": "9c2bd525-4a6e-422a-8b24-9ce82b0d3fec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009227, "uuid": "fc3b05d7-f03a-4f5c-acb9-8349dd3e48f2", "value": "f816db030e6d4c356138d8ee3656a6defd98b1fc31c25b2060ff9d7342823016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f240ee17-7f71-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784026279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026279, "uuid": "257034ec-9c25-42de-9ab4-1ad467ec01be", "comment": "Malware payload (ConnectWise)", "value": "baf37d8f887d4c5a8d2da49feabd08f2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026279, "uuid": "a66f5d86-83e5-438f-9e48-dae856855dae", "comment": "Malware payload (ConnectWise)", "value": "f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026279, "uuid": "f3464d91-cf45-4052-b139-36a295849c10", "comment": "Malware payload (ConnectWise)", "value": "69d1d2ed3ab3519d348748d141dbc12e9c819215", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784026279, "uuid": "31d996f4-60c2-440f-b5d0-e142db1c4778", "comment": "Malware payload (ConnectWise)", "value": "0b61b27ed952f0dac1d2c3e39e9325a57f796dc55d28c2fd4d56b3d59ceab62084a4a2838e11288d79c3d3f64072e36c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026279, "uuid": "cba3f2a1-1519-4d0f-811a-d113e8cd42a8", "value": "T134573303D14EC51CCF5B303951A6F9598BADA862E0385AB7ED8C8E5E47F706702FB924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026279, "uuid": "6224acd2-d4d9-467f-82df-7b394bd1f206", "value": "96ab939b3b55d317ed1968d099ccc72c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026279, "uuid": "ef6ca3fb-6571-44e3-b323-6bd40cc77dd9", "value": "786432:ts0spx677BaQJTNYTscewHQbcNW3g5DplEeukmWVY:tVspx6NaoTNE1eANWwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784026279, "uuid": "7458b7f3-51ef-4ac1-8471-cbf535e83246", "value": 28343776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784026279, "uuid": "db5fcb44-0307-4e7d-a19d-7b22c26ae9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784026279, "uuid": "b41fbdd1-6ef0-4e28-949a-cf13b90c135b", "value": "f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de1290-7fc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784062361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062361, "uuid": "88c33535-a48f-479e-990e-5e7fb743ae83", "comment": "Malware payload (Mirai)", "value": "0600d3fb991100376191f7627019e878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062361, "uuid": "12a82020-b715-4f10-b574-4bec8fac9f05", "comment": "Malware payload (Mirai)", "value": "f9a1915d056acc36d5405d81c80d0065078b1e47d8003d41fcb823e9b2e27835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062361, "uuid": "7ee148a0-b5d8-403e-931d-e675440b984b", "comment": "Malware payload (Mirai)", "value": "5f0f0e107d6d3304f3d5462eb222dc48be2d6579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784062361, "uuid": "b7103f48-b570-42c5-92fd-0cbbd7043190", "comment": "Malware payload (Mirai)", "value": "b67061a05941f3f79243e4e45ec40c0703462913a80b7f82a20d021a839c23146c52906df2c319e8931a1430c2719977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062361, "uuid": "d004558d-48c5-49e6-bcfd-a2f9d3d73e45", "value": "T1C65302F6A0E4BDCDC2596334021F1A073E8663B86096A53AB6C4F65907F0344DFD9BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062361, "uuid": "403c7e34-5cd1-4bbb-af9c-c324d9784577", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAH1Lkg4azHg:CM5az1Fy0oPgdZX6hTo8R+1LGazHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784062361, "uuid": "ac4d9d25-8734-411b-b62e-d5f93f7e5646", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784062361, "uuid": "3be0155e-b63f-4803-97a4-d1e1d3bd88a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784062361, "uuid": "13c9444e-21a9-4bff-9b33-fe8731d6965f", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e61a8c-7f4a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784009292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009292, "uuid": "fcab8aa1-f9f8-43b3-b29d-c54f3b44debd", "comment": "Malware payload", "value": "830da08203d63ced37e2091258d6cb88", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009292, "uuid": "8cc56612-87fd-41ab-a1c3-e840b4732715", "comment": "Malware payload", "value": "fabb3abd0bda132733d6b327b749f9f4742ecb97787a05576a69b822bcb5aae4", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009292, "uuid": "0315c490-ea1c-4644-911b-7a57f3c69b29", "comment": "Malware payload", "value": "c518ec339cc97a8c4422a2f25e5b169a36ce98da", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784009292, "uuid": "adf36597-c62b-4d3f-b94a-5d878519a01d", "comment": "Malware payload", "value": "1c6ec9745a2159dbb127c8044564b6a258f1cac1b4b21a94e52ae38e03f29e18372d0e44ff2dae60b32aeba7beb42c0b", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "parceloexpressdelivery-com", "colour": "#F6E809", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009292, "uuid": "8f752602-0923-4916-9f9a-24d4060c0c83", "value": "T17AC5AF56B3C05AA6C126E93487679232C3B2B8124B76D2CF795AD70A1F77F804F39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009292, "uuid": "ae7c6d1b-929c-458c-a472-3e1dbf450ab2", "value": "153683239408e7f0bebd6e002574d206", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009292, "uuid": "24245892-9e5d-4cbb-a3b0-8ae9206a4ee8", "value": "49152:qk42vuOIqfbzL4TBR42dGjo3x0ImQdIOrT9YtPaKWIVeaKKVQshh2kaljJGmHBLT:qKf36J3x00IOrT9YtPaKWIVeaKKVQshW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784009292, "uuid": "f6d6ae68-b3b5-43c7-891c-d2260e4aa057", "value": 2579456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784009292, "uuid": "ecf93f47-0117-45de-b2f1-d81c8e0d355a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784009292, "uuid": "b018c0ff-3399-48f6-ae81-839f13ca33e7", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439972bc-7f2a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783995492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995492, "uuid": "e8506c18-eb4a-437a-a868-f82e0834f907", "comment": "Malware payload (ValleyRAT)", "value": "07c01de3b6ff6532cf58f7cab029d26f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995492, "uuid": "a35ab04c-bf5c-4b51-a3a4-259abc671595", "comment": "Malware payload (ValleyRAT)", "value": "fc397bf8ddae5d01a16beb2076261b2a708b7cb3e8fea0898e56127a757153de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995492, "uuid": "a13cd4fd-9a1d-4ce2-a530-67efd9c61e55", "comment": "Malware payload (ValleyRAT)", "value": "611b5f4ac204e4ea14b8d9d32727fb49d418726d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783995492, "uuid": "074a6658-8896-408b-b716-16b80cf871dd", "comment": "Malware payload (ValleyRAT)", "value": "4898d6b53c440dd088f949e854de43495e45327e4b6c11b3c636aaa64f29bd39b1f665c84fb0af469e5e7475a546cb6d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995492, "uuid": "2033ee8f-2259-4b9f-9949-b2331d2eb2cd", "value": "T1ED6633D178C529B1E083DB785822767EB1393FC37FAB4D053AA97A145EB331221B5386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995492, "uuid": "9a8236be-2c29-4848-b53d-f9b5694a40d3", "value": "98304:pB6B0TitPiEW/IaMIpMDH2SGck+LfdKYyrKqN6qinuy8wTTUw2sRxVlFtRx+TNjW:pB6fPq0iA++LOrK+6243RxRtRsx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783995492, "uuid": "78fbdce9-8b9a-4a2a-bbc1-96a72efa67cc", "value": 7114752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783995492, "uuid": "34286c04-0b3e-4e1f-8ccc-0c443e413be2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783995492, "uuid": "e78bcdf5-a22a-40f4-8877-851631005f8c", "value": "app_setup.6653002.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da785fd5-7f84-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784034400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034400, "uuid": "544a0f3b-d0b9-4200-95d8-0e41162e1416", "comment": "Malware payload (Mirai)", "value": "d2661e7882167f2b58b55c20be748c31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034400, "uuid": "f145fc05-cc0b-42f9-950b-9d14bb123aef", "comment": "Malware payload (Mirai)", "value": "fcd6064ab8128214af98d533ee86db334fb51127b98ed0c6ba3541e671356ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034400, "uuid": "3bc53be6-be56-4359-834c-8c1e5792796d", "comment": "Malware payload (Mirai)", "value": "5f1ccfcd15737aab8fd66ecb0675063d133327aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784034400, "uuid": "3ce2b3f4-81ff-48e7-a4e1-745146f63525", "comment": "Malware payload (Mirai)", "value": "ef3bc4c3c3e0600debe0f019c3deb850cf2c93018228a0c6952e969741e960adaa179595b90299b9215403c4559bd762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034400, "uuid": "2e78e6dd-eccd-4df1-8fc1-c4d8309ad09e", "value": "T1B3847C0AFA63D5B1E0729071018FE776A13598351023D96BFF5B2E78EA353914B0E36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034400, "uuid": "ba5794d5-4630-4c18-b302-e3a2a205752d", "value": "6144:e3uKbva/Y5IipvMvS8sUbrCwN1uZ+PSdai/xUGDyrPN7:YuKbv4YHNMvzrCwN1uZ+PSdaiJFD4N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784034400, "uuid": "0e567a0d-065f-4fe1-943f-352150a3d244", "value": 394920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784034400, "uuid": "4bdd1078-4dc4-4cbe-8032-1b9519bd7529", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784034400, "uuid": "425ac9b4-8562-44bb-b8f4-ef1ae034babc", "value": "lkchngqsu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b77258-7f2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783997529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783997529, "uuid": "60be34a5-e844-41d3-924a-ce76dbfad906", "comment": "Malware payload (Efimer)", "value": "e097be87d39d5673afd233fbb535d768", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783997529, "uuid": "57560015-afbd-4bec-9d31-2786e239c12f", "comment": "Malware payload (Efimer)", "value": "fe33733d353438f4edcf5baf73b602a3a668cc5a948e4a685b13d5d4bfc16b12", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783997529, "uuid": "dd75d089-5f7d-4173-b19f-54cce230ebbe", "comment": "Malware payload (Efimer)", "value": "4920e8b0a9e9975aa3f032dc234937b053738114", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783997529, "uuid": "7c6353c0-7f55-4c3d-a27a-bb01927541e5", "comment": "Malware payload (Efimer)", "value": "1af79300e88a2bf4188f4f97571655f6eb6c50d626a888605f28da9d26397850c82dfc9115ca6a931ea67ce80ad0a522", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783997529, "uuid": "dbb494ca-477f-48b8-b040-d383f66a125b", "value": "T1D9E63359A9E000FFC8B3847DE9E15695E5B1B4BA47B2C9CB5A34C2763D032E1493A733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783997529, "uuid": "30e5bcba-2919-402b-bbb3-fcf9f7e667f2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783997529, "uuid": "bf2e7dd2-3687-4f43-818d-a3bcd3d21621", "value": "393216:GgtTYVvhwkt1E7PnFgaLmohSkZm9XMCHWUjXicuI3/PGTAI:GgiVv7t1YPnJKoG9XMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783997529, "uuid": "fe481f14-08b6-4c15-a9a2-1b1a57b6abac", "value": 14318314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783997529, "uuid": "2eb787b2-617a-499a-8aea-c3b3f281412d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783997529, "uuid": "7971e4b4-a75e-4b0d-a3e5-ec7eef1af149", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe84beb0-7f67-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784022005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022005, "uuid": "2cc73339-39f2-462a-8a4b-8f0a05467d81", "comment": "Malware payload (AgentTesla)", "value": "70ccc55374a58a7513304ffafa37db6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022005, "uuid": "343c6e90-58a8-41a1-8a2c-7f6e56e21ac2", "comment": "Malware payload (AgentTesla)", "value": "fe3e2114d24a0409a7b58e97a67c9da775fef6bc736e26f5a3ddaab131b090a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022005, "uuid": "9971275e-d844-4fea-842b-94e13638603c", "comment": "Malware payload (AgentTesla)", "value": "dd6d0514ba78dbf7e39288b14a9fa36338ca76d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784022005, "uuid": "92d24f6b-1173-403d-bf64-301dc3531b80", "comment": "Malware payload (AgentTesla)", "value": "e80176052f039b198a9d66498d704bf7d30f2934b28310f69bc0ec111bb9efe3eb33838986da118ee4eca89c459a0fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022005, "uuid": "be4815b0-3f4b-4415-b425-73af259eeefb", "value": "T1D63400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022005, "uuid": "69e2a258-1ce2-4649-b691-69092660802a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022005, "uuid": "6d378cfe-c0a7-427b-aa20-0a9ea6deb6e4", "value": "3072:mabqayiqH2zSyo+AskmTHo9rG8KaG5jnTh3SYufzz:xqayiqWm1Isq8KaWT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784022005, "uuid": "6dc7f713-d146-4d45-90db-1c4f317d732a", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784022005, "uuid": "5ca4f1ac-b331-44bb-8691-15386d8a4457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784022005, "uuid": "43abed03-ca8e-4b4c-83f7-d3cb02973220", "value": "fe3e2114d24a0409a7b58e97a67c9da775fef6bc736e26f5a3ddaab131b090a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399e4022-7f91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784039713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039713, "uuid": "c87f4884-54ae-4a64-9411-e8bef6b691f0", "comment": "Malware payload (SilentNet)", "value": "e31037ed0338ac70968e8d22be42a8db", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039713, "uuid": "5c28da62-437e-46ef-a98e-ed19ed3f8bb3", "comment": "Malware payload (SilentNet)", "value": "fe4336542f3f7b6d46756e17fd4dda4021695b1c542db24de954841afff1a418", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039713, "uuid": "27513a36-510b-4d03-9ab3-712500182a04", "comment": "Malware payload (SilentNet)", "value": "ffbe49e51646c03dc517f9bf9b86530df7c274ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784039713, "uuid": "ca52e5ec-040e-4099-817e-4ba9c1256f53", "comment": "Malware payload (SilentNet)", "value": "885fd0cd1fae0699cfa8ee6af5fd6fb309a06f4ed2eb82851b29d64eeeeb2ba333c58d7f981b2311731ca4c1bee13304", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039713, "uuid": "e12c4417-c6b7-43fc-8478-7bd5ca7ae567", "value": "T1C08312394DD8AF59F117DAF8AAC5770E5A5E81C8CD444D0DF6828819313A77F8D34C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039713, "uuid": "243de87a-93db-4c83-b5ba-9337fbadba2f", "value": "1536:fNUwRYhC+IGI2aNNDREGZFNOpNXO+TUwCBRHkCYhFBI1fq:FHDIIxDkpdO+SBRHLeGfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784039713, "uuid": "af0fc806-a162-4abe-90c2-eebf39ac05ff", "value": 87188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784039713, "uuid": "26cb14da-e75a-40c8-b2a7-d0425ad38318", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784039713, "uuid": "11025a38-c993-4bf3-bd4a-3b562763c6cb", "value": "Prestige.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50b219e-7f3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784002984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002984, "uuid": "c215cc5a-31ff-40e3-9308-76e7f24bc1f6", "comment": "Malware payload (RemcosRAT)", "value": "30baa39bbd0d1ad26b871e9fee44d4a9", "object_relation": "md5", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002984, "uuid": "486df4fc-730d-4bb1-8e7d-2e33ffb1ac65", "comment": "Malware payload (RemcosRAT)", "value": "fe6a7db6a680805ff319a6ff8e19ea4b6c9e42623887162c53bc8f7a2dea942c", "object_relation": "sha256", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002984, "uuid": "6b895757-4e9c-461e-8f17-d843029896ea", "comment": "Malware payload (RemcosRAT)", "value": "330c1447a047bc6a92bd2fe05937ef6b9efc628c", "object_relation": "sha1", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784002984, "uuid": "0d42ab6b-b187-440a-b8f6-219427bdff26", "comment": "Malware payload (RemcosRAT)", "value": "8d9f140bcf944f57a8de3503cb6b0bfc2845af9abfb4e471ad4cf4e13dbecd5336e8911eba109f6bbd6cdfcf305cd3d2", "object_relation": "sha3-384", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002984, "uuid": "3ccf635a-742e-4133-8a96-df9234e534de", "value": "T1B5A5C01DE39C12E9D227C134CBA66232E2B5B4560761B9DF369DD2152FB39D02F3A312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002984, "uuid": "2a190d8a-dbd8-4152-8346-da906f639db5", "value": "49152:DS9ZGKd9rfG8GcW2wdgVnAp6nZSrWu5S3+q:KGMTFAUIr1IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784002984, "uuid": "c1e216a0-f571-4ee3-9460-ca222be8c630", "value": 2111488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784002984, "uuid": "44752bf0-99cb-4ed6-98b5-cdb4ed00e128", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784002984, "uuid": "161a1313-c770-4b3e-9af5-9b2c35de357f", "value": "Bonifico n.1101252230290390.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0a20b2-7f77-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784028878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028878, "uuid": "3819fd61-077f-489d-a187-c5965e523d49", "comment": "Malware payload", "value": "26eeee7d0493dd1410db774242f49b2f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028878, "uuid": "cbdab32d-e4f0-41a3-9631-c5e5c85f19c1", "comment": "Malware payload", "value": "ff12c78f24a435c9eaf2f9d1cca37a4ffac206f260d383fd231b59f433b0359e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028878, "uuid": "9ca8e73e-aa77-4545-b133-8f182339c3fa", "comment": "Malware payload", "value": "3b7e974a9b6cc32546f57ecebd11aeca230d80f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784028878, "uuid": "91d4df10-477b-49c3-b1c4-139336e4831e", "comment": "Malware payload", "value": "72d5f483daa408965b623fdc22690fb99732d5043bc7755e1ec9043f547f43cd1e69deb443ccee65688c1dedfac63bf1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028878, "uuid": "7b91bc22-3025-4ac0-adfc-994c3c093452", "value": "T144136D6566843C24AE9998371D7E2F0CBDB983E5310851DDBFCB3CF58C49A9CA209B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028878, "uuid": "c109d589-a783-45c0-af31-dfc3d4baaf1f", "value": "768:h96rDTPjHw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:hwr3hcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784028878, "uuid": "61191ddb-3ec2-44d5-b31b-8e4af6146c40", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784028878, "uuid": "97e98706-28f6-4eeb-9586-e2fc6a933832", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784028878, "uuid": "de165567-f32a-468a-971a-bd8b8fe756a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815df9e6-7f6c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784023942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023942, "uuid": "d63da946-08f6-49c0-8b36-55c6985afd4f", "comment": "Malware payload (AsyncRAT)", "value": "4f147355b56ed6882730560f1d76eb4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023942, "uuid": "b6b39fbe-0df1-4fc2-821f-ae211d4fc763", "comment": "Malware payload (AsyncRAT)", "value": "ff6b4d5c82f96a4b2d8788888fba011d86c49340f2ecb4b859a7152318ae8d96", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023942, "uuid": "5be969d2-443c-408c-aa8d-ce6a4c2b1282", "comment": "Malware payload (AsyncRAT)", "value": "af11570d171d3bb11cf1f154c3362371fbd0c756", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784023942, "uuid": "cd963487-45e2-40c6-90be-989ed250242d", "comment": "Malware payload (AsyncRAT)", "value": "0e9e1ce26305e0cdd24a5f05578ebc7ad8580262f5b3858816a003590409b7878cdcf0552f816c4b2f022fb2269df5aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023942, "uuid": "41f7fd1d-8fcd-444b-82f4-e527eeb0310a", "value": "T118B4B0006BC87D5943DA0F35F12FB4D9FAE6098D2496548AD722FC47AE64301F9B2AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023942, "uuid": "d1edd8c6-b485-4eb3-b6b4-88e4cbd35ba6", "value": "12288:nFOnANYEJwZsc+Cgog1q/EoQpBfA9RjPynEKynEM5eLs5:FOfRGHCLgagAbzK+EMsLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784023942, "uuid": "2a268d05-acba-4329-8295-ba030c03f2b1", "value": 508245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784023942, "uuid": "37da6db5-a3c7-48cc-840b-7a7a96263fd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784023942, "uuid": "4e49c124-6668-48a2-bdf7-a2fe763cd41e", "value": "HK0987654323456780.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }