{ "Event": { "published": true, "date": "2026-03-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-09", "timestamp": 1773100982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0bfd1fe5-6f9e-4095-bf67-5dd79ef765c5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bad2260-1bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773087523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087523, "uuid": "7f3eb06d-c9f9-4d95-87db-a74c11b5d25c", "comment": "Malware payload (CoinMiner)", "value": "07bd5d0edaca14204802b8ff7db346ce", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087523, "uuid": "4cbfe410-0686-4132-a966-b229a4a684f9", "comment": "Malware payload (CoinMiner)", "value": "01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087523, "uuid": "6e43f0ec-2eb5-445e-9006-ce3f50450906", "comment": "Malware payload (CoinMiner)", "value": "660784d4aa65c5914978fae86d4f493e26a9b2b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087523, "uuid": "2b03213a-ff8b-466c-b478-04deceb7cc02", "comment": "Malware payload (CoinMiner)", "value": "e9edfb572a6ea9233719f8bdedff87069e249a7ba3abd40f49da08db3c587cfa15c992b1835c3bfded129d66e5dd1b5e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087523, "uuid": "5721868e-4834-4440-969b-1e3794b6b51f", "value": "T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087523, "uuid": "7aa35bdc-63df-44a6-bfc3-62ead8d77c85", "value": "3eaf5807ffab1e2f73dcc6c476f60324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087523, "uuid": "85e64b22-8500-49a7-8988-2e885276e220", "value": "192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087523, "uuid": "8a4f43c4-c5c4-44a4-bc53-5b8a7637a1c6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087523, "uuid": "133c8051-5208-405f-9d39-200bc9831bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087523, "uuid": "b1de6548-77d7-4170-97af-3b20e0e1dd29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f586df2-1b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773050727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050727, "uuid": "f48206b4-2d45-4a14-9563-cea8523f1749", "comment": "Malware payload (Stealc)", "value": "e2d51e426aefafcaa2064691c920e282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050727, "uuid": "80ce9e17-73df-4952-94d1-11663241552e", "comment": "Malware payload (Stealc)", "value": "0267f046308eb37ee48f932dce3ed33d578fc7e4bec5b24c9b845ac42a902253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050727, "uuid": "33c34178-4fd4-4f99-99a8-1cc6c23ab7e7", "comment": "Malware payload (Stealc)", "value": "3910f18bd957d7e70b063233e613514d868c2410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050727, "uuid": "1a864ad9-eae8-4e54-bd26-6cc96e4cba44", "comment": "Malware payload (Stealc)", "value": "b22d20f609ce243fa6b48ab7283009066ca8907b8979a17e4eaf92bcaac39c2160ed16625cb48acd65bf29726be4b73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050727, "uuid": "97ef8f0d-8dca-4d56-93e6-4934dd7196b4", "value": "T1F2C5C683A2930455E14AB370B54D01D59781EEA205E4BBBFA8F2FE683FA41441FF3A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050727, "uuid": "5dc5f433-e597-4707-95be-e7184ba2f869", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050727, "uuid": "f1a82b54-2778-4849-9a7e-3a831b00d504", "value": "12288:oDAkyWb+BEzNquZuAkvHM3GL9WsgJvJafWFwURUVzfB:QPxDRLZunvsm8Jaiwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773050727, "uuid": "30027a6a-5378-42d6-b743-e7480b7af683", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773050727, "uuid": "275e1168-5ccd-4be7-bcf4-40aefefd7f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050727, "uuid": "241541ae-6293-434f-9b53-d340e574233e", "value": "x0267f046308eb37ee48f932dce3ed33d578fc7e4bec5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18f5e8-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773068786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068786, "uuid": "060be265-583f-4db3-9135-8b65ea0f8b73", "comment": "Malware payload (a310Logger)", "value": "613b36b9f4e4c3a6626e3787007e291d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068786, "uuid": "b7084687-fb98-4f8b-8fde-208d35a70dad", "comment": "Malware payload (a310Logger)", "value": "02830077e7bc905e7a62f87b477b6a9d182c480c14ada347adce54b15d6fe02d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068786, "uuid": "fb82d365-224a-40a7-8d8b-3c90b6a2c0e1", "comment": "Malware payload (a310Logger)", "value": "ef3a9e66086c8b0a48854a0cd700cef5e165f02b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068786, "uuid": "5455e748-1a8b-4064-b12c-6ffeae6aa71b", "comment": "Malware payload (a310Logger)", "value": "48c6d85e3fd12bb1f86e8c807211bdffb694604bd616fe07173ce9e6d2ea0eafc33949e500efa4e3f5b15dfc007d1e4c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068786, "uuid": "202bc552-a4af-48a3-9750-a662b74e4782", "value": "T122E5B0229144177EBC1C3E2A10EB711EF3B05C6B98B188DCFEA5BD86C49E571D421B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068786, "uuid": "e619163e-d513-4c7a-add9-9a77bdb1f590", "value": "24576:AGjx0bdyTCiLdrT/8iSngm+ekx6UOaZnYqwgHP+:hubdYZL1T/8qm+f6UbZnYqwEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068786, "uuid": "c71dfe32-7f36-45ed-84bb-7c390e8011bb", "value": 3035203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068786, "uuid": "3ee10b83-ffbd-48d7-86ec-a8a2592596aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068786, "uuid": "f974886f-19d5-44ed-ae33-d2c8eef13a54", "value": "613b36b9f4e4c3a6626e3787007e291d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5430aa-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773038884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038884, "uuid": "c389b7f5-eeb9-4b01-b2ed-8e6b95827e40", "comment": "Malware payload (Vidar)", "value": "c4f2245e661746919eef7265cfca975d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038884, "uuid": "e8125a55-2203-4009-b836-7de0458d4043", "comment": "Malware payload (Vidar)", "value": "036cbadb1f57e8acfc5a54c01c0c82261b68d95239e6604481343d7c2504a6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038884, "uuid": "bf1fecaf-56fd-4c76-bb10-a5807675fc2f", "comment": "Malware payload (Vidar)", "value": "8ea90d8ed85b116f610e3187e0f5071bd480a9bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038884, "uuid": "6787d1c6-73c8-4840-a9e4-d2d2faa54375", "comment": "Malware payload (Vidar)", "value": "725a10fbfb372ab1413748f3add1e188fd5cadc2f6f218b17e02c17508afffca9418f40438c8eacb42a2b0999f198615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038884, "uuid": "cb721af5-cb65-40b6-b51b-81585ac60c35", "value": "T1B7C616AB62E58268F15D827BD0A28F30A4F3F1750737C2E732D147988E139C95D3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038884, "uuid": "8f856bbf-122e-4ba7-847c-3df03ab5d139", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038884, "uuid": "fee5f975-11a7-4fb5-9666-61c3b857612f", "value": "49152:IX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNhcXCBz+COt:NzCoeoTLtBAa1rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038884, "uuid": "24ae5e92-47a0-42a3-9447-618397f3fa86", "value": 11819520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038884, "uuid": "8781fdc1-9079-4754-a638-1046c29168cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038884, "uuid": "686a490b-4033-47c9-ba2f-c82b38d5072b", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0489de-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054107, "uuid": "7390960a-5f0c-4f40-8ec3-ada7d6ae4554", "comment": "Malware payload", "value": "8bb75fd48b895157f7844f061a908845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054107, "uuid": "387718e3-fe98-4447-98eb-7c4bac44739c", "comment": "Malware payload", "value": "0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a50642181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054107, "uuid": "99ee3fe1-7e83-4072-9009-4b2bd5a4e427", "comment": "Malware payload", "value": "ea3e94304172189db52b03b3491a346708408033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054107, "uuid": "dfd5d7b8-1210-474e-b65d-b5d47553f777", "comment": "Malware payload", "value": "da4fa892193ac0a554ee89fc3e4ec1b5ed3cd3d3ee53406a0836920c422f4a534147d81d39f21dfe1d73038e04877622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054107, "uuid": "91726b93-c09c-489d-8e48-726edbc86caa", "value": "T1D607334043A009B2FDB14D3DA8B0A969C166BDE73BB0C55FD7B803626D637D22D2D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054107, "uuid": "69a36672-a1f7-4cc9-905f-b8ea2a3581d9", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054107, "uuid": "fb7fbbc7-72af-43bc-849b-8a51b2bfbbfe", "value": "393216:Qo/cZBQ1lwGaa5wEMiuHClSXMCHWUjrrRQ7XbFsn6h6eRGP3gWBjVN:kqgaGziuilSXMb8rrRQ766AtP3gWB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054107, "uuid": "21322b5a-3b8b-486f-9478-8bdf82ac93ff", "value": 16954889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054107, "uuid": "c2fd98e4-ab19-49c6-9c9a-cd690facd252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054107, "uuid": "c02cc563-dc36-49d5-8e08-e8a30690a81b", "value": "0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a50642181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac40343a-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053809, "uuid": "c1e2e3fe-72aa-4a01-a096-431cdaacb9b4", "comment": "Malware payload", "value": "36b9518029173037cc4ba853cdf6d05c", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053809, "uuid": "b90286a2-b777-45be-bfbd-7dadbdf1e784", "comment": "Malware payload", "value": "0499fffb19677fa5f7ef73e6c6b138d2244938abc80f26c386b88ecf4f61a206", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053809, "uuid": "dbab1180-47d0-4214-97b5-d15a649a5d5e", "comment": "Malware payload", "value": "6b5f8416a31a20e665bce63478886411fcb5dacb", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053809, "uuid": "2c71d527-35ec-4667-98ca-dc840d8716f8", "comment": "Malware payload", "value": "8fccf90055dcfb9fe1d24bc4713a98e88eb9ada162c3bc51f3c911123d4e51d2e78b2ea89f94da55982b7985623d44e9", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053809, "uuid": "2edffb33-0346-4fcf-8e02-e13bbea062af", "value": "T153838D93AB4A17EC96948CF96309B923A5F6C97B3C192278FDD10583B43DF11B922734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053809, "uuid": "8f5d4523-5095-4bc4-93b0-b93548319a59", "value": "1536:/UuzIoMVcAJ/TwicXQjHhl/jpgqWwnwNinITu/QhIB/ZMWR:ksXOcKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053809, "uuid": "7e477843-31a1-45a9-94ce-97fab0689d3a", "value": 86756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053809, "uuid": "fb50d3e1-67c0-4094-bea6-928423baae1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053809, "uuid": "969831fe-ed17-4642-873f-896a95226244", "value": "0499fffb19677fa5f7ef73e6c6b138d2244938abc80f26c386b88ecf4f61a206.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5109a53-1c0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773097605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773097605, "uuid": "036f9a8e-144e-418e-a829-0d735f5eb787", "comment": "Malware payload", "value": "e0bed9f3a37fb6e3cae427829ab350b3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773097605, "uuid": "22a347d1-422b-4f78-9320-d844ae77d146", "comment": "Malware payload", "value": "0540737f42ebd2e42dcc1fbc5d43d9b0c55b97fb3fa228e20aa51a392f55804c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773097605, "uuid": "2219fee2-b0f5-4ae9-b8f0-a13bd4cd896d", "comment": "Malware payload", "value": "632ab46346ead28f71de7e51461fe3549eee5174", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773097605, "uuid": "e4310e69-5772-4ae5-ab72-8977c64ce4a5", "comment": "Malware payload", "value": "446c21be8b29b8c617eb2c56ab1f77951628659c71f46caa17c43fbd16418f38fbb35bcb5f73c122f615c5f833997fe9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773097605, "uuid": "a1f3098a-1e24-40b7-adb9-d3731a867540", "value": "T1188533955185EFFBD72BA03A1DE16E7F70A8329640BDE3C46ADD05DE28274931A070BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773097605, "uuid": "b6a9b031-017d-4877-b325-4a992704e320", "value": "49152:Xk7EE19j/kZ7GBNSwZeT/Zq7I34njUVjuOsl:XAEE1GG/SdsUMOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773097605, "uuid": "c9aa900f-dc58-47e1-820e-16c737244528", "value": 1784319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773097605, "uuid": "fbd7826e-d0e0-4c82-be6f-8dda29616adf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773097605, "uuid": "76585530-2ac7-4c49-8d86-544ec013187c", "value": "e0bed9f3a37fb6e3cae427829ab350b3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7893eb1a-1b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773050716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050716, "uuid": "cf194aa6-0ef0-42c6-8324-9cba8e4b0f63", "comment": "Malware payload (DCRat)", "value": "238cd37b1f7a03fad4846389e320c084", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050716, "uuid": "94d1347d-58b5-4db3-86c2-3b94e2a8b171", "comment": "Malware payload (DCRat)", "value": "058add3a76861e33920560412912eee7651c2ad2a9b81a26f679313a44310fdf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050716, "uuid": "8fb5d856-b6fe-4ab5-a160-ec925b3f4fe9", "comment": "Malware payload (DCRat)", "value": "f9d25d7ba6ef61653759c9a9162612fedebacec6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050716, "uuid": "18c4d455-9aa7-4cd4-af78-7dd0af71b149", "comment": "Malware payload (DCRat)", "value": "6a82191a5dc9dd048b37a69a0fdc6161324b30847a9476c3698fdcfe786fe7e2edd45fb945b877ba10cb1d01afc8b686", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050716, "uuid": "fb5f8404-34ac-44ac-9386-9a6babb34f92", "value": "T144557B117E44CE01F0091233C3EF458997B4E961AAA6E32B7DBA3B6E15123977D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050716, "uuid": "7f6556d4-2c47-47e4-9daf-02fb7352afcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050716, "uuid": "fc6dfb4b-7a2d-4492-b734-3856efa123c6", "value": "24576:0X04gO0v1bEYao5wf3BPxAgCrsbEj95RzBM/xKozxw:07s1Tao5KBdqnRFM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773050716, "uuid": "daba24df-fc4f-49c9-b6b1-394ba9927052", "value": 1357824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773050716, "uuid": "5eb2bf16-3c72-4cab-bf91-787df85c6090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050716, "uuid": "5b2304a8-5ecd-4629-9a83-0e8052d83ce3", "value": "238cd37b1f7a03fad4846389e320c084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddfbf54-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043423, "uuid": "0f278af0-f59a-41f4-9b82-3a4c99e39829", "comment": "Malware payload (CountLoader)", "value": "c5083ca592e8452b99e6ac86c8a19659", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043423, "uuid": "b0d0bb2a-7717-41ed-a12b-80c9af08fcff", "comment": "Malware payload (CountLoader)", "value": "06a3c6c95e739430812dddcdf09d93dcc3368bbd583cad0e0d6cd3428a2ae43e", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043423, "uuid": "1d47d6f9-ba8e-47fc-bb7c-0b07a91b4f2e", "comment": "Malware payload (CountLoader)", "value": "751e41edc20f3e403f0a1bc342da2b10dfc89498", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043423, "uuid": "6d695dcd-0ae6-4db9-a946-e5a860311570", "comment": "Malware payload (CountLoader)", "value": "4bedac3e8cab8b2ae9cf9dddadde74c52fc3d25e405fe79289bd577f3bd7fa078385cb8ff7133d6ff27abb9c01af4468", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043423, "uuid": "5ebed80e-f65b-4045-9c08-bab2ccd1a2c0", "value": "T1D6C3CE8938EF70C746122C298217E893CD52EB1F640BC97AB66CCB795F4491C61EDBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043423, "uuid": "68010d99-e544-4c3e-bec7-2b1e84edabe6", "value": "768:w2OaivivZr9OQo0N6x1Am+BW5ttAJXD2j/tAnYiSFytX0/u0KxCVutK0Xv4aBo4Z:pdN6x1ST2jeYVFKnCevIapWFZ+HAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043423, "uuid": "eeb74bd6-8c0b-46c7-9624-cb7d17f8e281", "value": 125393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043423, "uuid": "10497f81-4356-4719-a486-8906f5b64c0f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043423, "uuid": "13702410-cdd0-4cf3-afa5-b761428b2859", "value": "Invoice_Beta_v4.8.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8eaf20-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773039373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039373, "uuid": "1625e7ee-a5e8-4bb4-9342-be558e228bf9", "comment": "Malware payload (Formbook)", "value": "5cf8fae59f34b621462e2a938eae1f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039373, "uuid": "82c1ec01-91d5-4546-a3b2-1c4191ea26c0", "comment": "Malware payload (Formbook)", "value": "0736f9fef6e924f985231d52de2f37dcd16fad0ce814d152248628a18d632d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039373, "uuid": "b1348a9c-ea63-451e-92cd-2c3cabe20568", "comment": "Malware payload (Formbook)", "value": "8c203394238342ffad83acb4fde1ef703e70f4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039373, "uuid": "d9a36049-bde3-48e2-a4c2-02ead4cd9784", "comment": "Malware payload (Formbook)", "value": "4df8e7cc7891d0846458234a2ed0dba336f099647eb5b69fed12f7b2cdbad72a8c6b5d209f9e3604191b9138a93d6be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039373, "uuid": "ce3a1cd0-ac50-40c0-91d6-dea97721ceb6", "value": "T159E4C0B976047CE6F27F467BCA966CD8137236638B87A4CE41646BD30D633B0EE16805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039373, "uuid": "d7479962-7e3a-484a-93ab-31e86938cd9b", "value": "8cd0ceeac7350ba45773653bf8ad7fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039373, "uuid": "99fcfd9e-9ade-4031-8dc2-77afdd7d8751", "value": "12288:T/1PseLGkpd4igiIRwH4nOHM+SAUdcUnsJjDb2yZ4rDCC8QO6mmMMVW24eQ6wYpi:T/ueLMiQtnOHM+SAUdcUEjDyyZeCC8P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039373, "uuid": "866bee75-65bb-4793-8695-7a47a4028e4d", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039373, "uuid": "a6b28d62-13ea-458b-ae2a-7c4fc86cf7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039373, "uuid": "3f791c04-5855-4a00-af15-7639d9f85efe", "value": "COPYSWIFT_MT103_REF_BACMGXXXX920RD011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b25d1b-1bfd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091114, "uuid": "7832e53c-1cdb-4340-8df5-4177b6f2d2bb", "comment": "Malware payload", "value": "3b9a96041192e0860cc039f5507dd5da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091114, "uuid": "6a646a1e-5e58-4563-9454-34a3a646727f", "comment": "Malware payload", "value": "084dbd5563fb9b83793957c0ee176d38b1129987eeb5f922f27606f52c0c8be4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091114, "uuid": "db3ba427-be6c-4c01-abf2-cff29eb8662d", "comment": "Malware payload", "value": "dd2bb5dfd3a117562f60fc83760412862c8a7589", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091114, "uuid": "da81c887-66ef-4582-9050-b9a9ab420c50", "comment": "Malware payload", "value": "f036ddf46485649cf6a43d5187ef2ff705920342badc8363450a7572c9e5291c58f875b60c86bcc2d99a6f70fec50125", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091114, "uuid": "f108659b-d6c2-4056-bf4b-3d48cc3772b1", "value": "T12DC3A84E1CDF0071069F3816160B7586EBB2578B0B4DD6D272BCD7A83F66A2D40EB4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091114, "uuid": "a7fcfe18-a9f7-4e81-9d7c-0a30134507e3", "value": "768:NUn9iNGlFkxrlBdp8GMz8p8xcRaQyOmsxngqaqwfJksfwg42fbzZgIlAi999WFNQ:NVS0cURaQQqaqwEg4Q6I39YEbo7mEAa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091114, "uuid": "0e8bedd1-566b-447f-af1e-723570c2d711", "value": 122957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091114, "uuid": "60f7ea17-5274-4bfc-9fe6-ca6384d61871", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091114, "uuid": "5e8ece35-b347-4f2d-bcbf-2ecb9d251e79", "value": "Europe_Dataset_Final_334.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d747c82-1b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773050751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050751, "uuid": "28fc9d67-9f08-466c-9462-3b8a29fa6205", "comment": "Malware payload (ValleyRAT)", "value": "03e9763f3e9999ee3eddfc9d1d238988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050751, "uuid": "29901f9b-835c-454d-97b6-736f99983004", "comment": "Malware payload (ValleyRAT)", "value": "0a5c661ec5c23a88eb4bc0a903489d77b39faa7aa6525fe376007d454be952ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050751, "uuid": "016df81b-1f1d-40c4-98ce-f9c29a441968", "comment": "Malware payload (ValleyRAT)", "value": "c4314c7626ad2d717ef744c4d67f538bc40e2e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050751, "uuid": "7467ab03-d59d-49f5-8ae5-930be1b2d3f3", "comment": "Malware payload (ValleyRAT)", "value": "e5edecc2bfa22ca0c08944281a021718664f031eef7e6266ca484066f80982dd3abdc85968d179658ac0996e27c89108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050751, "uuid": "5bbfe684-66de-4ff4-b076-27139aa748e6", "value": "T1C5D37D4733A450F9D4A78279C9A24A06E7B374660735A7CF17A086BA2F137D1BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050751, "uuid": "31649b3d-a2bc-48d8-8009-7f6a25b70225", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050751, "uuid": "69e52cea-6917-47b9-a0f3-8507b4658799", "value": "3072:XO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o5:XO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773050751, "uuid": "87344fac-d209-4753-8031-934b0e1ec47d", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773050751, "uuid": "d93ac53a-127f-48c6-970a-cda462812060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050751, "uuid": "53abf0f9-ea03-43de-8c26-f8e5b3c7672d", "value": "03e9763f3e9999ee3eddfc9d1d238988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a23e02-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773060593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060593, "uuid": "a09b291a-c175-43e4-9a9f-e9c0d2a370f1", "comment": "Malware payload (EternalRocks)", "value": "6d60b4ed70a575a60beabe430210efee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060593, "uuid": "62e20beb-6d9e-41ff-96a2-5814c0bd8bed", "comment": "Malware payload (EternalRocks)", "value": "0a62b065688ebbb636fb8f800881da22d6cb480bb458870909a39c0228c10c90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060593, "uuid": "43007264-2f97-4a97-9332-ae5ac5f10a22", "comment": "Malware payload (EternalRocks)", "value": "4c33913517f56b663a228a52b745b1b4310c390e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060593, "uuid": "50a3ac28-7050-4835-ac9c-2634c20b5fb3", "comment": "Malware payload (EternalRocks)", "value": "93ef6a6fda0979f960a41f8a9cdb63e244d16da7b39973ff593c24ad1f571c3f042e1ca04a2c8fa061e08a725ce693a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060593, "uuid": "254e1693-4ce6-4b69-ba9b-3924667e10de", "value": "T1EC558E6172D715F7EACF5031020ABA6FE779E06C2F20CAD7D2D05E67A932BC25634942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060593, "uuid": "6d71b16a-df6c-4f9c-8f38-c310608cbbba", "value": "2b6cf70a28379515c8e174f9b5717856", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060593, "uuid": "6c47cf8d-9c53-43f1-adb0-349ce9148a6a", "value": "24576:q2rZFMtJUivSpItJ9ByeeCLAacNuFP771BFIYCdOG4L/IXOFTzVKHBIOba+YARl:trUQItJ9XLzV1BFIYCdOG4LyOFvV2IMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060593, "uuid": "33a5c7e7-b5d4-4f11-80d6-52392e75bb67", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060593, "uuid": "9f27eb79-0642-4190-bf9c-70dbe799966a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060593, "uuid": "ef42916d-4b13-4632-b9e7-e1a5c52e6f0b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.22578241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ab239d-1b8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773041903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041903, "uuid": "bf376b99-a9da-4f87-9eb2-02353c1127aa", "comment": "Malware payload", "value": "de77b2a10d6e2a75384c880d56ca9194", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041903, "uuid": "9d5ec803-200b-484c-a821-8368fd9e7574", "comment": "Malware payload", "value": "0b6b1750fdd0a30e1f93aea37296e4e79328f1bc39cb01d6a6a39b0d48370be0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041903, "uuid": "55887628-55a3-4ea3-8b5c-cf676d73c5b6", "comment": "Malware payload", "value": "9aa865858f47783c33eed31f3fb035d9fa79294b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041903, "uuid": "f0765403-45f0-4e7a-8a60-f62dbb3323fc", "comment": "Malware payload", "value": "34e4e170b205f3593481ae9bfb8f2c0d7f963ee03e9cdba63e8b004cc66c605df1df40ad8dc6cc4928fd8f0e17cfc862", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041903, "uuid": "a8a449fe-3c7f-4d70-97e5-ac3f7df6c995", "value": "T124B304455C6B8476C7FEE8A9828B5C5BFBC1620F172CC4107A0F69602F22DA5D4BDBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041903, "uuid": "bfc7ee49-afa4-483d-a05d-d650a8a7f4bd", "value": "768:RFpWj+liWfJ2rKNxfL6D+IGDKC/Y1VWxwrj+yKqSGXysMdZkZLaQvxULyFIrc1k/:c+/fd2OIl6yaGXysMdZ4ZBlicQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041903, "uuid": "c832b9b4-f8b8-41e6-8b2b-af6e62b1f36d", "value": 114503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041903, "uuid": "011c689e-57aa-4ee5-b33b-9ffdb704c391", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041903, "uuid": "7ccc901d-4e23-4f4b-8530-bce77378bddd", "value": "Global_Neon_Build_149.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e7b475-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043413, "uuid": "3be3a1c4-af96-4672-ad3d-e08353e68218", "comment": "Malware payload (CountLoader)", "value": "c30b97e0c8a1629f1655022061cb82e3", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043413, "uuid": "b7753d59-d57c-43d7-bddf-49fb51861681", "comment": "Malware payload (CountLoader)", "value": "0b7aaef18f064093bcc3bda8c92173ee96141e7bee8c91240264c881f6f251ea", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043413, "uuid": "90bb529c-644c-46e2-ac9e-9a0db974b7c9", "comment": "Malware payload (CountLoader)", "value": "54de9cf72ed83914daad165b3c9297588730239b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043413, "uuid": "9aac08c0-e8dd-4d9d-9333-52d39037afcf", "comment": "Malware payload (CountLoader)", "value": "61754f12b710b411b6d0c23051bc3341b12b106507f3ccd9c76a7b4154a711133cb0dff95cf651308cd9e32b08ec63e1", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043413, "uuid": "c1634685-5cb5-4a5d-aaa4-d8fcab3f6922", "value": "T1CCC38E8946AE59ED83066838495F0407DFBEB7236E4CD9D0F55E8290BF7BC9842FC894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043413, "uuid": "b1580f4c-0258-4dc4-a2ee-52a7e0bc35ee", "value": "1536:zmFhn/U/srKLnEFr1+CXNaY56Nyx0jAO4bQW4jJu5:JoQC90jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043413, "uuid": "bd340429-c44d-4bd5-95ec-6c961acace27", "value": 124044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043413, "uuid": "1eec287d-5793-4bbb-b8b7-8e3695099263", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043413, "uuid": "e8d91dba-328d-4710-a249-40adc0ab9c33", "value": "Fusion_Document_Europe_6517.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544391f4-1b92-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773045071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045071, "uuid": "2941644b-44ff-4f81-973f-a3e70f21fb9a", "comment": "Malware payload (Vidar)", "value": "81003378cd0abd804a0fde22cc33def0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045071, "uuid": "1736fc9a-98b2-4aa2-9079-02783159fc32", "comment": "Malware payload (Vidar)", "value": "0c5c5e8913579e246fcc2ff96f2fa8f5ce82b296ec0ae4952d25125a94ce5251", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045071, "uuid": "d2326909-1d05-4160-b9a6-9a82433177f9", "comment": "Malware payload (Vidar)", "value": "9bd822cab600743f1dcb14e1e80038ca9690dfd3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045071, "uuid": "b91b7465-7034-496e-a040-b8e0e7ef879a", "comment": "Malware payload (Vidar)", "value": "c69e922966992f021c79566db676a13166a91122128e16fe187788d8820f070a58d75e2b3f89baca1a8d2dbfbbfb2efe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045071, "uuid": "efd79807-0ed8-4940-b3a1-2d604d48b502", "value": "T14A96E62B2EE5B178C16A8D3EC093CB4094F3757547FAC1E7F2620FA99A119C54D7AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045071, "uuid": "a70a50dd-c35f-4592-ae79-6ce22c73b155", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045071, "uuid": "15552326-e212-428c-aa8c-8b84dde782c4", "value": "49152:4SC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfpTTP4qSFnBTAvCB7JV:k7b2OoeoSKpqhT4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773045071, "uuid": "648bd5d8-0511-4065-9c1b-9b57db6929ba", "value": 9184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773045071, "uuid": "5dfb062f-f980-4e56-b6be-3c3ceceb9619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045071, "uuid": "86979801-efb4-4200-9cd7-79180c3b427c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0374c193-1b8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042788, "uuid": "4f70343e-da7b-4c60-bf23-f0851e8d8db8", "comment": "Malware payload", "value": "941c589770edb9921e911311aac41982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042788, "uuid": "399298e6-b7de-4ca7-b1a9-727d72200834", "comment": "Malware payload", "value": "0ccc3231d491cfaa06db8b5f9edd6a308577975df02d0b1b5eb2288c928b0d29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042788, "uuid": "8ad14a8f-1e2f-4a2a-8ceb-489d14cb793f", "comment": "Malware payload", "value": "fcd553713ee33e02b7b05c3ccbb64c7b566560a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042788, "uuid": "b76224ae-ffa5-479c-88d1-147b64b20afb", "comment": "Malware payload", "value": "2d719c2d21df084a03a4b4789bc3dc08b88d214af99c72925177baeb2636a06f8346374b847412f8fe72d3ec65b22b77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042788, "uuid": "175b350c-ba0d-47c5-bffc-0629b9194789", "value": "T18D3502709E73649B2FF2C05C5962AA878D1C2F91A4B721CB7A55C1DFCFE7429C1092B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042788, "uuid": "8523a52b-ead0-4219-a197-43af290ac3a2", "value": "48:veN4OWADtExAtfxXHLt6P5z87K1OOdoOCiOlAKEtIzzz7MCzzzv0OuaLLiPbhI7F:lPbO3ymyyuxykyZykymP2Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042788, "uuid": "8a004948-87e5-4615-9c56-29361cd7b827", "value": 1146244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042788, "uuid": "9866bf38-349f-4d02-8c1d-f8597d475df3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042788, "uuid": "b463097d-e083-4e8b-9b39-0c26179439f7", "value": "new_product_order_specification_request_03_04_2026_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a272184-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043417, "uuid": "4152d1b9-5622-4387-9b78-77d8b549db99", "comment": "Malware payload (CountLoader)", "value": "53bee385626cea6823dbbf48eb04c183", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043417, "uuid": "03d725f9-235f-4c26-9ff6-31e02c0684d9", "comment": "Malware payload (CountLoader)", "value": "0d24a35bc17cf1c3f374c20acd4a72a588d38456b816ac2a8f8fb669df1f4cbe", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043417, "uuid": "61e459e9-f7d7-48b0-83b1-e7aa27e505dc", "comment": "Malware payload (CountLoader)", "value": "fe6c4ca7f58458231403a873308066be66f1db29", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043417, "uuid": "eca74af9-70e7-48d7-87d9-42954d3914eb", "comment": "Malware payload (CountLoader)", "value": "540cf40cfdb93c0eadaced010d2e2e0bd1bb942747eba304b397803e2e8c281e1ffb4935ef6b24e7b65bd520cf67afa7", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043417, "uuid": "5fa6e7b4-1430-4760-a82a-824251299ae8", "value": "T15AC3CA1D08FF219142466E11E6EB5877D7A089538B14C3D1376CB6F1AFACEB2D0FA294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043417, "uuid": "a0f01027-1b6e-460b-92c6-039bfa2916fe", "value": "768:XSSjwv7F6JtyU7UzU2tUMUaUQUuU1tUNUZMUZHUZKUZqUZNUZXUZAUdmeQUdme60:8kh3w95M+wkcZhT28TB2pNf+dxAwJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043417, "uuid": "0b787700-bb59-4284-be47-7074d29dc22e", "value": 123306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043417, "uuid": "bb2f94d6-d9bf-4efb-a62a-deb3bc242bd2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043417, "uuid": "80acb05a-a46d-424e-8a13-aec9a93f0109", "value": "NewYork_Release_Temp_153.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428105e2-1be2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773079401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079401, "uuid": "bf2cc409-b107-47bc-bfad-ace8c7983f45", "comment": "Malware payload", "value": "18328c68f73ea34eb3ef72ea34ca4b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079401, "uuid": "ec817cd0-6a76-4cce-bede-430450141147", "comment": "Malware payload", "value": "0d4b049801571883a536a8ac6312958183afd6e3ec1364d7a460c8b62982f2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079401, "uuid": "c31a195d-7304-40ef-a908-1a53ee423ce3", "comment": "Malware payload", "value": "b271dff9204f039141f7b53b301e2dfd279d4f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079401, "uuid": "9f06f4a1-9911-4cb0-be7a-5b5e409d76f7", "comment": "Malware payload", "value": "e9341d9189d88f27f44af98f3f370f46f59c4e65c895585b9ce07e7ccab86df9f789ada55704a9d2a7b11c6ce798ae8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079401, "uuid": "4a223b0b-3dd1-42c3-96b4-732863d36cf5", "value": "T1398222CC7FC2F3708271607B292BA53EF1AE0C90B0AC95D885D56259B978718D7F64E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079401, "uuid": "3a1f80a1-5452-46c0-996a-f0dfbae7f830", "value": "384:xul6Idx8c2+ufmua7ISaf4ZlwVFM1Xn2GNahL3WmwRyHS:Il/2cBVMcyc2GCrWmwRyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773079401, "uuid": "aac58124-463e-4717-bc21-80e4004762fc", "value": 19247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773079401, "uuid": "32b81d8b-26ea-4a4f-b00d-63441ebdb90d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079401, "uuid": "c8bc3482-0d28-4ffd-a207-dc3f07788819", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24bc4b7-1b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773021258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021258, "uuid": "f51ef39b-33a8-431f-adb7-15a8e4d9d906", "comment": "Malware payload", "value": "e9c1ebd332655a5567763444576dbc38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021258, "uuid": "1185cf4c-fe39-40ed-9264-fc08d45e5946", "comment": "Malware payload", "value": "0e59e19adfdedede1c052f744aa460b42d30fea69b5569e739c6ad6c6f883925", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021258, "uuid": "e8c4df9a-11f3-4920-b171-992f5f638a16", "comment": "Malware payload", "value": "e683788a247cf98d5f73a29e4e1ce38ffa597b80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021258, "uuid": "17f77759-4712-4514-ac4d-4f2a03d1a6a0", "comment": "Malware payload", "value": "03a3451cb429d983b10a0b660a33c2c9da66b7e822ad6ae16ad867b4ea709ec5c746a606d441a3e350b86bc8003db152", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021258, "uuid": "59e58cda-7ab6-4d37-a5dc-3078e51a9dcf", "value": "T19DF054F907765F02A14DAA96B0A3048B6387FEA8B4DCFB8CBC5602152D4AD60F018F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021258, "uuid": "ceb8b1a7-421e-4955-84a5-312f8de35696", "value": "6:B8+yiqR2GLD32+yiq9zk8b+yiqWdT0eFK0KvWk0+uBa+yiqR2GLDl6+yiq9zn+yH:Br+n7t/8C8ewat+0B+nhhD8ewat+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021258, "uuid": "8113f374-5e74-4759-8315-d0020b2e5dc9", "value": 514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021258, "uuid": "67d79473-1fa3-4024-bc47-385766306d98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021258, "uuid": "1f998e22-c2c9-47fa-a188-16756529c525", "value": "teleport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde613b5-1b94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046134, "uuid": "995941b6-d75d-4fbb-b3dc-a8f97cb99798", "comment": "Malware payload", "value": "3cd015a2cfa4f5038df234539f79f696", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046134, "uuid": "40dec33d-da2d-45b3-8997-d78a681a7f25", "comment": "Malware payload", "value": "104356dea1aa91a3b749bbe52e33046c0ca0053e1b83c318c66be51e29469790", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046134, "uuid": "18782002-b43d-40e1-a79d-2e4920db2e7d", "comment": "Malware payload", "value": "a64ae7a543ed023ef5c7236063ad7b9b22d8166b", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046134, "uuid": "f0882e65-df07-4f90-b729-767b49d70e27", "comment": "Malware payload", "value": "84151ab5b9c623bed1f7e0c5e10dc8f4524afab6f24d81b8b0dfe3802e788da6ab5c878356e343f11390919bcd33236a", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046134, "uuid": "ef437b1d-6520-4691-85d2-6585ddbb7d03", "value": "T12844DE9008D0637ABED127747729C1D08BED3509ADA88F2F7C81EC1A71976BD4AB7349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046134, "uuid": "5254a5d5-ae47-481b-9413-457d90726444", "value": "6144:RAcHxktl5lNXlEMsBkUK1pownvPo1zYYa/E9INEMvPhEF0:Lktl/NXlQBkUK1DvgdYH/E9IlPhEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046134, "uuid": "364c2c2b-a3f0-4e37-9af3-2ae79e4c88d8", "value": 274428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046134, "uuid": "8412046b-a96a-4eb5-bf8b-ca7114870d1b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046134, "uuid": "26f7e389-dba9-4cf6-8267-28c2c206ebd4", "value": "Purchase Order 120010690.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3127c60a-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773070782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070782, "uuid": "4c0d348a-959f-44ee-8d8d-83465db16460", "comment": "Malware payload (XWorm)", "value": "1ca66f5770cff04b03e200aab601cdb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070782, "uuid": "fb85f062-32aa-4c43-b91d-72b1d4661823", "comment": "Malware payload (XWorm)", "value": "109b233024348f26571c086aa6aae6eeedb062a704b4a23e0d87dd2234659103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070782, "uuid": "44b4cfa5-3aee-470e-8964-f82090f824a1", "comment": "Malware payload (XWorm)", "value": "f6ac1b40817dae7058cfec365974e03ea68538e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070782, "uuid": "6c2a4b76-e50d-4202-90aa-2650aa53653f", "comment": "Malware payload (XWorm)", "value": "b891428386e142ee993fe8956868583fd12c7e5f3f9d8e77e3c4442b60eb10c4df9b0407cea0e03939b33fd1f79cf25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070782, "uuid": "26bdb5e1-3739-4720-bf80-344a66fe83a4", "value": "T160F56B47BC9188F6C0A9637188B752427B76B8491F3223CB2E50B7782E72BD05DB576C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070782, "uuid": "c3821859-185d-4ad3-b36b-d52028dd013e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070782, "uuid": "83a24804-9324-4fbc-ba04-ce53745a3864", "value": "49152:UToPNLT8P+DQdNqi46i2t9ZBvc7+pTcsOG5epiv+4:UCbgFC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070782, "uuid": "4dde7be4-8662-4c8c-a9ae-b6720aeace77", "value": 3564544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070782, "uuid": "fa1a61eb-7ea8-472e-957b-212fe735c081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070782, "uuid": "855948fe-9f83-4bd1-9565-a5256e54b10c", "value": "1ca66f5770cff04b03e200aab601cdb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb392992-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098609, "uuid": "15fb99ba-c4db-43b0-ad35-12ac11adc3e6", "comment": "Malware payload (Mirai)", "value": "cef2b1df876dc39acc45ae7b391dc13c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098609, "uuid": "4a592979-129b-438b-887f-454ca9cea4b0", "comment": "Malware payload (Mirai)", "value": "115305edad4bbf58c06f67ebb9357cb67cfb03b3e668c72a62fa607324ae943a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098609, "uuid": "b1d0a88d-cbbe-4e8e-8dc5-1d93ecb190a3", "comment": "Malware payload (Mirai)", "value": "47b2271c13eb01c946285aa535db95f46cef13fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098609, "uuid": "20ca7daa-b019-4d73-964b-116ef0913855", "comment": "Malware payload (Mirai)", "value": "ffa4c3fdfbaa3cd8ded431d608037359b42317ecc613a2745cb09ef60086c9f5957fb3150d80fae0ea98afc1341d3355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098609, "uuid": "66ccbb2c-6126-47d7-851d-3e3f80c7d730", "value": "T17BC33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098609, "uuid": "0d9d5fe9-918c-4fa8-9879-981005b0040c", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmbGHzNzQSRN6Fpjygljc:jrguLRkHQo8SsGT74p1oB4n2pvalnBzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098609, "uuid": "0f8b45bb-f9c7-46ea-9ec4-52cd65944ec3", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098609, "uuid": "017ff370-fbbb-4b5d-89f5-f0c10740432b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098609, "uuid": "1796a234-bbe2-4b22-b3c2-480d9f5b7c0d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59005909-1b82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773038207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038207, "uuid": "1c2654f4-375d-49b5-961d-dc0e221f20ed", "comment": "Malware payload", "value": "bf8e74f1dacedcd2026ef97894cc7978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038207, "uuid": "ca10570a-f55f-4721-bfa9-19b34fc36edb", "comment": "Malware payload", "value": "11b3b6fe6ff2b4d31c43cb6d61d1249ce3f266252d7d10e9a48d1af9117b688b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038207, "uuid": "7a917792-6646-4941-9247-397b9507618a", "comment": "Malware payload", "value": "33a3fe17285b172d94e1965828b5c7764ec8ddbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038207, "uuid": "de37675f-a5d3-4773-bf22-12819f525265", "comment": "Malware payload", "value": "f145d21d9abc8efb285dde831e3a5e08287dd50b6dd7e62afdeb1ac017a5689677f6f6999a0a97903ae30a0ee02e1f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038207, "uuid": "ec51a44e-63fa-48cf-b69f-dad24f19e696", "value": "T11AE5334A3FCA4D79E2962575589523B957F3EEF81B6182CBA6A031228C317D07D381CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038207, "uuid": "3e78e4d8-7653-4c8c-b3fc-d7583009dd93", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038207, "uuid": "60417920-fd86-4e5f-b111-d574f76cbf4b", "value": "49152:zQ5Lf2b/TJSUijJAUzz+UfzciIuvVp/GyBQJIAkxHq1+uMSwBcHJj60HvbfW:zQ5LOb9SUM/zkKAkpq11C4Jj60HvzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038207, "uuid": "8ab1308e-6e18-42d0-932c-a000012efd92", "value": 3188992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038207, "uuid": "4fa76a25-0daf-40b1-8779-c1be8633dee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038207, "uuid": "ab6bf8bc-e08a-4d9a-963f-6b0dc2f2a8cb", "value": "bf8e74f1dacedcd2026ef97894cc7978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dbd483-1bbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064479, "uuid": "01ca58b0-2240-4d6f-888e-20eca6485682", "comment": "Malware payload", "value": "62fe0b98c11f76b5bb5619331a0aa386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flyland-Software", "colour": "#E91AF8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064479, "uuid": "8022e04d-091f-4c0e-af18-457414aed043", "comment": "Malware payload", "value": "129a40e38ef075c7d33d8517b268eb023093c765a32e406b58f39fab6cc6a040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flyland-Software", "colour": "#E91AF8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064479, "uuid": "1e47c0f4-709b-4d05-beae-cf8e7610de79", "comment": "Malware payload", "value": "7ad4e55536d9c43e20549a652564691dddcb5440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flyland-Software", "colour": "#E91AF8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064479, "uuid": "2f37eec2-18f0-4a49-9ce0-a8f93631fd85", "comment": "Malware payload", "value": "161aaaa802d82456fa86fcbb5e08812987bf1ac4668d93398e9bfda75e817c2c13a14311c92aa51c97d1ed2b9d217a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flyland-Software", "colour": "#E91AF8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064479, "uuid": "037c7cbb-81f9-4cbb-8d38-a88c858898f3", "value": "T19E957DDF16E7219CF4E5AC70D0421B42E6E17A2DEE298DE3C27DE23026367D91909367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064479, "uuid": "89e429a3-ac81-4fc8-b0a5-fc1726cb0bd9", "value": "19172d9608fbcf4e59f32293465d5d34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064479, "uuid": "644fb7e1-1220-4278-9e7a-5e03142263a5", "value": "24576:ddWq2RlDqm06RT2+Wwa0iEg/NMtkqtFw1YUVYZ9ilDRO0pziG77r5eVj:ddGlDqd6RT2+sSUuiBNig78j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064479, "uuid": "28fe9e8b-3ed4-417d-9f56-ba3cf266200d", "value": 1930064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064479, "uuid": "469c372e-ce10-428f-b5a3-cb5e870c64b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064479, "uuid": "4e5ce04e-6632-4f71-bc0a-bcf8ca992765", "value": "129a40e38ef075c7d33d8517b268eb023093c765a32e406b58f39fab6cc6a040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6726cce2-1b7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773036084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036084, "uuid": "39cb3c2c-ee32-4d26-a1e5-bc8cc6a63035", "comment": "Malware payload", "value": "e5e29b802d8b50cf32001ae0ab5a796a", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036084, "uuid": "70079964-20f3-4bb3-ab62-40b7b8c0c147", "comment": "Malware payload", "value": "1353a7505ed7f2cebb49b1b184dd50eeffdd28f973362e0c065556eaa5f660a1", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036084, "uuid": "0bf1e685-a46b-4281-a583-9669611a5a6c", "comment": "Malware payload", "value": "6484bdb2140e35898502b247203526e08ed9935f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036084, "uuid": "473db3ff-98b9-423a-9b23-334682cddefa", "comment": "Malware payload", "value": "6c15a116396cccbd4b5432309f7e6153b2e67bc15bb25e0448ed2ef0e1942293101c43c4fe505c614ee3f333fb7e1820", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036084, "uuid": "1e8d33da-da46-4afa-9cba-eb31fee4cc18", "value": "T18AA68D56E2FD00E8D4BBC1B8C6574617EBB234551330ABEB16A08A652F37BE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036084, "uuid": "becd9bc1-cf89-4023-a5d5-0011a3c42a66", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036084, "uuid": "b9937be5-7337-4551-b10f-66bb215146f7", "value": "196608:JWDqwpamFZxR4VsS3UbebqMTCj7/GV6rVT:Jxw0MAs9PMTdgrVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773036084, "uuid": "d671402a-bacf-4eb0-a0c2-c00a98f23ec4", "value": 9968640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773036084, "uuid": "02bf6464-cf5f-4e80-a656-41cc8c4b3d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036084, "uuid": "13a5cfb9-4213-41e8-8e9c-9f4cb5a3893a", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab50274-1bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091683, "uuid": "1af67ed7-2d81-4d65-a0bf-bce8172d761f", "comment": "Malware payload", "value": "d382c52bb0eb64f34512da8e42d6e81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091683, "uuid": "a96fac89-0c7c-41d7-a2c9-90529c09dfeb", "comment": "Malware payload", "value": "13c0c83d83b08fd0f97eb8e7983d051d0609062dbae2c15ef936f383aa661685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091683, "uuid": "7dca2ab7-a752-40be-b3a0-2e0afddf83ee", "comment": "Malware payload", "value": "d489612fc5037becad7585e441cb739e45ad8d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091683, "uuid": "1bc4b901-4664-47c2-93bd-9ac01604679a", "comment": "Malware payload", "value": "ebe890e6cd667990fd83e744e8bcd8026f236f8105c7adc87952fbdca52b71508f877e5867cd09073e4fe6a0d2862675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091683, "uuid": "7cd068c7-4878-4592-8259-c15574217b4c", "value": "T101B6067B62E44368C15E8D7ACCA6CF04D8F3B4741737C6E7029317289AA25D06E3B66D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091683, "uuid": "63f4b36e-1ffe-4494-92e6-433f2fb7c346", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091683, "uuid": "ee978169-9751-4cea-94a1-19a91402b604", "value": "49152:G1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpZfMdPHQptZHHsfNafkI:G3L31Poeo13p3HHsfNaTEdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091683, "uuid": "60db5176-4f9c-44aa-adb8-59082d91b9a0", "value": 11000832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091683, "uuid": "b2e35f97-21e7-4b9b-806d-a1324093b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091683, "uuid": "93b02d5b-a208-4f65-9147-15167179efac", "value": "SecuriteInfo.com.Win64.MalwareX-gen.75579121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2584c06-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773039646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039646, "uuid": "ae9067f9-c5f2-4cbf-85ef-a317ce9e36e5", "comment": "Malware payload (VIPKeylogger)", "value": "6a7f697c5b6e1ad293ea972c8f42f298", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039646, "uuid": "2f823bf8-f28b-49a8-a782-fac58ad527dc", "comment": "Malware payload (VIPKeylogger)", "value": "14b25dfcc6e7f69992b3f5543bcc9ebe86bd0b682e211f49cb62c019d8e9bc4d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039646, "uuid": "b05bdbe9-cea9-4d17-bee6-588c5820b159", "comment": "Malware payload (VIPKeylogger)", "value": "5c864384b3789768192e6cebeb2f62281d003394", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039646, "uuid": "d2a47e32-ca75-4b30-9d82-d3e47684f6a2", "comment": "Malware payload (VIPKeylogger)", "value": "ec3000a4f51620854283a76272e3cc3ed4d385a2458f9f7fb721f12641e3f535e751d265de76aa566f419713937b4442", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039646, "uuid": "1b6e0df9-28bf-4c7e-a075-b85a9bd43de0", "value": "T1B8B4F2114DC86FB9DFAC1A1890FD171EA7E05A8A5417794EFB33BE4AAFF7904011B089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039646, "uuid": "5762b044-145e-46b2-9f3a-78b9dc7a1623", "value": "6144:GYnSaZcZz7xbsiParRi4sgO2V5EAka9eFAhrecKegfCoysxkQcg4efWkcRlmyWT6:c9Dalf0AH9eFAhreKmCMioERlGGYwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039646, "uuid": "678072f8-dbfe-4f1b-b6e5-3b642477ef5c", "value": 539816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039646, "uuid": "080a1fb8-3b54-4a78-8b95-c5d98482b0b2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039646, "uuid": "d8ac0f96-b72b-4cdb-8df1-9a854b424327", "value": "Sales_Contract_MIQOSZX040441.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a0f859-1bcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070231, "uuid": "d2b65453-faff-4636-8438-467c52af9344", "comment": "Malware payload", "value": "46582b568803b49f801819f16ecaf1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070231, "uuid": "57268e98-1fc3-41f8-9ade-620df1659ee3", "comment": "Malware payload", "value": "14e2d790b1ec8d2c29a595b3b4d5e58ae49eec714e143e33fb340d992b0b6c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070231, "uuid": "99091130-4a27-4620-b0b6-ef814c2806e3", "comment": "Malware payload", "value": "dc64cddd13ca267c19e75b3757eee287bbdff3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070231, "uuid": "49a786bf-2f8a-45d9-b898-3ee76da3d1d7", "comment": "Malware payload", "value": "63a16aee909c67fa97492c83d5b0843525bf62ae32a801ddf9a8eda735106d46d21aaf4fa71ea8d8c9c33fba1d88ec5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070231, "uuid": "56f04c2f-5fa2-424c-80db-a2723b9bc513", "value": "T1BD35D651F4A620D5AD12FA23CD5927A36DB348103D41387872CE97C95AC47A86BBF3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070231, "uuid": "b9f7b31c-6110-44f7-b099-2bb78974b354", "value": "96:JF9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9F9Q:vyA/qDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070231, "uuid": "83a641ec-1514-4205-b708-1dc33b1a1a84", "value": 1145933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070231, "uuid": "1d87b981-705b-46fc-bfa3-70c222c1ecc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070231, "uuid": "9353b3ad-da6b-4019-a55e-5f3b0116afc1", "value": "shipping Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cb9e99-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054070, "uuid": "99100a3f-e3b0-4f58-ab7e-7284b3e59adb", "comment": "Malware payload", "value": "1220d2bf0b50e9758ab29c605cf9fe01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054070, "uuid": "dba916d5-8853-4c58-b140-cf3846c370c1", "comment": "Malware payload", "value": "15187dbe81dd9c8ce5dad8acd10dfec269b51fe72b67bccce60870fb91221980", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054070, "uuid": "a89cc150-a86d-475f-9ebf-c0b1e836b5a3", "comment": "Malware payload", "value": "701c97f154a6f856c901993a5f595e9c6530100b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054070, "uuid": "ccd94f1d-48ca-4b7a-80e8-49cf82f5d33c", "comment": "Malware payload", "value": "c9eeead1f01910914df65476241c4ed92cda6c6c23b1a3258f8efe0b9a0bd244770c2795733413d37f2d4a108707d253", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054070, "uuid": "b886eb8e-1a44-4add-96c7-e5207c8f9b3d", "value": "T13242A5083DB720214F6B54BF931F720A66A6441B250BDE1075EE83809FA1FA5E5F73E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054070, "uuid": "a193c9bb-2032-472d-b8ba-315ae27a4c4b", "value": "384:9V0OvwKlNdN1Crzat+O5ZKfy6GkepbBRV/poZTgIuvA4GHVa5bBjH63wzr:LvwKlNdN1Crzat+yZKfy6GkepbBRV/pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054070, "uuid": "1dd668c3-f7f3-49d9-bd80-ec3ada36857c", "value": 12873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054070, "uuid": "189521cb-7f41-4950-adda-238fc2709256", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054070, "uuid": "3c0cab25-7f8c-48d9-88c7-81e2cf599cd1", "value": "scripts.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a4bb94-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037104, "uuid": "cfd6c4f5-1f43-4f63-a218-ea5d415f1a97", "comment": "Malware payload (Mirai)", "value": "a3480b4afa54e8e1db8e27657dde32bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037104, "uuid": "bb76e10b-7ae1-401d-b9b1-0dcda5f78b53", "comment": "Malware payload (Mirai)", "value": "1542593fc136ada1095a4743dea2ae1cc748483f219449d99d1a4a9983223836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037104, "uuid": "fdcc917c-911e-471b-82a0-ee0c27f55379", "comment": "Malware payload (Mirai)", "value": "67f369bbbe88d1805b39c8deac9a105314542054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037104, "uuid": "b619fe70-b9ad-4788-8abe-678fd18dbc24", "comment": "Malware payload (Mirai)", "value": "11c96f3522760e4264e79be863c7a435607d461e0847f1cb66ffb48ff3264909c58f396917298e09ea502598d843833e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037104, "uuid": "a02c6e80-363d-4253-8b8b-42e28e00ba4a", "value": "T1FB531A52FD42CF13C5C321B3BB9E4A453B166BE8D6EA32029935BFA137874C70D26A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037104, "uuid": "474eb95c-ea05-4afd-b592-41a8bc94cb46", "value": "768:cdq7L+I6zVlRbxxL1JAYBRGlNUCXw/cMDwJGtG8+8Cd0OC8xi/0npSMhbpTmaDV/:x7sItNUuoEe+jd0ObLZhFjDhqvJn3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037104, "uuid": "f92e1394-0086-446a-9b59-ef5cd343a77d", "value": 65680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037104, "uuid": "44dbf170-c436-4340-8c08-0782dd2a4611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037104, "uuid": "5791ee41-c851-49f0-8403-a452a5bad99e", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f7684-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054377, "uuid": "8929406f-5888-4f07-9895-4fdb0a9aea74", "comment": "Malware payload", "value": "5fa8c4b5feed7484e1bb56e51ab6b9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054377, "uuid": "bf7cedd0-b0b9-4342-894e-1b22ee3cd149", "comment": "Malware payload", "value": "15de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054377, "uuid": "a064b382-6dd2-4392-92ce-096ac9501f19", "comment": "Malware payload", "value": "7017b69b09f3b51ea36ba121b83092bd345d9725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054377, "uuid": "2e558e58-e6d2-49e9-ab1c-9d1b5750262a", "comment": "Malware payload", "value": "1e5b33a5ddbfc9c573280ffc9b51ce9f826d644243f37732703205b8ad027b13ae0c246f53e7e21fa9a312cdce7c8034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054377, "uuid": "c38abe4c-52fc-48cb-a2c1-468f31098da9", "value": "T129D35B5773E530F8E1B79639C4910652E772B8761B31ABEF03A4865A1F236D08D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054377, "uuid": "22ee0474-924e-4427-83cd-574a80f88abc", "value": "bb6ec78133cbe8ef33a52cb63b854ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054377, "uuid": "6a7df56d-5cbe-41fa-8d2f-d3d5d752cae0", "value": "3072:juVg0ZX/NUW3RgqGaVt6gGeISyGbU6uPNp4WZpDF131:juu6UIGqGq6nNhPNNzFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054377, "uuid": "546f3768-feac-4ab2-b4a4-c81aec26a32f", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054377, "uuid": "b48af8e2-1877-4e1d-814e-95d2f2abef16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054377, "uuid": "2e0a116f-7878-4fd4-8695-7f6543778205", "value": "15de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfced14-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773038966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038966, "uuid": "0f500a50-1d70-47ca-881c-0d4de698b4d4", "comment": "Malware payload", "value": "c08a4606654e1a2b85e8630d04d5533c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038966, "uuid": "3a5a88ae-14e8-4b0d-b320-3576570cc4b9", "comment": "Malware payload", "value": "16acbdffc1f39af50803caddc21133f489c76099327ea30623ea62b23caca17f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038966, "uuid": "bbdf12bd-da24-4b4d-8af1-ef0d98c64e39", "comment": "Malware payload", "value": "874186b8661bdf030c34c9554f6b6ddb62ebb100", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038966, "uuid": "3ea8821d-1619-4e5d-9be9-ac3fc46eb3e5", "comment": "Malware payload", "value": "c0d2e66329ed33dc59d261dbcf05f3bc27cca2f1c5c5e17709f1bd02a747cad0cef3d58898231cbf4c1c6b07d7366bb6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038966, "uuid": "85260586-bb53-45f0-9774-2bc23237eda2", "value": "T1F94165FFE01B9338CA43427501666D5CDE62E63B66029050FE8C0949BF644B0F3A56DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038966, "uuid": "6024c998-1f78-4f97-91bc-062547204358", "value": "24:8vd2jiOoQZly88q+sP4arW+C0deQ2bNbrblw5F3Q1RiQL/RRA3TKWsCNhKa4b7Qn:w2qeAqHP43J0dS5uTgD/A3NnG8/u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038966, "uuid": "78548c08-fbcf-4292-ae24-3c3da7d70877", "value": 2087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038966, "uuid": "5d2ea195-69c1-4e6e-82e9-1b128c7eb5d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038966, "uuid": "45cacec7-b86d-4194-9f73-49df68b413a6", "value": "a.txt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e51d74e-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773038726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038726, "uuid": "444c5553-d79f-404a-af80-500e44dd791f", "comment": "Malware payload (Vidar)", "value": "188069b6a059a5b2fafd2fb3a2aa88a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038726, "uuid": "26086370-c97f-49ea-abaf-8313253daad1", "comment": "Malware payload (Vidar)", "value": "17d6bf4c49062995225871d44a091d0f1fa62fea653a6a6815b15a97c3327c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038726, "uuid": "f2218877-00db-4b0b-b64c-995fb118d660", "comment": "Malware payload (Vidar)", "value": "1892e80e149dfba6f018c9436296f7de5e19ee6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038726, "uuid": "984e320b-c8eb-4e96-ba66-711a18cc5790", "comment": "Malware payload (Vidar)", "value": "6da347dd917e8ced83953fad7904b6bb7729d5c1506ae0c684747d632b0de922c8afc129ecc06fa794966255d39bd442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038726, "uuid": "76d5bbef-b4b0-491c-9178-3aa4e7ea748d", "value": "T190242321B902FC5CDA316177F6F363409172781542CAF5FB2ED2B98CA521F83468A6F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038726, "uuid": "66e50054-217d-41f2-af7a-b0806d9c5f99", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038726, "uuid": "81e88e90-9c56-4142-ace1-1dd458540d74", "value": "3072:hfU53ZR5xeumR8OdBi/bm1IJohPsJJ0uMJgRYCnc5SZwY9m6CGGidPzIZkhJOXnD:hfU3txADdBYSgoJbsfZwY9m6CYdrVJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038726, "uuid": "4090db81-b164-46b4-bbf1-533dc4e43351", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038726, "uuid": "2526ab1a-87ba-4633-8466-f0e98052ef89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038726, "uuid": "5d976247-97d5-4231-9fdd-60aafcf28886", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7b81a7-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773042508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042508, "uuid": "310b43ee-95e0-4c7b-8418-163178589667", "comment": "Malware payload (AgentTesla)", "value": "587288be2fdcbe7390ceafebe7a7ff59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042508, "uuid": "dd935775-4553-4224-9f7a-31ae99b4933b", "comment": "Malware payload (AgentTesla)", "value": "18165a00d7f21f370e4b0348fb68559d821a0976ea8778b8ed450bb47ef593b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042508, "uuid": "0bd20cf4-d4a5-4b28-a4a5-6534a9cab419", "comment": "Malware payload (AgentTesla)", "value": "4ac63e6eef6150626f357eefc35c86987a6b36c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042508, "uuid": "4202fa9f-fe8e-420d-9b3d-0ebd5addaf9b", "comment": "Malware payload (AgentTesla)", "value": "6cefcc376f2bdb414e7c09d4642c830260427520d65fe9c215b3f9a139762b24822438574fb120187ac62ac9126c7248", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042508, "uuid": "ba04655d-81fa-44c6-bc96-0b3ac34eade2", "value": "T1AF559E73DB06691DD22E3D95AC6EF82E90FC0E80422552CBAF3B6DA9E214F30C575B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042508, "uuid": "8dd07514-0288-4486-8344-787c1bc46ef9", "value": "24576:AewficnSPkbE5uFDI3EmzA5sbEhaYD57oM6LTwHHzAxZIDdKF7XXLa9LDlTEHydl:AcN0oCn9GrFpcY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042508, "uuid": "d161cc6c-c3f3-4fc2-919b-b34541ab71cc", "value": 1345490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042508, "uuid": "3a76255c-b11d-401c-8d76-0e2bb855a553", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042508, "uuid": "9c437f3c-bf9e-4d75-9cb1-ab100d482bb4", "value": "Purchase Order 4500004453.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73251d3f-1b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773022789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022789, "uuid": "515e95f5-5e10-43ef-802b-5dc7cb7b2710", "comment": "Malware payload (Mirai)", "value": "19f37fb514779abf80fda44df0e99308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022789, "uuid": "b9d9980f-4979-4227-b302-185f5755e23e", "comment": "Malware payload (Mirai)", "value": "182dc5a1e6dbb9027d11e3d9c78b61a7ada2c85e1a282229b2428a869af2f79f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022789, "uuid": "6083f592-52bc-4500-8f37-7f78dae5a416", "comment": "Malware payload (Mirai)", "value": "ec0e6a5f27e49c2f12098d24dad2359d3f5a91ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022789, "uuid": "0ee77b3d-337c-4c8c-a41e-625bf5567e4d", "comment": "Malware payload (Mirai)", "value": "5d4392413cb540de99cc07566cf03e1aa6e70a9ee961174bc66a1bc4521c057b823c9d069d4221810b05c72808a3ddbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022789, "uuid": "ac6ce660-b159-449e-abca-e2d07242e646", "value": "T10A14F981B9017F73C1C2ABB6F7DFC2553B726A1497DB3301AA69AEB02F466CD1D29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022789, "uuid": "4376dcba-faff-4dd0-8b3a-ebd1f1273539", "value": "6144:emiwIl245rTkOgqSbJxHabnvg0NwYdZZaSV+SRkd9q+:em0M45P0q0JWvg0NwyZ0SV+SRkd9q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773022789, "uuid": "bf26842c-1502-4c64-9411-68e7a4f38a45", "value": 199376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773022789, "uuid": "d90779a4-8198-4c48-885b-afa8b911ad8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022789, "uuid": "04d52d50-977e-4fa6-b52c-1681794e0d1f", "value": "a-r.m-5.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94ce3bb-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054368, "uuid": "2110f4ef-1c86-4dc0-b680-8f269b542dbd", "comment": "Malware payload", "value": "e4bf50cbb57ab733869a7720525566d6", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054368, "uuid": "0aad1f16-1bc6-4c47-b01a-15eaea82caab", "comment": "Malware payload", "value": "19704012125e694f2dd00485c2665ef4d050961939e549e4a4d5dbd3a57c9d2b", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054368, "uuid": "86540250-851e-463c-8a37-8f824c62b594", "comment": "Malware payload", "value": "e48f526011aa310e0181ba2f8830ec3f39c3f580", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054368, "uuid": "e1782edd-b259-4c45-a363-8e7a5c20b4c2", "comment": "Malware payload", "value": "fa29e6427512cdf5cd98a9bd6d22d2955b49ac9c16da7ecc08e7c9a2a5da69584555b92bc4bc1bdef8270858a55f2775", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054368, "uuid": "71574b7e-ad9e-4653-9c95-587999932997", "value": "T19E046B760B13FCFE2ABC3DC8D8013E460E9D29870629C559EFC811BA67F9990CE59574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054368, "uuid": "f73ae9a5-6abc-47ad-ab5e-6be55f3d8a90", "value": "1536:KgER/OoC9ZQAQ+kNriZnT+q1l3ypTqQHnJEv5EcjuJ6u+Ugokeua6atqz14ofzf5:mpuVAU6kES1U3rcrfpXi8/Mn5u0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054368, "uuid": "146ec56a-163f-49c4-9f9c-46398743aa1c", "value": 181592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054368, "uuid": "0c765132-d764-4b4b-b63b-043ef88ecfc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054368, "uuid": "708b5463-94ee-429e-a673-090c0e1eb29b", "value": "19704012125e694f2dd00485c2665ef4d050961939e549e4a4d5dbd3a57c9d2b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000a758e-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773038917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038917, "uuid": "b686af84-ad00-4ec7-883a-d75aa157f74a", "comment": "Malware payload", "value": "332701464a9b46a1c7f429d2da97c07c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038917, "uuid": "0e15a5f2-5fc5-4824-b2cf-6827060fb086", "comment": "Malware payload", "value": "19c1e8deaacb377d4b8d72bcd6127d00fee26126d91873b28ffe7e5beaeb0282", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038917, "uuid": "5f9f24e7-d32d-480c-9f62-d74019bd43d4", "comment": "Malware payload", "value": "419a74f65dffb1a584453312aeddad0d4afe957c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038917, "uuid": "aa475158-f0d1-49f2-9637-a5ef0cfcfe84", "comment": "Malware payload", "value": "5e875f2b66f26bac861d79fd3b08da523426792c089647e1a02e349b6925705350edc939a04e76b462e27422ade5458c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038917, "uuid": "1eebb3d7-d307-4937-bf05-ecb16f7ff6ad", "value": "T16D14390063E851E9D0AF90FC9397A801FAF130445324E6CB77618618BBBB9F925BF795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038917, "uuid": "5dbdf648-a93e-44b1-b6d2-0d8c4279d0ab", "value": "3072:BlBpOBXLkx86SRvSf1gUWujm2AxQMfTQZCSAgNx1PJ1zzI:Hu9ipSpSfm9Z2AxQMf0ZrAGx1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038917, "uuid": "822ded7b-cfb2-4986-ad5e-6d58841a715c", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038917, "uuid": "a0f25ac7-6550-4eee-9b9a-5cfa3c194383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038917, "uuid": "650fd179-6712-47f5-adae-418e4dde51f7", "value": "a84jo4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6ad7aa-1bba-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773062345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062345, "uuid": "0429eaaa-8330-4096-af37-9a6068006f87", "comment": "Malware payload (AgentTesla)", "value": "665d77ad939a86dc2a6a039da4c1acbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062345, "uuid": "d7c30c9e-c01a-474d-94d7-367a56379d15", "comment": "Malware payload (AgentTesla)", "value": "1a5f6870dce757bae62ceaf98999acaa48ea784b2b7c14abb213cbc3e550a4c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062345, "uuid": "fbffd834-bc3e-40f1-b531-c08678ce2c8f", "comment": "Malware payload (AgentTesla)", "value": "0187f7d5fc80b0145dee4a6b6cd22b3a1960f69c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062345, "uuid": "8ca14d0b-073b-4d7a-bd17-de0f1ca056ab", "comment": "Malware payload (AgentTesla)", "value": "fcc13810741ba5a760000b32187e9f46ed2ff36e76cab1cd16b8fbcea4fd325a5439f15f4323b0feab23d33fd234b787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062345, "uuid": "718ac60b-b1e4-4f15-b7e4-5c9e9523ce4b", "value": "T140161A50B0C5974838236D71A7987091CEC656DF2D86F906F01F3BB1FEA73C2AD612A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062345, "uuid": "9a3852c7-fa9c-45a0-9391-2751c25e77cd", "value": "98304:+l9+h0HHl62m0QAgmcOHjfX7VXNv/1Wb/tGyGq1OX+clIrzOjesPHK5vRIwYezCv:+lwSJm0QAgVOHDrBNVWbVGyGqAX+clI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773062345, "uuid": "7ff7b681-785a-4941-aa4f-304b4f8bc726", "value": 4181657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773062345, "uuid": "fd9f5c86-a804-4d24-b017-11f6e9037913", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062345, "uuid": "49202199-5360-4437-9e4f-79f4b9bcd85a", "value": "PO LIST.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64185f78-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054117, "uuid": "944cc820-c3f4-470c-8906-bcada5a547b4", "comment": "Malware payload", "value": "62dcbabcff567c9965ab570704f45a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054117, "uuid": "2337c243-46b5-4b10-922a-e9f6c154e4eb", "comment": "Malware payload", "value": "1af59525568e4bec660c30b6c14fc9c0d235d99c0ba2292ed81994c843e1dc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054117, "uuid": "4cbbbc35-02ba-49ad-9eb7-bc331adbc240", "comment": "Malware payload", "value": "e11ce1e8cfb738f2c7654b561f4d7f556087db1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054117, "uuid": "dd432e29-bf33-458b-8510-819e1ca2baf9", "comment": "Malware payload", "value": "307d2d501a958b881d035dd9b510615572a578cadd4b31071a0149aadc5cb216d15f22ce4f4750c3b3cee34eb1776829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054117, "uuid": "63b9cd3b-a428-4bed-82d2-3932db82fba8", "value": "T184241A0B73E30DB8D627D17582E7D772A932F8110334BD1F1AA8DB326E65C504F6AA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054117, "uuid": "32544f13-d630-435c-9da5-522f663d2a92", "value": "e56b7ad37b56c736d7cc2618d55bc219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054117, "uuid": "45bcac0e-b413-43b4-9c51-7f563647830a", "value": "3072:V4U/jY0DM9SiL9ui7jUEQCs3ddzt+RKeeCUSniVOU8waSDornoVU0mHOkVw1:B/EwiJRKeeCzsOU8whU080", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054117, "uuid": "842e7349-dbe7-4278-81df-76421076a861", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054117, "uuid": "6fd0f988-0a78-4eb3-882c-dc6e35c7544f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054117, "uuid": "5cd0fde9-01c5-4175-bad3-f451a67f67c6", "value": "1af59525568e4bec660c30b6c14fc9c0d235d99c0ba2292ed81994c843e1dc5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4eacb2-1bc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773065733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065733, "uuid": "d7a1d22d-0970-4c60-b3a4-adf82c00179c", "comment": "Malware payload", "value": "884d8f2f4111d298096152ecdc751903", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065733, "uuid": "5e2ad9e2-51fe-4e1a-8231-8770f8626e37", "comment": "Malware payload", "value": "1b9115b928239d2adea06d84ba8ed34c5ab1ba9ee68893b49dd2cecdf5711ca1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065733, "uuid": "0db28beb-e2f8-4370-90ba-cdb29b9b6026", "comment": "Malware payload", "value": "2758288aafcce37f5d957bc3954a56d928ab494a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065733, "uuid": "9658981c-9685-4bde-809e-eed96ee544cc", "comment": "Malware payload", "value": "4057538ee930745ed27f5b4d3ec5436f029f78ce2f076a67c7a1e114442d8623d36e7f6fde0983c6c49ce4b8abe90d03", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065733, "uuid": "1f70ec82-fcb9-4865-b4ed-2566987a805e", "value": "T148C3DD99CA9B4F895B432C70E54B484BEBB52D03391AEE70B72D82417F4BCA815F9DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065733, "uuid": "f24c1bdd-dd65-4b6b-bac7-2150e4404207", "value": "1536:BpRap+9YMXzEhRqYfTKm9no5U/AWQ9MejxOzvOS:wWtUYHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773065733, "uuid": "459f0100-5f70-491d-a826-6d3a4bee1500", "value": 123058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773065733, "uuid": "0fb52ab7-a48a-4934-8088-60758d10dd68", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065733, "uuid": "1404aa5e-0fa2-4ae7-85fa-46f84f063515", "value": "Archive_Draft_v3.6.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29382bf-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053793, "uuid": "a57a5848-cc33-46f9-b457-805e9d188c9f", "comment": "Malware payload", "value": "d8551563571e8f01c48a4c717810b7b9", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053793, "uuid": "d11beea6-eb24-462e-acf9-f665e752ad4b", "comment": "Malware payload", "value": "1bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d76", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053793, "uuid": "bf5215ce-e360-46d5-a676-488d64ee72fe", "comment": "Malware payload", "value": "e1dd68ffc3a7be2c7f75a47d55d1e21e7fd7d4b7", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053793, "uuid": "61ae480b-d445-490b-86e4-e83533c2c29c", "comment": "Malware payload", "value": "d25a6093e7d4fb0a2e9beca78f0284501791dd204e1d5db720e10769ac72b6d2a0886580ba83963c5371836e10c7815e", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053793, "uuid": "13996436-c848-4b66-a9d9-edd7dbb9d5a6", "value": "T1D9C378D3AB8917EC96944CF96209B523A5F3C57B3C292279FDD20693B43DE10B922734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053793, "uuid": "ebef86a2-08a7-4875-be49-a1b9d5b3ed4e", "value": "1536:jscGXHnMO7QRg+BAaed3AqnmSQti9J/KODi8X1POsuDP0QKBlvE37eH3:FmMSd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053793, "uuid": "ddf41a32-8421-4ed1-a094-e0ab2991596c", "value": 122009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053793, "uuid": "e336b0c6-55bc-47b7-bb4f-433a5f719a5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053793, "uuid": "cbd5dada-62e6-47bf-b7f7-b86f6f3be93f", "value": "1bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d76.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88669494-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773068781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068781, "uuid": "cf25e356-b642-4486-a06d-67d16e36855b", "comment": "Malware payload (Vidar)", "value": "730d705a72665f08fb2d8dddfc7e6443", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068781, "uuid": "2b22210c-1a12-4398-beb6-9b2205f492ae", "comment": "Malware payload (Vidar)", "value": "1c83863bda00873d081eb525fff37080a4b262a9092ca00887ba56234b860273", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068781, "uuid": "3053e18c-7914-46e4-b4a4-a1243cfa1346", "comment": "Malware payload (Vidar)", "value": "1752e656e0c810d2714c514770667f89d30d6d2e", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068781, "uuid": "8fd732bd-a493-4e28-b7b7-147e8b056cc0", "comment": "Malware payload (Vidar)", "value": "503d483aeea60ac52c6f510dc324728f20bc3a79f2edb8cc2fc196fb264231bd22023f27f3427589fcbe7829b4ea9c0e", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068781, "uuid": "010f99ed-5ff3-4d6f-aa52-2fa1ed91c5d6", "value": "T1E9A56C0BAC9544FAD46AA73588B67292BB70B8080B3233D72F91B67C2FB67D05D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068781, "uuid": "50afddf6-eba7-4851-926a-393a16b69371", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068781, "uuid": "12d126b9-2a0e-4d72-b383-142c128f7dc3", "value": "49152:zR2JFtXzphcQKV+cIPQu15jCSrvzdzAj:zEd7WVUoEdr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068781, "uuid": "6bada88e-b066-439b-b86d-f33c57376007", "value": 2165248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068781, "uuid": "4c987953-1854-494c-b762-45449b726be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068781, "uuid": "00679bab-0580-42c4-88b9-090739980977", "value": "cache.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd16817-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1773038697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038697, "uuid": "399edc1c-95a3-4f71-86be-8b82932b8aa4", "comment": "Malware payload (NirCmd)", "value": "16445e9652581965e427e9d187e69471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038697, "uuid": "ea22f0ad-510d-4b82-8aae-81b424b23f73", "comment": "Malware payload (NirCmd)", "value": "1cf289b84c5236fa31ef14ae1c24382415ad16574136f0dc83ddb800c1f39b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038697, "uuid": "7caaabb4-3fbd-4f6a-88f0-32019b2d15fd", "comment": "Malware payload (NirCmd)", "value": "209c8bdc4342c35d40a2f5ee4a6cf67cd5085d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038697, "uuid": "c17fdd1c-aac7-490a-b725-cf4805a4fca8", "comment": "Malware payload (NirCmd)", "value": "7556588b89b17bc83edf5b69ccf0de270de33074fdbe30eecbdf5469a1fa7e44bb9896ad14696fcd8955a54177d84183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038697, "uuid": "95b6f815-cdcc-420d-a33e-bd4261454b5c", "value": "T1F7A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038697, "uuid": "e472679c-24e5-4d2c-9e18-33304775d570", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038697, "uuid": "ee5a8cd4-5296-4f93-97ac-19fdddeed17f", "value": "49152:ABR3Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aJTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038697, "uuid": "9d982ccd-2839-48de-bc9d-2e3c92799a25", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038697, "uuid": "cc8abe1e-c51d-44e1-b85d-f2297b95bda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038697, "uuid": "ecd38dcb-6010-4960-920b-5b390741874b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a76fbc-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1773039551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039551, "uuid": "04058bd6-6bb6-433e-bd8a-1d376399b57d", "comment": "Malware payload (STRRAT)", "value": "74a407f89efe3e6df5dde4fa4742b97b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039551, "uuid": "cb9e236d-423d-4303-ae67-e440eeeacabb", "comment": "Malware payload (STRRAT)", "value": "1d0135c28d1040f113d86669d4fc7069a423fe4867f00637f62843d24399bd33", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039551, "uuid": "b3e6a842-24a4-4b50-8c43-4bc8b2bf3828", "comment": "Malware payload (STRRAT)", "value": "dbd56a7886138a6da09c8a3dd87ff8615c3b6f2c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039551, "uuid": "f3ce5526-f721-42aa-93fd-a77ad6f8166c", "comment": "Malware payload (STRRAT)", "value": "4afe51f74bf42edf61c0c427e76a6fc52c27bc645cf166d17efee92cde9bed738ab44b820c54857b495212345fcf05d6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039551, "uuid": "f8cb833d-d685-457c-b9c0-8fdb112e0f56", "value": "T1FDA32A42BB41D072DB63B173095C920AE970E5EF975471E72EF0AC9CDCAD8820FD6686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039551, "uuid": "33554301-34e0-4031-85e7-d7495b59ff63", "value": "1536:OB9y3GI8Q1zdj5FRGex7OZJJsKvGhGWXqOUoPndTk:ObDIfx1wW7uJkG2XvPndY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039551, "uuid": "b21d36da-365c-475e-ae20-816c38269baf", "value": 98442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039551, "uuid": "588a7c0f-ee9c-48d6-bd78-454345061311", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039551, "uuid": "88a0ad1b-e7b6-4e5d-ae9c-abd170e2d711", "value": "TEKLIF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a0aefb-1bbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064377, "uuid": "e85fe039-b5d6-4c2c-8718-b2ec425a68d0", "comment": "Malware payload", "value": "a909cf434df9fc8ae10e33903fc38e1c", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064377, "uuid": "033bca1e-d297-4e36-bf74-e4c8efe62226", "comment": "Malware payload", "value": "1e9c31ce0eba2100d416f5bc3b97dafe2da0d3d9aee96de59ec774365fe3fe89", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064377, "uuid": "dea3df64-8e29-4120-909c-cd8757f2c855", "comment": "Malware payload", "value": "937d407635df5b473ca642fb395f128e212cd6e3", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064377, "uuid": "d2e747b6-536f-4023-8040-8a39abdb1d6b", "comment": "Malware payload", "value": "3de53ebb1c4932733356b152549d064e591e73ba9844e0d854f08456f65b865b3d8dbb47cc59b8dd7fd1eb94dafc79f5", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064377, "uuid": "1e76ff1c-1320-4cc8-ad55-973ce1fa89af", "value": "T19E06332D7099A1059FA78B09A4CDAC71D4B72BB68E86317BDA912427047CD81F7FC72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064377, "uuid": "30a06cfb-83ef-4409-8441-957bf2dd0460", "value": "98304:pOZ3xwrApy2XTeOScCsHigLpm9/Hupeq2:q3xwiejjsJLU9ML2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064377, "uuid": "abcdd283-e03c-4afe-bbcf-e3402666f729", "value": 3876055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064377, "uuid": "6e68aa79-15a0-4187-9c9e-b63c2ca14376", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064377, "uuid": "4b49fcdb-38f7-4c06-9cc1-ad16c7e09a88", "value": "1e9c31ce0eba2100d416f5bc3b97dafe2da0d3d9aee96de59ec774365fe3fe89.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c945ee30-1b66-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773026370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026370, "uuid": "c1fc5698-506c-4b6b-a89a-55b4bf57bf56", "comment": "Malware payload (Mirai)", "value": "e9c4610c4b528eb506af2451c2615934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026370, "uuid": "4b2ab28d-e878-4a3c-9432-61acdbd1a271", "comment": "Malware payload (Mirai)", "value": "1eb2df103a6e10e67af4ba8245d03949bb9c27d4177b6c8c660b5c5c9ee4aecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026370, "uuid": "61a255b1-4fc3-4c84-8a49-f11030b34be9", "comment": "Malware payload (Mirai)", "value": "49c68e1453d986e45c163bf8b7b1980253d5e7b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026370, "uuid": "2fa21330-8b63-43fd-a62c-82f71d7a4779", "comment": "Malware payload (Mirai)", "value": "6a3cad886defabbea15d8741f3eeb48a4a4171a09386e8dceda26e8f44c52b95253f77ea763401151088110fdc220bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026370, "uuid": "378af9b3-a42c-4171-8923-d6b61fb74386", "value": "T1E2A32A91B8819613C9C556B7FB5E429937170368D3EB3203EE248F76378E89B0F7A845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026370, "uuid": "9c814847-2452-42ca-9e7e-aa7c5c188fc4", "value": "1536:iG8/i8J+Ycr5WbNb/BdgntX+IP5RqMnSeAvEWtJtwBj3XOuagWe71:cQXGNb/BdgntOIhRqXsD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773026370, "uuid": "cc05e7dd-e30f-45a8-8822-16e9b8c32ff2", "value": 99660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773026370, "uuid": "0eeada9e-8c55-4ae3-8336-79ad976ed5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026370, "uuid": "1b67fa53-2f20-47af-9fcd-3ceac8bc0664", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99691932-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054207, "uuid": "edeb4749-3b4a-45d4-9a3d-d6b5cbe32f4b", "comment": "Malware payload", "value": "75564ea21009fd8f49535c8d8488e0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054207, "uuid": "ded009c1-c302-4569-90c3-655d5be4782b", "comment": "Malware payload", "value": "2050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054207, "uuid": "cdccdcef-a799-4212-b438-3495e52ed1c5", "comment": "Malware payload", "value": "1a9cca241d6c0436edc9819931fb299cd8c77fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054207, "uuid": "5cf603a4-7b36-47f3-802a-9abd0e6f4e6f", "comment": "Malware payload", "value": "5d843750a219b782536b3e89b3d0b1ef72390e1e720a68bb113df0b88a5b2cbfd32155ac2f307aa49acb06ea7d1c1de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054207, "uuid": "d3fec197-97e2-47b9-b094-6b9ed743b739", "value": "T1E0C41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054207, "uuid": "4d327916-f647-44fa-805e-4d2761b8259f", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054207, "uuid": "a79f1474-f971-4e9d-b0ac-c81958b2dd9b", "value": "12288:ycVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:ycVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054207, "uuid": "b3d747e8-8604-4f11-857c-87986a664726", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054207, "uuid": "d8e2cfb5-fb06-4e2c-801a-affc1164ff98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054207, "uuid": "0a7800fd-29ca-42b6-bead-0057f7d37fb3", "value": "2050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283f08f4-1bbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063466, "uuid": "01e0ea4e-0a13-48cf-b07b-32f8695602de", "comment": "Malware payload", "value": "1a739c949b988348bea318026c380ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063466, "uuid": "a59b21a5-41f7-47c6-90fd-e4803d4f1c5d", "comment": "Malware payload", "value": "213a169d7fabf53f580c8f675ef3793f43f9a71508cf9ed2d96445e3b3eb6e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063466, "uuid": "bc693183-7db4-453c-bcba-09b5d8973418", "comment": "Malware payload", "value": "bb94eb2ab5c860bf15a7957d6d9d14f0bc734fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063466, "uuid": "752e864e-b930-4d0c-bae3-bd4d7d3b862c", "comment": "Malware payload", "value": "7ce08c7b02e9d6be887696df9771d2d6181b2523072c884965d4aa2fc63f3fc3f15c4c4dd035b3f31f6fe96294a19d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063466, "uuid": "29d3fb06-44b1-4652-8594-e4e1fd7a3ff0", "value": "T11A876A0593A41471D017C6388E158233CA79F8BF8665C40E359CE7CE2F7BD526FABA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063466, "uuid": "c65faa2e-3629-49e6-98a6-95e189473ca8", "value": "737ee8e88d13e54a63ab2f692249f554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063466, "uuid": "7ed52be1-d62b-48d9-aefd-80abc4bb324d", "value": "393216:gFjBH9b6fCip68tvrDQP/C4Ew4uZlUA2GNaxq:Ia6CA2GAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063466, "uuid": "41157531-5db7-4c90-8524-a21bfd64a183", "value": 38304768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063466, "uuid": "8a8fbf35-e233-44f1-976b-b3e697a9f432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063466, "uuid": "3d9e6d7e-12be-4616-8265-71509122ce2e", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d09ea2-1b97-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773047242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047242, "uuid": "a8013d9a-1680-4fa6-8736-af1728e17346", "comment": "Malware payload (ValleyRAT)", "value": "70def424d4ebde2c862e3dd752598fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047242, "uuid": "8fad5dd7-c5e7-4775-8200-691457a91d5c", "comment": "Malware payload (ValleyRAT)", "value": "22f2f123c1c7835cacb6c96ab6da67c06631a9520dc81b24a9a528746b083888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047242, "uuid": "1cc4814d-02f4-42b8-8cd5-e75d7902c654", "comment": "Malware payload (ValleyRAT)", "value": "f1cbc4e929bf1891d6b2fe04f744180fde325381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047242, "uuid": "4e1c5b5f-3cae-48fc-87f7-31646ec3a284", "comment": "Malware payload (ValleyRAT)", "value": "23d6fdd077435b686c40f977699332b0dd142c853f7bccde5ffced98edb6025d47382dc97fa96cabfa28ecf5a03d19d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047242, "uuid": "3bdafa78-401f-4d93-8849-de8592c69f63", "value": "T1F0C53354997F6D3DC394053D50EF5E3E68B02DB0C429F2A7036666F37A5EA410A0F92E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047242, "uuid": "3be7c221-d8f3-4d68-ba8d-3a90b7d9763d", "value": "c2b2f2613938ba9838c78cd62e4e8ed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047242, "uuid": "df340354-4bd8-4060-a859-ac3ca7bb3d52", "value": "24576:QwKd+6lUEdoPYZFdK0TRfBrMWAxk9MBBvbnpzb7dwoHceOpPGRrXSOL4XIYMBMfO:Z5EW0TrUcIzFZEeRpCJAgse5vIMOP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773047242, "uuid": "9e27d18a-ef8b-47da-9fdc-001dbfb442ae", "value": 2627584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773047242, "uuid": "44e8a87c-246b-4726-912f-cabf13b154b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047242, "uuid": "1ff4f890-d0df-4336-a2ab-39b2fcd51323", "value": "22f2f123c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ad3018-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046662, "uuid": "289f6df1-993e-4146-9c9e-078119933d34", "comment": "Malware payload", "value": "07f1fc96fcb02d7887445477b690d797", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046662, "uuid": "9ead81e4-c3b1-4f6c-a0ae-ebc273f587f7", "comment": "Malware payload", "value": "234f48a667d94ab06a447c1826bad6ad64c618d9f482b85f380b55deae49b1fa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046662, "uuid": "05673a81-9982-494e-862f-2dc3e1636826", "comment": "Malware payload", "value": "8c5328c6cbd53129a7e8cfbb9079f702ccb332df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046662, "uuid": "f34e7f84-8fe7-43c8-8597-9658de95fd46", "comment": "Malware payload", "value": "16f5d91209a876f733a79c8c05733445bdd057606794ddb3a0072516c6699b8cb8bdf7a0970c263fd61f454cfbedca95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046662, "uuid": "4d884083-2cd5-446f-8a54-ed3262121669", "value": "T1C6925BA912496C79BBC0DE7D9F3C7F0CADE881C02119A3ACBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046662, "uuid": "308da276-b6f1-474d-b1b5-9c0ca9779f8c", "value": "384:B/0M3vgRjGlsaq7szsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:BrmjfQzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046662, "uuid": "daccb81f-dfaf-4618-ac3e-a413afd64887", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046662, "uuid": "2080e239-5419-4aa8-ac57-5e207bdb6521", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046662, "uuid": "58353e5a-ad94-4fd1-bdd3-e974bf1e3364", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2d95e6-1bbd-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1773063503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063503, "uuid": "fc4cf353-1d1d-44a3-ae3b-4e396c250381", "comment": "Malware payload (SantaStealer)", "value": "8e5f46835fa51862a19b18defe504e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063503, "uuid": "69c48b80-9aae-4109-b62c-1ec46ff57502", "comment": "Malware payload (SantaStealer)", "value": "23b50ccbd06a8ae450539f780cb09c81cf80bc7fc3720cbfa65ca242c4506008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063503, "uuid": "5e4929d2-62a1-45dc-8f5e-f28956b287d0", "comment": "Malware payload (SantaStealer)", "value": "e8fc13dd9023be377655e96d7e607fa3d85a1fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063503, "uuid": "ea94c611-9efa-44fc-a064-dba3222d81ac", "comment": "Malware payload (SantaStealer)", "value": "550cf9cda82f880b67406b3e45d4f1ad2d010d6d41b454084de47f61bc7404e95711134b8c6f05ab514b62a5076b8b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063503, "uuid": "1ae320f9-29c8-4ada-9b0c-fb69e2b6c849", "value": "T1ABF6171014D96607FC7EEFBD85DCB6444F7AB2953723FA389B5109EA0BD1B08C8429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063503, "uuid": "8a4c4e16-28ef-47c3-8db7-690a3bd32831", "value": "196608:D0c1TElYn9G2q6fR93u4hwjPhQKbwLXJuPsCNwfjFhLaACES:DxEiY2qaRbAPhQKbwLXJGsljFhaACE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063503, "uuid": "43c5670f-5c40-45bf-aff0-e1b5bbf8f58e", "value": 15328768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063503, "uuid": "9eccb4f2-bd23-4889-82b9-79d45aa4b572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063503, "uuid": "90ed05a5-0e6e-474d-9619-cd25d49c041d", "value": "KIDDIONS MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dccee5-1b60-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773023837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023837, "uuid": "671ef78b-62cd-4918-84bc-6d521572ffff", "comment": "Malware payload (Mirai)", "value": "ba89899ca32e1fdd52722aa48ad19829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023837, "uuid": "e0639f81-78b6-4425-b834-ef267db5ebb2", "comment": "Malware payload (Mirai)", "value": "23b61b7224532d7695a04057f8725e4b7758053d2057eec1a918a7d57080bf98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023837, "uuid": "571192f8-fe15-433c-b9e7-f71683f189b5", "comment": "Malware payload (Mirai)", "value": "6c76c8eddd6403f41739b32c5ff9d9de686eb0d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023837, "uuid": "e07957ff-0462-403e-82c9-411425d3c6aa", "comment": "Malware payload (Mirai)", "value": "dea4b209bb74da9cbbb0ebe45f953e88db8322c8ab5c2e40d7416226003c737b678bdb2b1afd607046858c481f552d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023837, "uuid": "be09e67b-8ba7-48b3-b571-7abd3c1ef8c4", "value": "T11B240A85EA417F63C0C36BB5F6DBC20133B39B54E7A72305A528ABB43F8679D4E12506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023837, "uuid": "05e0bc2f-7d59-49b7-bd65-679a9944aa84", "value": "6144:BpOt0cw+hah8E816lCvfK6THjicM/RO1mC2ZwPLEl:Bpq0cw+ha6E81QSffXix/c1mCCwPLEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023837, "uuid": "ee5305f6-0569-4d84-bcc2-b3e2ade55786", "value": 217487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023837, "uuid": "d4c1f03a-2dd3-4ea4-a10f-2e3ba9652afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023837, "uuid": "cec928ca-9ff3-431f-b597-73a466413c9e", "value": "m-6.8-k.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded21053-1b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773049169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049169, "uuid": "7ed2472a-62fc-4b69-9c63-bf61163e5aed", "comment": "Malware payload (Phorpiex)", "value": "4e8b770def5fa68ac9fdad816a5b50fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049169, "uuid": "fa55c349-9fe9-4028-a24f-5cfb78e271cf", "comment": "Malware payload (Phorpiex)", "value": "24c134595a2e38206674b3e4be0f57e00a29477c51103785dc18e937eebb6e57", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049169, "uuid": "8a593157-f2e9-4255-98d5-d4ad25bd5123", "comment": "Malware payload (Phorpiex)", "value": "3a5e4683d6ba64238b0ea14d1062e3ab4e18cf07", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049169, "uuid": "b42294c1-3561-41d2-9817-a97eff74c248", "comment": "Malware payload (Phorpiex)", "value": "303482534eead0efeafaba905edc14d0fa7e61ef9f27e5c293c8bdfd3f5726246746a7845396104b537b54d61e67c96d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049169, "uuid": "c2cab862-2668-425c-8d43-46a463becc5b", "value": "T14B32190A684A5831F3E204B2277F829786BD1AA337D5B9DBF380764D0E753D1C17866E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049169, "uuid": "82996cbf-3a22-45b0-a38b-2fa306b35077", "value": "27080eab3ded4a4cce0697f22f2df921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049169, "uuid": "422db8e3-f461-4e10-aaaf-e40c65d7b2be", "value": "192:yBdeU99M0CnUrfR6fBee2Hz3bJxTNerBthIjOu:UdT9MqR6fArzrBerBsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049169, "uuid": "44836b3d-0ba5-4cb6-bd01-6679ca7c90b7", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049169, "uuid": "0e5e5af4-0e42-4450-b740-fe666557b677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049169, "uuid": "0903bc59-f9d9-4470-a472-566c950cfbb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e691c4b-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773060577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060577, "uuid": "9ff49ae6-b99e-4b29-ac96-f50834c9ace9", "comment": "Malware payload (GuLoader)", "value": "48e2ceba623541351a4e3dcd3ae5197a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060577, "uuid": "2cfd77c7-7774-419b-b80b-e49841a44a0f", "comment": "Malware payload (GuLoader)", "value": "258c637a49e90a8ed3ebb9b9bbb4b0edd1f6d884d8cab83de7907a67d7ec3e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060577, "uuid": "fcd31694-e628-47f5-ac86-c08d382bb854", "comment": "Malware payload (GuLoader)", "value": "25db542e7c2647a82f25f8ed566a05c0674f7ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060577, "uuid": "4b745430-73c3-4d88-be21-08e4c170ccc2", "comment": "Malware payload (GuLoader)", "value": "27723784431afc8b335219082e34ca11e1ff5b6d240426a543f6e98ef22b742dd1bcb232cacddf29b0b1402f539ba39f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060577, "uuid": "41103800-921a-4ebb-90eb-224c7ff9f800", "value": "T1C105AE1FD72089D6D51D8DB4C9BBD3F171B02EE980FACB4ABD5DAA59843078A323D604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060577, "uuid": "5db87e33-4b26-4d91-a3e5-fc9c346467be", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060577, "uuid": "3b27a0e0-c7fa-49ed-a5de-bed7aed61a98", "value": "12288:pkIeE7wnQ7vovjN+dDdABfY9X7YAcQixBSeNUea:1eE7wnnQX7YnxB6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060577, "uuid": "dc935a66-efbc-4a88-ab1e-2d67c7eb54a6", "value": 835328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060577, "uuid": "c9fa966b-b39b-486d-9fad-59d027cc06de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060577, "uuid": "7cfca71d-dd50-4468-9c80-f27bd155d0d6", "value": "Betoners.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558a21fc-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773046362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046362, "uuid": "564e25fc-5126-4361-9a61-c1836ef8613c", "comment": "Malware payload (AsyncRAT)", "value": "1a83ebb66ca48cacae738887e9bde37c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046362, "uuid": "bef19ab1-b046-4d56-a7da-2d2f26340345", "comment": "Malware payload (AsyncRAT)", "value": "261ca704d693db3a77d4b69c1d28e338092c9cedc42b2f794d0508e4515a79b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046362, "uuid": "95262f2e-6c2d-4b15-9a69-f3c5e52cddfc", "comment": "Malware payload (AsyncRAT)", "value": "9f56efb56633dd2caf2941fa23785b86d9f7fa91", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046362, "uuid": "e5ea51bf-bd8b-4911-ab98-b7c72c564511", "comment": "Malware payload (AsyncRAT)", "value": "b769195870cd4ca4a14ab16b6b7ff8b212a1b86ec9af6f129783afbadaa2f42ca453f0af607d03586229bff7a31dc5ca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046362, "uuid": "505edda3-1811-47d2-9d10-68f34a9899ad", "value": "T166032908B7F84965F2FE5B7D8DB182004735FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046362, "uuid": "5d88c106-bea9-468c-ab95-e8a640078537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046362, "uuid": "8486c669-e901-4849-90a6-92fee0a67d27", "value": "768:knCIcEZ7k1Y/bTpwVRbJpB+WWP7L91lj+:kCl+7OY/b9wVRbR+dDlj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046362, "uuid": "0c96a60d-beaa-4c3d-8a2a-019b33b05910", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046362, "uuid": "793a9f39-87a2-4006-9b30-40aa0626ac17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046362, "uuid": "000a1370-571d-4b2b-8853-a1d56d6b2f79", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d381fc-1b5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773021423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021423, "uuid": "a7a5ab8a-0e25-465f-aa32-afbc53c2502f", "comment": "Malware payload (Mirai)", "value": "6ff6bd679ef157106b7250b393e837e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021423, "uuid": "f8ea1438-2319-4264-839c-87e6f4bcafae", "comment": "Malware payload (Mirai)", "value": "271c4e74701bceebf3afdadf3a9564d29debdc568b3696386637a6c3b1d8b405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021423, "uuid": "7d38b0ea-c8ed-4700-96d0-636a59f2b217", "comment": "Malware payload (Mirai)", "value": "f881b647e75029390767d9cd959083b46b31efed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021423, "uuid": "a52b9b81-a7e7-427b-8a81-7cd8e7a82b94", "comment": "Malware payload (Mirai)", "value": "a8f051c71749f2e768f4cfe1f6427a2eeb19e8007074ab8b42327b1940a6efe1fbaf40b4bedee9e6b4e548245fd55fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021423, "uuid": "d46a4466-6ee1-4218-bd5b-8e689fd9096e", "value": "T192141743B9917DFBC4C2DFB557DBE51148A3F8391B63220673E8ADE51A0DED86E08608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021423, "uuid": "40faca8e-28de-409a-bb60-6091948b4b29", "value": "6144:5b0TYUAtkfMR7Dv8KNCYTl7ZLLHtJ3Itt:5b0TYqkDv8KNC4l7ZLLHtJ3Itt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021423, "uuid": "ff25ac03-2cf3-4a42-8bdd-5ae2f030694b", "value": 206442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021423, "uuid": "0e12b48a-4ff3-4f76-9446-330f3c2a7a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021423, "uuid": "0b282fcb-37d3-4756-81bd-9830cf64bac5", "value": "x-8.6-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa4e3ab-1b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773050773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050773, "uuid": "8046f492-c149-48f0-b2e2-1dbc1ea8d0d9", "comment": "Malware payload (ValleyRAT)", "value": "3f0e4b818411951209d94c1f05fe6ad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050773, "uuid": "68d9d389-103f-4a71-a778-2694b56f8368", "comment": "Malware payload (ValleyRAT)", "value": "28b7d235e3df5e51d552ef035fe783b93dcb229dc58b31c71c0498cdf840e967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050773, "uuid": "95c3a50f-4a82-41e9-b2c1-2a0d3924cc6a", "comment": "Malware payload (ValleyRAT)", "value": "bf0039aaf61ecb0f33a5bfa2285eeb7b5088e3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050773, "uuid": "4d73e555-b587-4f3c-a789-744cfaacbea1", "comment": "Malware payload (ValleyRAT)", "value": "daa16d1a52efd73bd54007c2d99664b83a65bb75dc8aa6f4afb6dbf932433a00806c285c0f5cc27a82f48f070262b684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050773, "uuid": "349da418-50c7-4303-b2cd-042ad17e7279", "value": "T14A950993FACB5CEACAC657B896C743312338FD1687166F2B6604C7316D436C5AE4AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050773, "uuid": "4281eb5f-3e99-4236-9f08-3acd81ef7ae7", "value": "6c2a7141b4d387d6711c3b0da33d58c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050773, "uuid": "21526132-601b-434d-aea0-180f2cd90565", "value": "24576:4tko+GNCEl2jxEnlgBlRwEF6qgNeW8JsU3Aot+Ec0xMkxd0MD79bvq:4tkyNCEl2qnlgBlRwLNod0MD79bvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773050773, "uuid": "073d9ab4-a1a5-4e5f-a0fc-c85998afb38c", "value": 1890685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773050773, "uuid": "7b2b23f9-d469-4b91-9b99-269a6fb01907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050773, "uuid": "4b012797-5c69-40a1-b670-31ba615a88fb", "value": "2026-03-093f0e4b818411951209d94c1f05fe6ad6.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a021c6cf-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054218, "uuid": "5c623830-9142-481d-b6f7-0f15d476003b", "comment": "Malware payload", "value": "37e63c37d951649c131922e48ab52055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054218, "uuid": "4845da62-7be3-4829-a96b-d4d4e9c4e8bf", "comment": "Malware payload", "value": "2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f955518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054218, "uuid": "29345ae2-6153-46fe-ae18-4aa82da65c01", "comment": "Malware payload", "value": "05b683e36a7ed1ee766b135323d92eb6c8772a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054218, "uuid": "09ddf7fe-1f43-40e2-82a6-9608f8d5c697", "comment": "Malware payload", "value": "1324d35336d859d5497bfa01b66aae3f66f44fa566d70b1a91fe40ef07e85d0861409fba8f7011dc2141844dee66b976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054218, "uuid": "b1ab8bab-bc7a-4e93-b8f8-f5f732fcfc9e", "value": "T15E666B47ECA145E9C0A9A2318A679353BB717C885F3523D32B90F7282F76BD0AE75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054218, "uuid": "7167e15e-9565-4245-9827-a870e85e752d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054218, "uuid": "ca97eeda-309c-4b74-92fc-3aad4655a2b3", "value": "49152:dT/7GrftNAKuBDMGHdgIRAz00vR14ht70UdIuCFC3oAjJNOsE6aSVazktz9QlfKt:dLBHCIhqUdPWU5jh082dNzE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054218, "uuid": "c73268de-e799-46ec-9072-c7b7281936f9", "value": 6635520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054218, "uuid": "3c04abb1-152a-4c07-906b-171fac32f541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054218, "uuid": "15e00195-3e3f-4fd2-86cf-bd5d0ac872dd", "value": "2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f955518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa5c364-1b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042084, "uuid": "bb49d111-7fe8-415a-95ff-635a157d411f", "comment": "Malware payload", "value": "49022c30cdbd0f01011d2bc4d1ee01d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042084, "uuid": "69e323e3-1591-4b23-8a1b-88e2d683d2b9", "comment": "Malware payload", "value": "2b68378a18e2161faf3f76a61bf033271275537aaf903307387d4886e56dfffc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042084, "uuid": "a6ac77a3-eaac-4bf3-9079-eb8966488f15", "comment": "Malware payload", "value": "5f2d9ea0a8f29c257479acb01e0d8f975d2a1b93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042084, "uuid": "d5727502-5a91-4751-bae8-dea78619f1f4", "comment": "Malware payload", "value": "4ae6873063062d84bc41e2ea13c564ec702976f44035f21a7c2dfef527164520557e590de6ff9b27330e39196bd35028", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042084, "uuid": "ec9ff208-8c7a-4715-bcc7-7326a37ed87b", "value": "T1C4C4FDDE2EC2F29D0F42A923F61AF06DF4F498F0535A5C68A0CC2C48F8956D5BD19639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042084, "uuid": "d9c0131a-430a-4b1b-9fa6-b93449840b69", "value": "6144:/CWfU/JubPUzCjSJ/5HX7/qayUnnLCiYVZg3W:/CUUuPUGGJBL1nLCiYVam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042084, "uuid": "a8bdec92-e897-43e5-b9f3-a9996b4efa0c", "value": 557522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042084, "uuid": "cfe23490-6cb2-4205-aefe-ab166d1277a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042084, "uuid": "20d85b03-1842-4801-88ef-23dcbbc0c6d4", "value": "256_SAINEST_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4613b1c7-1bfa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773089715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089715, "uuid": "854450f5-2bf2-4ae6-83a0-9a6eca935466", "comment": "Malware payload (RemcosRAT)", "value": "074455d041a0b350fc447dd2317cd2d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089715, "uuid": "3feedebd-1b85-4362-b134-23666dfcbd33", "comment": "Malware payload (RemcosRAT)", "value": "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089715, "uuid": "813ead4f-ca1e-417f-b58d-28a2a452bc9d", "comment": "Malware payload (RemcosRAT)", "value": "082b4ed87ed4e67982a9fc44c8a93985e8bf4385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089715, "uuid": "2c626a37-f5c7-4bbc-9bc5-cf80b278dcc1", "comment": "Malware payload (RemcosRAT)", "value": "7754d8ec88b402bf35c9e6c0c2e2322086cf9cd14ed9108fd687863033631a9a92c77a2aaad4689467e68ce21716bf44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089715, "uuid": "5804ce24-1253-4e51-af0e-32a479a74832", "value": "T1D0B4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089715, "uuid": "6e460ece-e350-44d1-a469-60e22e3e344c", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089715, "uuid": "643cd377-dd11-4551-acd7-7a5bc01fd193", "value": "6144:EXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcei:mENlHV9FGeDWv3jADnyYiCNrsPZlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773089715, "uuid": "67144b05-c708-427f-9a71-76549708d1b8", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773089715, "uuid": "f0a99df7-fad9-4521-92e5-ca9fdd5905bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089715, "uuid": "250c780a-f2d6-4c52-988d-421772b0662c", "value": "074455d041a0b350fc447dd2317cd2d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0a143c-1b9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773049592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049592, "uuid": "f52fa5d5-a641-4c9f-989e-a8f48aa99040", "comment": "Malware payload", "value": "648ed31c1891325ff0be0d9b06403c03", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049592, "uuid": "9e7678cf-02d6-4593-a72d-b5f239385433", "comment": "Malware payload", "value": "2ccbcf84f35dfdd608eb77d78bae3dfe4f6059c5c1b8aa0708c1d4d315b38534", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049592, "uuid": "018537b5-3c79-4180-a93f-d7620b8988f0", "comment": "Malware payload", "value": "2d969c0a1e6b67f7067d617045ba554fc5fee8a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049592, "uuid": "f872c34b-2156-465c-8cdc-6480ff19f24d", "comment": "Malware payload", "value": "50062d2c220ece79a08886c070850484ffc207b3ceb550d69c7711c23bbe4ecc252f8ea9c2be49d7bbcdf8cee7526b9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049592, "uuid": "f32dc48d-a21e-4499-b297-5e91a2fbcc55", "value": "T1BA925CB512896C79FBD0CE399F3C7F4DADE882C42124A3ACBA0F39215A1166DC60535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049592, "uuid": "b7339b2c-7277-42f4-88cd-18c85bc46ef6", "value": "384:GFcuQpWx+BL0SWL0gkzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:GF8i+BL0SI07zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049592, "uuid": "1343c768-d9b3-4ade-8859-6a8b1a1877f3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049592, "uuid": "9393a9db-2586-4fa9-88a6-222bde1ab339", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049592, "uuid": "0b838cd8-db5b-4c94-afad-8292fa899943", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54e0a30-1c05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773094680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773094680, "uuid": "3fbf7d7c-6957-4f40-8e9f-45eac0a6bdbd", "comment": "Malware payload", "value": "0295c79b3557ac53303c923fec8a06e2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773094680, "uuid": "b90e5465-917d-4ed9-9d10-3479e4036eee", "comment": "Malware payload", "value": "2dafdce13e5820f7e4b12c93d81fcb35351eb82bdbb820473a08ab2004470619", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773094680, "uuid": "169292a8-12c9-46be-8568-09007db53ec9", "comment": "Malware payload", "value": "55470d74063f05be689e64a1635c13339ee95970", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773094680, "uuid": "7bf5c44c-e68a-4c54-94d5-0557d5632da8", "comment": "Malware payload", "value": "cd968e68652e4ecba9e9bc326d1646fb927b6fec9c3cc156d08cb7e3e18badbe22d64b953021c613694cdb431dc4ee31", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773094680, "uuid": "9b75f0e1-5986-4574-aa1b-58c11a87ba1f", "value": "T143634BDE27CFD211E194201FFEA33786775218B99AE19AE73821925C8521CC352DBD8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773094680, "uuid": "06abe8cb-0280-4995-8366-6b080d6e2512", "value": "1536:suBcHzTt5WTLuPGoPE7e/324oLGbUVTiOP4VwvdsaQgH8vbsgJDkO+:suBI0TLuOl7g8GrOP199Asgd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773094680, "uuid": "b1c4242e-1ed8-48d7-85aa-afdd4ee2e547", "value": 72064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773094680, "uuid": "9f97c0e3-3997-4218-badf-06fabd54e007", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773094680, "uuid": "c358b210-5499-4a1e-a21c-ed4df0e50d39", "value": "kryo_crypted_nmbm1i3k.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6766df2d-1b62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773024488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024488, "uuid": "4ee2b442-c6f8-463c-a59d-f8b3a4314c08", "comment": "Malware payload", "value": "3dac13d33f7e513fa19bf87f29e36a6e", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024488, "uuid": "465b5319-75b2-4ae9-9825-e8296b447bd9", "comment": "Malware payload", "value": "2e5007afdbb0041c9d95325acbb2fb06cd7622b66575523e3f842461aa3f3e43", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024488, "uuid": "c12dfb33-160d-4b6a-97ee-82eac9af1239", "comment": "Malware payload", "value": "50128ba1840d13b9b3bb93ddf9308fc78bbf93e5", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024488, "uuid": "76a83864-7c69-4238-a7e0-697aef80b4e6", "comment": "Malware payload", "value": "51da27a404a5b8346945cb1a3373a14e49575fdefb50463fa0f996601e53a1b7df49814069a46ebc8a5e6d1f3f7a281c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024488, "uuid": "c9fea835-11f0-4804-838d-63988c3d6306", "value": "T14A772213E70C5A1BDCF2F079DA682263B55EAE143542979B4D04E25C7BF3AC48E2A7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024488, "uuid": "8b00bca7-e72a-4916-a527-7526d7b5a486", "value": "786432:tFh7w7H4JkYyxQNuiRpVrIUrqn4BVDwJo:HhM7YJBbD5Zen4B2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773024488, "uuid": "3e1c4170-4e31-4181-949b-f641e1361726", "value": 34577538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773024488, "uuid": "61183b9f-3059-4674-8cbc-76e08649e921", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024488, "uuid": "be856a6c-defe-4f4c-a890-609dd2eadb5a", "value": "com.maxmainten.filesclean.strike_2.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edf1bab-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773046807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046807, "uuid": "1ebd121b-6a73-43b0-84b6-a7f8a9e1e8f9", "comment": "Malware payload (GuLoader)", "value": "2b1ba232fca3b270082c4e89a04e26df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046807, "uuid": "4ca62851-7093-48e4-b651-14991d3a4837", "comment": "Malware payload (GuLoader)", "value": "2e7af1f215337777ae33c29d8c5c3f9a04eb8e33427e8370d69b75efb54b1eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046807, "uuid": "0b56ea66-c328-434c-bbc4-9389c493077d", "comment": "Malware payload (GuLoader)", "value": "fcb62f0ac9cc60124189e8c257c8bddcf18a1696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046807, "uuid": "55f9bfce-7a2c-4e0d-805f-1cfd900da7dc", "comment": "Malware payload (GuLoader)", "value": "63c88556facc221d7371379d616adcdbfcab6f8d94e1290d6e955f7d70e1ba6955e1c576bb1b9f0a4185b2d15167ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046807, "uuid": "337a1568-139b-401d-9c1d-ee396ae2bc72", "value": "T1363533B68B99C59FD9017A38073FEF4E7AE7C6B01309324723D0A9A77836245C14D2AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046807, "uuid": "8334937c-8ead-47ef-8a3f-0a8fbbab8ed9", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046807, "uuid": "232effd4-b8b4-49d5-941d-915fb296c161", "value": "24576:KLrZnY8zTHVOu5SR2K1KuN5UE8w4a7ey57F7b:K1Y8zCF1bkXwBX57Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046807, "uuid": "1b98d5cf-2c5d-4b14-87e2-b87eb4f50dee", "value": 1075176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046807, "uuid": "f07a73c0-c8a3-4728-93c0-89998a6a44d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046807, "uuid": "93acbef3-2b67-41e0-9aec-4947bb0c950f", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b7e40e-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773040881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040881, "uuid": "bc5732e5-635f-4a8f-b070-dec253e9290d", "comment": "Malware payload (SmartLoader)", "value": "5a9e0479cb40f385e8aa0236a59d0830", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040881, "uuid": "4c3b8f52-69b4-4972-bbeb-eae53c3d2e36", "comment": "Malware payload (SmartLoader)", "value": "2f8c00c2b5c47fc6a3e535839fc387e4257b1f43d965140f230d5ac56df2737a", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040881, "uuid": "7b66dc1f-5168-40dd-9f87-152ce11acb9e", "comment": "Malware payload (SmartLoader)", "value": "6c57cd6d9cdb5993f6f02432d7163a67645122b2", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040881, "uuid": "51fdd903-b0e8-4e27-b591-d39f21df7268", "comment": "Malware payload (SmartLoader)", "value": "508ad0178324ac3d82464f0adf5b0e7536d9d474372185b96b8aad494720ad710229ef9fe9182ef3662974c70e10923f", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040881, "uuid": "dc79cd08-8a2b-4920-9493-476cff94c12b", "value": "T17CA42397E39997EC88C47ABA8B2C0D08B27CE7745CCF06A8537E5335D1688A39E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040881, "uuid": "f76a77e4-deba-48fe-849e-57b43245eec9", "value": "12288:msS5lyFd6N+6sVXkvgSe5yHqr++rVOje+yH5a:msgx06sSvPKy+6eTH5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040881, "uuid": "8701be40-94b0-4dd4-9f3a-9ba0558ef7ae", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040881, "uuid": "14cd2119-f8f7-4922-a212-6972ae61e9e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040881, "uuid": "910e787d-4bab-48ed-8d26-4544535bbecb", "value": "mcp-accessibility-bridge-v3.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c60dcf9-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773040790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040790, "uuid": "93a70b59-2800-44f8-85a8-bc350ea28a26", "comment": "Malware payload", "value": "15dd8f81b050863ed46ea42ea516e467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040790, "uuid": "d9af09a6-bd76-49a8-a051-f862814e19b6", "comment": "Malware payload", "value": "2fc62df4a95c49395bda1d10408c6ea97beacd19d8c82fd7339f00538cd3e1ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040790, "uuid": "95df8a32-b510-40ff-ac00-9e33cc10d578", "comment": "Malware payload", "value": "d1367a59702368947d0d884480127c52ce4ba363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040790, "uuid": "16659376-2042-4118-8e40-605610c82a01", "comment": "Malware payload", "value": "4262cb389df0d74f54f72dc20034c3c3bddbd81305ce89755a9c6614c37e34dde9962e2af9f44e2080d5c88b445dd393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040790, "uuid": "4c7c20c6-c8f1-4d9e-a455-3c0b8c443aa6", "value": "T17F83E07EDA64CCD0C79A1774A5F2EBD841BBCCE78D260E0A95593B0E2A307887F49714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040790, "uuid": "ade59560-1b21-4f63-bedf-edde6df25d48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040790, "uuid": "5f918525-0686-451d-a2f4-71e36fe1ddeb", "value": "1536:7jb1bNlU0Q1vbrc09BerseB+YzB1h91SjDviYIv0Qf266/qlj:XbRNqt59BeF+YzB1hXeiYY0I26QqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040790, "uuid": "0967f558-f8d0-497a-b3a7-2a11429cb9ce", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040790, "uuid": "5f612b3c-3504-4ecc-a73b-aac8eb7371cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040790, "uuid": "bdab3ccd-af46-46f1-82b7-175138387d47", "value": "unn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72155722-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773077763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077763, "uuid": "c6ec3263-5f7c-4b9e-a820-1ddbeeae0612", "comment": "Malware payload", "value": "556d0c63545bc292fafea3b32258a693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077763, "uuid": "e23b78e7-6730-442b-b23b-64c5b69c7f36", "comment": "Malware payload", "value": "300d4aedb43f3218268b206f9abe4dade042bda7b502cea12e716e6b85061cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077763, "uuid": "2459a139-9701-4768-af6e-cc435c3a840d", "comment": "Malware payload", "value": "d8926f5cc293d1cfbe0ef4e197f564a004f69200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077763, "uuid": "cad9a160-1231-4b6b-a641-2a968f7cc555", "comment": "Malware payload", "value": "445f8660089e190adc73ee03a8a2c9598f14104ded161b04fe4551a585e54dd45485863af15d04325f551487e40b409b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077763, "uuid": "48b91448-6ea3-4a48-9ca0-2d18418e6a8e", "value": "T17FB6F5BB62E48268C15EC13AF056BB04D8F370B4072786EF02ACDB789AF15D55D3A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077763, "uuid": "52e0dc0a-ffac-455b-9705-0fd005745594", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077763, "uuid": "91b75e3b-bcc2-4a81-80dd-6450c71cd158", "value": "49152:N1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpmfMdPHQptYHHsfNaRw4:N3L31Poeoi3paHHsfNaRwPj+YcHggV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077763, "uuid": "aad09672-1fd8-4644-8266-95af1ffa5fb7", "value": 10945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077763, "uuid": "7446bfa1-63aa-4181-a63b-16939bde7cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077763, "uuid": "516061db-f250-40aa-8005-79feb3f36b1a", "value": "SecuriteInfo.com.Variant.Cerbu.271832.31691.6746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062c2fe4-1bfd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773090896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773090896, "uuid": "480ee182-a598-415d-8de6-e0a65da8ab26", "comment": "Malware payload", "value": "bc191b8d6e8e809ddc10904232ddfe01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773090896, "uuid": "bc9d95b0-ff3b-41c2-bc2d-efc0e68de621", "comment": "Malware payload", "value": "31ee0d6b90096506ef3d336531903cdb8688a05086dd70b2c4e580b62181ddb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773090896, "uuid": "69e12fa0-61e7-41a6-a4ec-9a8a95b25574", "comment": "Malware payload", "value": "bf5e4b8c92c8a6c116bb18690c99e5a698bb4825", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773090896, "uuid": "60200aca-0b2e-4e60-8086-9f48df0578ed", "comment": "Malware payload", "value": "33c41f689e0e1e9d9a5bb08e56f3c090386ba9559f6371f27faed2bb07256780e6264c9e071fd1a3a07787a0b256ba8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773090896, "uuid": "532b136e-2f4c-4729-80f3-95aee7b4b229", "value": "T1EAC3DC75169FC0BAE102F458C59B0642EFE29813871CDAC4FFACFAF92F9592490F5894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773090896, "uuid": "a2935550-fc6e-4718-9d73-2ff5f432178b", "value": "1536:DpH/Cm9lfJWbFznV3sws9poaoKx+JmJ71:xcRJuoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773090896, "uuid": "f0e2759a-3474-405f-b9f2-d156d1191ce2", "value": 121363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773090896, "uuid": "13e40b06-c909-4c5f-9e98-3a8ab8981709", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773090896, "uuid": "c122b1d8-a55b-465f-a93d-08a4959a03b6", "value": "Sales_Core_Data_518.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7991e8-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039690, "uuid": "98c0db1b-5c0f-4753-a433-c4c51fa52fec", "comment": "Malware payload", "value": "61549251372131156ff75d40d4b02020", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039690, "uuid": "a0f66961-83e5-441f-bd49-5aa976b84121", "comment": "Malware payload", "value": "321a8b2a992d1d0dc5cfefb14b4b0e4ec75d73a3e0e4c21bce21b8a46d6f7401", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039690, "uuid": "336e3304-f281-44ab-9cea-dd5f4b6c4a92", "comment": "Malware payload", "value": "86cf701adf240df62715719548cee267eaaf1e23", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039690, "uuid": "06053ad4-662c-4c50-a284-fa6225fc1faa", "comment": "Malware payload", "value": "74689398e213e0ebcc4ebd3489a1eeeb7eca2d79ec11b6c7416b9bbc90fed83c4fd317a18eec6e05df73bfed0660ed50", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039690, "uuid": "e0a5ac1f-2d6d-4588-8f00-d4d8b76987e2", "value": "T1BD451213EA61BFFFD4065B36551B08925A399C13B21E631B0F86716160723F9F2AB1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039690, "uuid": "c1b66a7b-67ad-4364-ab97-c6e919558f20", "value": "24576:fX3u+GtYEJZC3lZF055wqOAgtHT5KEDNhd87MA:/HGtjbC3Z0fKA6zTX+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039690, "uuid": "d9ff88fd-9b22-4ff1-89ab-0b1f34f2587e", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039690, "uuid": "ecf5adee-7e46-4cac-9a3e-bb0fc901d1ed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039690, "uuid": "4e4819c3-8277-4a3a-9522-796c89a7fb88", "value": "006-230226 PACKING LIST.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b5a3a0-1bf4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773087332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087332, "uuid": "c4a3f7a4-801e-4f69-a2db-c2a357043c9e", "comment": "Malware payload", "value": "80a9f08e09b98f10b6bdef01d7460764", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087332, "uuid": "f87be006-58e4-4563-a117-37ce64702ad2", "comment": "Malware payload", "value": "3297233d82b04a04e11cc2fd8552d462438041d42fd8c74af242452b20866299", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087332, "uuid": "d09f2898-5c19-4039-9ec9-2e437a18c98a", "comment": "Malware payload", "value": "9ca950405db909fe09eef23fc312543dd6adf87a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087332, "uuid": "6bcc8e92-8d71-4495-86ec-158f06b749ef", "comment": "Malware payload", "value": "ecc9b8f57aa209d7d3dc64deb67de6853b39648ed0b29fadb00b0331fefbfe49582802c00ee8c614d4904542b5394faa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087332, "uuid": "87b0ba08-d187-4291-830d-4e92c878638f", "value": "T129C3AE0ADF9F81B963593C34864E0A03CFBEAB436559ECE0F67EDB510F8D41641E62A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087332, "uuid": "bcc9041c-91d7-4c0a-9cba-c2ba991a67d6", "value": "1536:4fGY+aHHnOPQYddEiakS+HUTap48QGlGrQmTOLSM1+gYVxXFM20s1Ya5m/W3YbvA:AHOAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087332, "uuid": "bbb56197-0f78-46ba-a298-ec2ddfd2a4c6", "value": 125018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087332, "uuid": "82ab86bc-c2d2-4ced-b12f-2215abeeba03", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087332, "uuid": "74f71569-36ac-49d4-8c6a-b7d848e9a413", "value": "User_Fusion_Images_997.cfg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1554c5ff-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773068588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068588, "uuid": "32596c50-ff30-46b1-bda5-5f081922498d", "comment": "Malware payload", "value": "d9d0ddf3b8e648031176c8ce05f4b47b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068588, "uuid": "273d0692-7d27-457f-9d69-af6a1dba801a", "comment": "Malware payload", "value": "32d47a196dedd39a947429019f4624c945df10bb21bdb21571dbed558f49b9d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068588, "uuid": "8010a376-7427-482e-8a90-4ce3cfbe7bbb", "comment": "Malware payload", "value": "6460075e40b0e1438219605e21ead01499eeb5ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068588, "uuid": "d70ba09c-7169-4b59-a2cc-6373ec0d40ad", "comment": "Malware payload", "value": "e42122d50ed5b24cdcd67a75f43d9fbf647eba9a835ea018e15bfd90d8ff83bd481144ea2ff75fb0ceff6af74498cfef", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068588, "uuid": "568445fe-1b11-4249-a2eb-7baa6f193684", "value": "T19E053C694F8AFD8926EFD1F067299CBE72DFB95176203C868D1A01D34779382142E327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068588, "uuid": "be69a5ad-641a-4e0e-935b-90ceef981b98", "value": "12288:qa3K3Ehpaf4gTJxEtSG4tCBZjv6af8K9Bsl3gOAbgyGi4p/1gAAn8:1hpaggvEkG4YBwaf8K9QAsDvpSAA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068588, "uuid": "2b7d96dd-f23d-4478-be86-fdb8c91ae3e8", "value": 826977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068588, "uuid": "517218a3-f4da-4ccc-9b32-223f7d574820", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068588, "uuid": "f34225cf-d099-4725-9ee5-0715573d7407", "value": "RFQ BS-00151.Bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0367da53-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046224, "uuid": "b77526d2-c0d5-4b14-9134-a0858c08b58d", "comment": "Malware payload", "value": "fb2d8361ecc0f68a91511a5f7413582d", "object_relation": "md5", "Tag": [ { "name": "Nextier_Equipment__Projects_Specs_5326.pdf.wsf", "colour": "#12C8E1", "exportable": true, "hide_tag": false }, { "name": "pwd-protected", "colour": "#DF37DD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046224, "uuid": "991de46c-9a38-4aa5-b59b-9fd104ff9ee1", "comment": "Malware payload", "value": "33a6d5ae170d5e297a88b9451f06741b11a6f3eb7fbd25f1e9ae6c66db22af51", "object_relation": "sha256", "Tag": [ { "name": "Nextier_Equipment__Projects_Specs_5326.pdf.wsf", "colour": "#12C8E1", "exportable": true, "hide_tag": false }, { "name": "pwd-protected", "colour": "#DF37DD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046224, "uuid": "08ed4d02-89c1-4df5-bbc0-f98dfc1ef13f", "comment": "Malware payload", "value": "c07d3ff9ab85620bd06aad45a6b0093956c4817a", "object_relation": "sha1", "Tag": [ { "name": "Nextier_Equipment__Projects_Specs_5326.pdf.wsf", "colour": "#12C8E1", "exportable": true, "hide_tag": false }, { "name": "pwd-protected", "colour": "#DF37DD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046224, "uuid": "7fe84ce3-abc1-4fe3-9ac9-041cbf3fcb77", "comment": "Malware payload", "value": "075e17ec9459338935f6ab61c902144623f0b145316424844c7c028316f454e524413052dfc00710b9339f1c85a06574", "object_relation": "sha3-384", "Tag": [ { "name": "Nextier_Equipment__Projects_Specs_5326.pdf.wsf", "colour": "#12C8E1", "exportable": true, "hide_tag": false }, { "name": "pwd-protected", "colour": "#DF37DD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046224, "uuid": "c5733e97-52e5-4eca-9ab5-329b369ae1ce", "value": "T19B34237D132E47F2B04A084334D33125F1E35CB28969A6B3793C7D9D1A4D4FA76EAA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046224, "uuid": "24fdcd2d-13cb-49bf-88c9-7ecd37473965", "value": "6144:W5qVZcyZAzcEjDMQLSjDX7RyKpzk/vsjpvOdbMQm3rRHy7fL:LVZ/67kbj1Bk/vuv6gQK47fL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046224, "uuid": "45320aa0-8baa-429d-90fc-23bb41f7931b", "value": 230618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046224, "uuid": "334d7a8c-5db4-42ee-a348-c3c2861d0640", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046224, "uuid": "d4e6ba59-3603-4514-ba07-8ad25fe12dcf", "value": "Nextier_Equipment_Project_Files_05032026.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40795ce7-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054058, "uuid": "86456fb2-c718-4149-9fd4-ecb6399036e7", "comment": "Malware payload", "value": "29c26a5734fbc0b73708b7f70842ee08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054058, "uuid": "12b15af8-78d4-42b4-80c7-7865284f8143", "comment": "Malware payload", "value": "3506677f2724b2e1e6b8398cb630db3d68cef6454edf970369bbea259ee47a6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054058, "uuid": "576ce218-7e57-4b08-a9aa-cb865cf76694", "comment": "Malware payload", "value": "33caeaf552b0a8c5c34bdbdbab3bb60268189e24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054058, "uuid": "98aa4917-02c0-4b47-97a0-0f0edd45d276", "comment": "Malware payload", "value": "70866eed56e5a12ac247eb7ce9f78cc75ea920c6c95a852f709b0054d3f323942eea2a237b2383964cb30483b20fe6b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054058, "uuid": "7f4ede0e-e2b0-4c0c-894d-e48aef0c2653", "value": "T10BE0ABEB7208839F2FE4F0DBE967088E8513410E0B4C43ACC8271CD840AC771E531082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054058, "uuid": "f4551645-8d32-466f-81ae-7dd160ee71b1", "value": "12:2QKDRAq7MeGbfqLTQJ33RcKkMUXmQmTVEsAmrgkV:2QKDRBBGbyLsBRjHUX3m65mrg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054058, "uuid": "45160ae5-b41f-49f0-bf67-4a0177b74dbe", "value": 424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054058, "uuid": "c9ab1a6c-b6c5-4603-ae78-e278dc85b327", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054058, "uuid": "d3d2fef8-c332-4e8c-9ad2-9ac62cfdce1f", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e8459c-1bcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773071376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071376, "uuid": "6387beae-577f-481a-9774-b86958d6a442", "comment": "Malware payload", "value": "67647dc2dd0f34709e092d5a91e7d33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071376, "uuid": "69b009ad-1725-4f3d-b236-bc34a2913ec9", "comment": "Malware payload", "value": "394f53fc1390fad914957b8db373f8a4dbd660e84986b113a3c735fdbaf9b1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071376, "uuid": "f626f98c-e6f8-4ed5-bc7c-1b1804781180", "comment": "Malware payload", "value": "9143e2264d2b9b4fa80d83f5b349af4fd3da005d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071376, "uuid": "3d3ebbda-a01f-4108-8414-2b5020025a0d", "comment": "Malware payload", "value": "28c9e90b5cbaf1fee5e65dd24e064849b9678f222abfee8947f0e4b4d90a818e19370d068d668391fc57e584fdd87c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071376, "uuid": "b822b9d9-2bde-4b22-8a8f-e42baba60dd8", "value": "T1A58533B39F6430C3D502C570A1D2662ADC76234F0D9C3582DA9D6C96F6A83917AFAF0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071376, "uuid": "4e682811-4757-4d6c-ba6e-adb868680246", "value": "e9b5ecb8da24181e5e37fe3ae102e954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071376, "uuid": "2ed66255-b87c-47fb-84c7-4449cf72c745", "value": "49152:32SR367a1qtagX9QpTXHmK14qniPkNLLqF/DhiRk0:3RwImKyqn/NLLqF/10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773071376, "uuid": "6744a210-2c27-4a1f-a168-557a0471fa13", "value": 1790101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773071376, "uuid": "abc12865-9075-446f-930a-018d61ac8458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071376, "uuid": "89ef8263-d12f-4f07-9310-e55b7078833d", "value": "\u5916\u6c47\u4ea4\u6613\u8ba1\u7b97\u65b9\u5f0f-.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1901876c-1bb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773058716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773058716, "uuid": "f7cecd42-9aeb-4ae2-b1a2-2a2e3635364d", "comment": "Malware payload", "value": "6d7b717577ff7db42806bd31ca270faf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773058716, "uuid": "8338c458-fb27-4fd4-b0c7-35ea5ee979e1", "comment": "Malware payload", "value": "3bb394d69af7787043724157b5d76b89fcb9154a77da8a613bf71d03d87a05fd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773058716, "uuid": "aa863dad-6ea1-4e9a-9ac5-dc410ab3914d", "comment": "Malware payload", "value": "788f20dbdfc4c8b48331bd508d09ebe1ec1819cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773058716, "uuid": "205c5f39-2695-48b4-b8c7-b3f567512a92", "comment": "Malware payload", "value": "cf1cce41c750ccc02bc71902accfc3f38d41108be5ad5a8106b55a23c38c5cf08cd59d27c10759291d4f01b7631c8e10", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773058716, "uuid": "96506439-e3ea-4ca7-94a1-20b3241920c2", "value": "T135363395379C4E33D06E8F3E88FD8866CB353009A228EB56284D66DD9F31B854C527B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773058716, "uuid": "12bb18ed-158c-4ada-bf27-866fb988e275", "value": "98304:k1x6FSXMQAHi6Y2rVHeUaNia7oqz87lKDtAjskOn6Q9TYr1QKksmrq:kZXzAHvY5RNiWzclKDEu6QNYZnsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773058716, "uuid": "b266924f-1bd1-4216-bf49-76c43627f40e", "value": 5126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773058716, "uuid": "488170d3-0dd0-415e-9edd-525c79e49761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773058716, "uuid": "ac5abac5-d15e-4da7-bf92-41d83220ea31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416fac00-1b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773048046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048046, "uuid": "5d906dbf-87c2-41ba-af93-fe6556a8a63f", "comment": "Malware payload", "value": "a7b7850401aa17728452fbbb43bc2f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048046, "uuid": "57306056-fd64-4e7d-965d-fe24e537acd7", "comment": "Malware payload", "value": "3cd3510884dc7191a40a8d271f2b5df747af307fec83f4d1b42140c767a0ef4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048046, "uuid": "8ceba752-37b7-4454-8b50-6678f9d208f3", "comment": "Malware payload", "value": "48f13c8f728a193866194227070349d1ebe7ec77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048046, "uuid": "7c7c14c7-682c-4f9d-8e32-c85151eca71f", "comment": "Malware payload", "value": "3535c4ebe23dfa0a4acfa0e99b069bc8896cf7d89447f9a258f63c839e706129cd75790b28e0a08f0dc437349f477feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048046, "uuid": "5e4611ae-94d6-49ca-ab07-64c6a94726bf", "value": "T1C1369D41F3A4CDA6D51ADA78CA1B9B32C271BF524631C14B25DAD71B1F33B824E3AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048046, "uuid": "87439e6b-2cb0-4b85-b77f-d0c97f244db9", "value": "828e8e1456fa9d03c01d5649a2a0e8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048046, "uuid": "a5b8ffe2-d6ce-49b6-8bd5-3ea01f424eb2", "value": "98304:V0nIWb2SLbbXpwT5aHfBgnxobGeW5VQl9cULIdYBSSOowuySGbm:V0nIWbRHpwN4Bgxoieiml9cULIdYESOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048046, "uuid": "d17f4350-69f1-4c86-8348-3fae6ea74f49", "value": 5035520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048046, "uuid": "b962c6a3-caa6-4514-97d3-02b40e5a6bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048046, "uuid": "1cfdefb8-9854-40a6-85a9-96fae6e14b97", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63c1939-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054255, "uuid": "f91b7bf5-79d3-48f1-8dd2-0bbd8f9b18d8", "comment": "Malware payload", "value": "d637b4fddbf92b4d2c95fc97e92f51ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054255, "uuid": "10b1a5d5-7497-4a54-acb0-b956701cc1a0", "comment": "Malware payload", "value": "3d8bf54564eb398cbfcf00ad747816d60594ab832ce42512ca1fcf00e7120d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054255, "uuid": "2a5cbf6a-8424-4aed-9606-569e19f4b9a7", "comment": "Malware payload", "value": "5869833f4a5f89ea1f051f1153eefe1b21815395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054255, "uuid": "b7274ee3-a688-4c1f-b38f-93f32226e33d", "comment": "Malware payload", "value": "a509b37b07b2e864248dfc4a10a77c0b0ee54dbb51377bb6c31fb027d275aef19c0ddb23e6e35f29f08659bed383117d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054255, "uuid": "4fff3397-458d-4d5b-b16e-00259c2e3cc4", "value": "T15594BF8A77E520F9E1B7863888634E45A772F8350B619BEF4360465E1F633D08D39F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054255, "uuid": "2f6a054b-d278-4497-a84e-c3547af58b70", "value": "64dc6c3fd31f17b87ea8c93504f6251e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054255, "uuid": "b1c9bd13-63a2-40a9-81a2-c675c633525d", "value": "6144:gwWLOsE++u5l4dq1cLl9u8ZtACGOb8TCa7m5RhYkvS878egT1:XWLOe+ufpcvtACGOb8Oa6Kkp78r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054255, "uuid": "d81065e4-7db6-4f25-abac-d0126c3123e6", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054255, "uuid": "b6b4791b-e6f2-4a4c-8777-844de07e3c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054255, "uuid": "645cc734-e930-4be6-9943-eaa625aac11f", "value": "libcurl (2).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070f13eb-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039358, "uuid": "9b4da76d-dc31-4960-a6ce-e32e9c77781a", "comment": "Malware payload", "value": "fd93407ca38eec0ee51c1ab667ba8481", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039358, "uuid": "7ff65900-a7e9-4f9f-9444-ceebad8ef0c7", "comment": "Malware payload", "value": "3e46f46197c692743cac78d7fd78184c558cf6574ce16360ead933ebcde8b303", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039358, "uuid": "1e5db760-cd49-4290-af7c-0b739e85044d", "comment": "Malware payload", "value": "14380ae9f5b9e1fa0cbb088e3469511ff5e8aaa6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039358, "uuid": "d013a3a5-677a-40f1-be1c-6d2cdb2e018f", "comment": "Malware payload", "value": "d9e42e8189b15c521c588d6ebe606686a616043b8237349747e92410f182150e3eea79a0ee5e1f284b2a0ad135553dd9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039358, "uuid": "2beab5b9-e05d-45e4-a93d-b572ca526e0b", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039358, "uuid": "43e37446-7933-4ac5-a803-00bf988c8be9", "value": "3:LjD0JgLMC:L0KLMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039358, "uuid": "c50deaa3-abd8-41cd-bf67-d06c355ed81f", "value": 28, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039358, "uuid": "4f8f0837-ebfc-4057-a93a-a2e602a88dbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039358, "uuid": "a6dd2fa0-4a1c-4c4b-a26d-b7262d999314", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba581d93-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773046531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046531, "uuid": "d43185d2-fa80-43a4-92f8-14244bfcb04f", "comment": "Malware payload (AgentTesla)", "value": "dd6204b1c169cbde6fd4f393885d9471", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046531, "uuid": "594f1f3d-54b5-4c71-9ef9-68957da34fc2", "comment": "Malware payload (AgentTesla)", "value": "3f6b1ee279af8d5b5f855d3868173829cff0afcb977c037829d3a079a6e66bbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046531, "uuid": "1e6e6648-91c6-4ffc-853e-e3f323e9385f", "comment": "Malware payload (AgentTesla)", "value": "a140c290a9da79c371f4aecfc8a6fb0e6d6e82dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046531, "uuid": "a47baaa0-970c-4321-b92a-5ed402bd23ee", "comment": "Malware payload (AgentTesla)", "value": "bc6eb0bb9970627825b8803fecd4d93485d5224bac80e0c66302cbcb89f67e834c1399a0044b0ec652a93c22172a749f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046531, "uuid": "c7b1f3db-eff4-4e3c-aeaf-ef12465c2b5c", "value": "T18E659F8982C5CFA64EECF71690FE2119A3F69E492077E71D1ADDE8C2EA7F7380211151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046531, "uuid": "098fbf73-adde-46e9-9953-7cff437976cc", "value": "12288:eFr51ChxAXs4HMveuIjv3L0ZhYShsRoU7ieN:U7y21s2uIjz03rw7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046531, "uuid": "85d1077e-d10c-4847-b8f0-fffd2a798194", "value": 1426043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046531, "uuid": "7ad6d88f-6828-4d72-8c35-a73b65e8398c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046531, "uuid": "b1004ac4-5e6f-480c-b22d-b9a54e2607ca", "value": "RWEEK_3201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd5852e-1be6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773081276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081276, "uuid": "22fc0f48-918d-4474-ab7d-a88e4736d391", "comment": "Malware payload", "value": "c01db88f89bcc95f2842b04a167154f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081276, "uuid": "d961d287-2176-4fda-8897-01a892922e4d", "comment": "Malware payload", "value": "40d2e1287608e697cfeb2fd4f52323cf3d97a99a5f7ce7ce2ab93a7c923b1fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081276, "uuid": "715d53e8-5d27-4476-b34b-9de8c1e90494", "comment": "Malware payload", "value": "4b5ab176d671f0d6e51135755d7373f6875c07db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081276, "uuid": "9357b1fe-0cd2-4dc4-9b6e-a0c422132ba2", "comment": "Malware payload", "value": "d607ab89a4bca4f804f0c9c5391c81003842969491e5a03b1106bae31eb776ba2f83691fc52c7376ef9e7cbcd4f4d1ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081276, "uuid": "d8f3c0ca-98b5-4005-9d68-846babdf8cfd", "value": "T1E5B606AB62E481ACCD5EC13AC0B7CB00D9F374F4073BCAE702951718AE669D75D3A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081276, "uuid": "dd954d95-d861-444e-a5c2-9083db346b24", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081276, "uuid": "50bb00bf-6831-4b12-944f-39e8ddd95299", "value": "98304:v3L31Poeoc3pSHHsfNakwWa2TdguV/RJdB:/L31PoeocZ98kjaOem/RJdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773081276, "uuid": "1de0585e-a65c-49f9-94cc-22152e308bdc", "value": 10872320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773081276, "uuid": "49b025e5-84bd-4d08-826f-aaed2ca7edba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081276, "uuid": "574681f2-0a24-4210-ac4c-12496c402c69", "value": "SecuriteInfo.com.Variant.Cerbu.271832.20337.10785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a8a214-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043411, "uuid": "58c73264-0025-4515-9e4e-a7355c3dbfc6", "comment": "Malware payload (CountLoader)", "value": "6433672a54483f5d21cebc13ac9ac7fe", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043411, "uuid": "63067791-c859-4c1b-ade0-cc9ea987aa64", "comment": "Malware payload (CountLoader)", "value": "40e61e8070a58aeae224e5aded63b7f2c8ff25340f611b23585ee5c33b4a433a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043411, "uuid": "7b040c6e-9f7d-4f7a-878b-ec5c22f0235c", "comment": "Malware payload (CountLoader)", "value": "d8f89f6149408f867cad1f57333fb51d2f551090", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043411, "uuid": "a99e026e-bc76-407e-8a3a-5df43fd0c6cd", "comment": "Malware payload (CountLoader)", "value": "47b5258449495719822b68e426f539a7c4c508bedf4053d65b5aca67acbfae289705c27481df12698a2a828eb0dfbf8c", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043411, "uuid": "4aa7df5f-ad38-4ead-b69d-dbf84c4e38e3", "value": "T16CC3DC1814FF70D75662B828C357E083CA41CA1B700BC53A7A3DCBB55FD956A01EEBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043411, "uuid": "cf2ff974-766a-409c-8249-85863b9b00d4", "value": "768:D6k8gS3riY8mL3eMcGhDSJHT54y7km7tp9RW4NNnBgl7oHlf3le4JlfExLQc6fdB:m+qLq2d1Rxefe9SmDgiSsDGPFCg/My", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043411, "uuid": "14bb3f90-18e1-4e5d-a635-a1a1e2697558", "value": 125254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043411, "uuid": "386e2450-66c4-4bac-b772-f2bbdaa6cb30", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043411, "uuid": "f318141a-b5c2-4276-9521-5a084b8cb2d7", "value": "Nova_Data_NewYork_5969.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f31e9ba-1c0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098696, "uuid": "7ea3b0bf-4cba-4748-a5bc-6680609ee079", "comment": "Malware payload (Mirai)", "value": "947402ac83abffeb48e53b33b6783874", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098696, "uuid": "72a33c86-31a3-49ad-9276-9ebe9990c648", "comment": "Malware payload (Mirai)", "value": "421dd52c9864f6586232a76357706f8741d6f0e5e7c535c62c6d82254013b555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098696, "uuid": "2cca66ec-6e73-4b2f-a4b5-79f8193bd70c", "comment": "Malware payload (Mirai)", "value": "4a35b3647ab76a56cb1af75bc91a1c557d683c6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098696, "uuid": "5e62f322-45d0-480c-bc40-c9c7583f5fd5", "comment": "Malware payload (Mirai)", "value": "70ab8fdbe9f0be12d4498253003900fab55f0bccb9799d18556732b729c79df0795e65d274fa9bdfd8856d3a2ebfc75d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098696, "uuid": "36319f09-9e58-433d-996f-7c001adf5361", "value": "T19A041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098696, "uuid": "1faae23e-56f8-4d68-981a-59e421e88fa7", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMzEzvQ6WJ9G2/7ZiYlTBVmJTM:J3CTRdrD5GFnrPU4sNzZt0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098696, "uuid": "7ef3fad4-6475-4d25-953e-4e154aaa1234", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098696, "uuid": "78a1da13-0426-4020-9443-24b8dbefdfb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098696, "uuid": "4f360c78-9323-45ba-8e3d-70425644708b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f8ddaa-1b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773050767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050767, "uuid": "e9d57d72-943b-4db1-b93b-7aa834f21c1b", "comment": "Malware payload (ValleyRAT)", "value": "1855155f3021b30eb1160522bfc10b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050767, "uuid": "476cd59e-8f9d-4e25-8753-01f3a4aadfcd", "comment": "Malware payload (ValleyRAT)", "value": "425fb0a07478df7e030a8d65b55c7fbaeb3380e039db6d34da97146221ff2ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050767, "uuid": "fc4fc26f-31ee-42c1-9a31-c96365b4ea9e", "comment": "Malware payload (ValleyRAT)", "value": "d9758e2967c3ad3fcdd2d97425466461a768c29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773050767, "uuid": "0e319e89-e48b-4a10-b4e2-f874e2c6e38c", "comment": "Malware payload (ValleyRAT)", "value": "7dfaa07756484e4bc63f3f908e758de88f815e3738344a4b6ec8d5d11ca9e142cec9b71fae51f3b1fc376765c2fc1fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050767, "uuid": "9a76981a-69dc-4faf-b66b-e533551a2e67", "value": "T1620833A4706ACD25D4BAA472BD82E6887DDC48C4810EDF3AD757FD3C09502F2B17B91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050767, "uuid": "f0b6ab30-afa7-4182-8606-205efc0afedb", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050767, "uuid": "efbbad4d-eed9-4f54-a534-40c6cea03a15", "value": "1572864:n56z+xEJOzsY3KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYX:n5KSwOB3ecYmoCWdiUQxdF8X3kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773050767, "uuid": "ceb28725-e80f-4892-a7a3-b34c5a15c197", "value": 78569965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773050767, "uuid": "40c93329-5149-4acd-b0bb-62f0fb5f0950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773050767, "uuid": "9737d6a6-de23-4d40-848c-7e59d3873a70", "value": "1855155f3021b30eb1160522bfc10b5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3202392-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054357, "uuid": "6b985deb-3e7f-4d4f-a245-e841bbd9a45a", "comment": "Malware payload", "value": "814b6e48edbd12e325ba87619c59f704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054357, "uuid": "2d1e600b-1980-4dfc-bf36-9bee100a63a3", "comment": "Malware payload", "value": "4264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054357, "uuid": "0d29a362-1df4-4128-b9d2-02bcc5e3fef6", "comment": "Malware payload", "value": "5ebb84ab4bda97bd032d922e5dda7543dd28ba74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054357, "uuid": "3ae617cf-400a-4c39-8e8f-f7f9792834b0", "comment": "Malware payload", "value": "2c1b7d855604cd0bbb7a79e0dc0e0450406802a448b60cf3f41f1f2d6f90955c2e8047410dbd4f1f3117ae490ac14456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054357, "uuid": "572a75bb-a594-4bfc-8c13-0ecbf9587402", "value": "T15F549154299F352E74B97DA25FE8F85E975BA0A36C9F38CDC4D426130422E14EB30E78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054357, "uuid": "67ff7f21-335a-4770-b447-3cf401209670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054357, "uuid": "9bb4a317-35b2-4008-803c-cc257f3ee515", "value": "768:gsM9E4LUP9QcjdBJeotZa+zzezCW4sFw4YsaTghN+:gsM9E44QcjdBp8zCWR7Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054357, "uuid": "8e70e948-c4c6-44c4-88f9-725064988940", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054357, "uuid": "af71eb15-4b0c-4ed0-9635-e30bf9e65486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054357, "uuid": "e777097f-46b1-43a2-b09b-15bcb5d0108c", "value": "4264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5126f9-1b69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773027586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773027586, "uuid": "b7389a1a-399d-43f6-82c4-e7faa1395f9e", "comment": "Malware payload (Mirai)", "value": "66b3ab3bd4a32cf1251704093453717d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773027586, "uuid": "35e15993-4e9b-4c64-a9ca-cc16b67dc927", "comment": "Malware payload (Mirai)", "value": "42bc0e1e7309a256236ea5e46d0ddba04648f1ed6f930870d79f717c177dcae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773027586, "uuid": "35df6463-6817-4e42-a49a-ffe5e87e9681", "comment": "Malware payload (Mirai)", "value": "f16ffd119d93af0d9b209b41c0afa6b6ab480304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773027586, "uuid": "7a23141d-96bb-4921-a519-490ab08d8151", "comment": "Malware payload (Mirai)", "value": "d3be27df6e847d11b610b66387f9f2c82c92f8b7f5078df3e20b555e6fd8f2db7c89b553e438399dea17c41524be6548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773027586, "uuid": "ba122f1d-7d79-428e-933e-1451a25d9e76", "value": "T15A44A5553A22BFBBF1D9C73047B3CA2056D925912BD19746F29CD71C1E2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773027586, "uuid": "cecef2df-8ed3-4f51-9b6d-6f10902c29c3", "value": "6144:qASqHHDQgTUyGu6mvu50ZNxPtHyGtyTlHI1:3HLOu6mvu50ZNxlHyGtyTlHI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773027586, "uuid": "ace90732-de8e-46a9-9d3f-bf2c468f06d0", "value": 253730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773027586, "uuid": "998deef0-9e85-4b39-8939-fbd1543b829d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773027586, "uuid": "d9d9d9ff-e272-44e6-9f3b-854ea35f4c3a", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71b6084-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054337, "uuid": "d66ac75a-2504-4cbc-b6c9-509638f4d2e3", "comment": "Malware payload", "value": "4abcbb734bac612ef1922579a9d61007", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054337, "uuid": "e1bb874e-e90e-4505-970a-54a681b03382", "comment": "Malware payload", "value": "433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054337, "uuid": "335feee1-7c04-4d24-a4c3-f0792b05c052", "comment": "Malware payload", "value": "43b0e595c1a549e5a8798e30564eaed1a30044ec", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054337, "uuid": "5275d697-1505-4df5-9ddf-e75e090720d1", "comment": "Malware payload", "value": "84084c1d743bff43e0ac0ffa8eebcf7d3f210a9f40f03aca08e6ab0a1122d702da14f8c6032a8d2e54efc1c9d5264edb", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054337, "uuid": "cea6f1e2-c07b-4368-8c6b-c96eb0a4ab92", "value": "T1C2A38CD3AB8917EC96944CF96209B563A5F3C97B3C192278F9D20693B43DF10B922734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054337, "uuid": "0b863a27-f675-4012-bf0e-761a8d7189a0", "value": "1536:idoDk6skHWyZvUtdUg+zjIoltzNDvckBEXRlBK:i6t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054337, "uuid": "488f9d11-14e4-423b-910b-0fd85712e750", "value": 103191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054337, "uuid": "9914a328-e7d7-44bf-bd4b-a2624c6798ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054337, "uuid": "a9d35ea5-a633-4e3d-af23-a7622ac735db", "value": "433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17f0906-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054274, "uuid": "98c5ab1e-9bb9-42f7-afe2-330d1b3c31c0", "comment": "Malware payload", "value": "ffcc5ec07911e7d645bfdaf5767a885e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054274, "uuid": "9dad7e8e-41bd-4542-833d-691919dd51c1", "comment": "Malware payload", "value": "449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054274, "uuid": "54b0f0eb-6280-458f-a058-001e123e3299", "comment": "Malware payload", "value": "dabaff91230d5942be74c5ca80b56c44d96b3df9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054274, "uuid": "7b8ed1b3-bd6c-46d1-98b4-5ca7f2e9af6d", "comment": "Malware payload", "value": "0c9e47ae90f7c2e26f671155132eb0fd723661c1ce7c54160f6e828f43586a84745302eb076fa5c2275737c44854070b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054274, "uuid": "931b56e3-19b4-44de-b41d-d663900f47ae", "value": "T112D34B17B6A670FAE2778934C5520905DB72BCB24BA0ABDF17904E970E276D0CE3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054274, "uuid": "c155a2e6-b31d-444b-91d2-4318be610361", "value": "80bbfb0384bdc6b3a83a2125627e8b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054274, "uuid": "8daf49c3-73a4-4d5d-a566-973543fa5791", "value": "3072:dImIVSsLs0/aRgGyD1KYAwCHCkb0FgGD/:ESu4gGE19FFgGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054274, "uuid": "d3cebd95-e2ff-46ad-9cb6-0c783ef1b107", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054274, "uuid": "502c9c12-5024-470c-b7ba-8da295efd2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054274, "uuid": "6990e1b7-a22c-47a9-a2d2-57a9e1afb87f", "value": "449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c194514-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773040655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040655, "uuid": "291f59f5-f797-4c88-a55b-194ad21f15bc", "comment": "Malware payload", "value": "50fb0feb9f46c6b8a316dc4c2b79b8d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040655, "uuid": "847a7ef6-ab5c-46a3-94f0-bd2dd986c6e3", "comment": "Malware payload", "value": "462f1a390f0a4eb036362825a566e04fa83be65ae4b361badff438f4b74c3046", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040655, "uuid": "8fc9c4c9-7c34-4fd4-9c8d-a6846ad385fd", "comment": "Malware payload", "value": "c91d951d4f9496b98245136635ddbb6f975f7ec0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040655, "uuid": "c8a9080c-5cc9-4e1a-86f2-ba26228da405", "comment": "Malware payload", "value": "64835effa0d7af4aebfc5ec405c0959cb65c0b4ee8ffdf917d7f51ab15a30695f375b1737fc4cac28f35814aa7b32371", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040655, "uuid": "080610c6-3393-4cec-a44f-43193b94ea00", "value": "T11BE23CF24DF244BB7565877F6AA54C840235C8674256C33F0F8974ABE2388C8F4D76AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040655, "uuid": "d89ef806-c72d-4d5a-9b4e-241aa374b883", "value": "768:tkIQS71kj1ohHqr3uQpGnddw0AdEw1gkFpYiUGNnnuGOzunV/q3lewF0SL:/FjHnBA3KiD51P+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040655, "uuid": "735d6e2a-6f34-45d5-a733-b4a214825dfb", "value": 33692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040655, "uuid": "25393f59-6548-4ec2-8442-3ab2fe6c450d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040655, "uuid": "c6faa1df-5268-4bd5-8a6c-b33a04fd43c9", "value": "NIF050326475-wic786.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c424d08-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773039018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039018, "uuid": "93d36a31-98a2-4a5d-9416-3732de15bbaf", "comment": "Malware payload (AgentTesla)", "value": "a2f6acd2e16c7d9966dadd91aa1ec11b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039018, "uuid": "e3ab5e3a-3a8a-4783-983a-2d217c184521", "comment": "Malware payload (AgentTesla)", "value": "478db7c81a60aedfb07b367f7de642fd4b7bcba9b8fdbab2a93ecd91731d869a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039018, "uuid": "301322dc-e0fa-4d26-bd44-fe152af07a00", "comment": "Malware payload (AgentTesla)", "value": "d8e190f73d52f6511e32057b3408ff66f8daeb9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039018, "uuid": "aae58782-5990-4b16-a5ee-e0ada0c9070f", "comment": "Malware payload (AgentTesla)", "value": "677a153a3173c5a11196bd1edba3a98f31a964648015640760be6809c17a08b0478aaf9dc79fd7c1d7ce1e690fc56107", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039018, "uuid": "a7459010-d825-47c2-b16a-53333f34ed85", "value": "T183559D140C4B3F188D0D8B453E76163E1FDE94A6CFCED9BDA86666211FFB04C2D96229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039018, "uuid": "0061ec0e-fbda-4230-ab6b-ccdf1662c623", "value": "24576:2iLkJ6D1Uovuynz2HPP170ZEg0v7jhh3x:2i66xUovlz2Hl7qEg0v7jjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039018, "uuid": "074edc8a-7de0-405d-a987-56668a726103", "value": 1336150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039018, "uuid": "ef45b5f7-5f44-4ebf-bcdb-546fc0d1cd14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039018, "uuid": "c3fe1b47-475a-4bb8-9ce8-fde3f4a55c88", "value": "a2f6acd2e16c7d9966dadd91aa1ec11b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cd006f-1b65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773025887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025887, "uuid": "13e87b55-9f1d-46fc-8431-b2dc7d3a46f3", "comment": "Malware payload (Mirai)", "value": "764b3c4cf5e0517cd88be6a97f1bf3be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025887, "uuid": "68d5e4a1-b562-44da-a33f-04cad12536a4", "comment": "Malware payload (Mirai)", "value": "47b9a830b5747936deef619b2860e8d42520e4e9c2fcf2ffc991f233fea1a852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025887, "uuid": "5b64aa4b-60ba-48da-a34e-62c599f0405b", "comment": "Malware payload (Mirai)", "value": "a7dc98f119f32a54be8156f8a09c8967829f2c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025887, "uuid": "a48ae05b-4e6d-49e9-8bb1-4af64daad772", "comment": "Malware payload (Mirai)", "value": "18e431e7ed4ddf1233e14faf2debea2d4786639530b96d14fe5ceb464f4cf5568552ac1293ef781032b09c41355eeb47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025887, "uuid": "ed5171f4-52df-46ea-b830-0caae96958d7", "value": "T1F8932A91F8819613C5C5A6B7FB5E4259370A4368D3EB3203AD244F76338E89B4F3B985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025887, "uuid": "d2bf7b87-344f-4cf6-9d02-767dd270875f", "value": "1536:qgciOVmlXjOrDTpTugnyXfDMZavUU61gRU9VsZyedG8RO/IWe7N:KoReDTpTugnyPD2avJIVTRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773025887, "uuid": "06b5a49f-57be-4b20-9950-b73f0f4d0c3c", "value": 95564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773025887, "uuid": "2c9e1db5-30a9-4947-96c0-d195be63eaba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025887, "uuid": "9291b1b9-cb5b-41b8-ab2a-3146b7db0280", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6424d29-1c07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773095594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095594, "uuid": "4ffcb126-cd8b-414b-b48a-3936675391c3", "comment": "Malware payload", "value": "3b2ebaba3e14de9b00f5751800fc104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095594, "uuid": "7bb82676-a0be-4ec9-8682-9bac40875b19", "comment": "Malware payload", "value": "47cfb9a85a5e8278842388eab485b613f5ed2fe9ed54d31e75cb1f50d59f03ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095594, "uuid": "4b1304eb-7b94-41e8-81b5-2b4801c27e80", "comment": "Malware payload", "value": "a1e892db634a8e6512d70ae4ccb5e7163425030f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095594, "uuid": "4db85c54-b7d3-4d3c-86f6-319977c4660a", "comment": "Malware payload", "value": "b541e579e008ed74bcedfd638cbfd8e5d4d777a65a0ca77c97cff4597975ddd8d4c6e43061ad8a59a654de636a3be59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095594, "uuid": "d4ac9b39-3888-45ab-99c7-8ca2fc207bfe", "value": "T18BB6E4AF62A48168C15A813AC06B8B3CD8F374F70727CED702AD171BDA235D55E7B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095594, "uuid": "246d732c-c79b-4e9d-8124-2a2f403e409d", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095594, "uuid": "780b73bb-f055-4500-b7ea-9d9cc31b1a2c", "value": "49152:Q1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpNfMdPHQptnHHsfNa5Lh:Q3L31Poeoh3phHHsfNa5LYwPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773095594, "uuid": "86576948-5128-40c6-8b73-75a0581352b3", "value": 10895360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773095594, "uuid": "64122e05-aa2d-4204-bc14-4de4f1545b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095594, "uuid": "39fec58d-d0de-4b9a-ba06-294ad4b18f46", "value": "SecuriteInfo.com.Win64.MalwareX-gen.28927456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0e6364-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043422, "uuid": "200faa97-676e-4645-812c-b25ade2b3d87", "comment": "Malware payload (CountLoader)", "value": "37edebd87e9c173be0c10adba3f019a0", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043422, "uuid": "a4fbf436-098c-4489-a8b4-21c979d856a9", "comment": "Malware payload (CountLoader)", "value": "47fe8a5fcf2748d0bc948f6bac6cc480999052df75a8d954d371a9a22ec76607", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043422, "uuid": "5c292324-fef2-4404-9d1f-d4714c345617", "comment": "Malware payload (CountLoader)", "value": "83af6f7e98c226051af7d1851ecbc7d5512e1a64", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043422, "uuid": "c53f864f-28d2-49c4-990c-0a5c8af05e1f", "comment": "Malware payload (CountLoader)", "value": "6d5f3e282c6e44ae850dd647cbcdbe77fa08b793b66e5e70e6cd95e9dbf2ac08a9db56c7865cc0366f5250f449ed77de", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043422, "uuid": "d04a5e81-8aec-4c15-9654-1bf988385dd8", "value": "T185C3239B5F9F82F992067546966F1902DBE2E813055CDD80FF1CBAF91F12D2C90E849C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043422, "uuid": "bfab45e6-13f4-4002-84b7-0d442849f132", "value": "1536:PeCrptdK83kDclHj1bLcRvrUIjZYCZoArfy8jB7:F4Ccd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043422, "uuid": "de81fb17-2713-4880-a318-2ae8d849e499", "value": 126059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043422, "uuid": "6e6771c8-8d45-4a2c-9165-3c776e40897c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043422, "uuid": "30d124df-cc8f-47a4-94ba-5d4a098643ed", "value": "Journal_Raw_v2.9.webp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aefa85c-1b61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773024091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024091, "uuid": "da6cad85-9059-45c1-ac5d-10a4f3749da0", "comment": "Malware payload", "value": "f80b916f72aec8c9b484670639577542", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024091, "uuid": "6058ed12-ab7e-465a-921f-117eab359fb9", "comment": "Malware payload", "value": "48d525bfa1153d08845db7b48326c79dd1bcbeac0b96eda782c5053ace288c9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024091, "uuid": "7172bc77-16ac-4468-9900-1a61d7db5dc4", "comment": "Malware payload", "value": "b042bafa4fb8ded507f58b5c7785d283b277b376", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024091, "uuid": "91983bc2-a0f8-4b5f-8bef-f23ff21bd961", "comment": "Malware payload", "value": "b025b28995f0deec40ec85e020751162ae799ec63edfb5080b7f52cf292488f49f6cbdfdedc5d71ef47b1efd15eb3df6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024091, "uuid": "ebb6a865-2f5a-4c5c-8e30-b62be74b6283", "value": "T1FB925DB512896C79FBD1CE399F3C6F4DADE8C2C42124E3ACBA0F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024091, "uuid": "1e188cd3-4c42-42f2-9290-8224122f5d24", "value": "384:1mcuQpWx+BL0SWL0gszsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:1m8i+BL0SI0PzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773024091, "uuid": "ab9910da-ebae-4551-9a48-69216dd557c1", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773024091, "uuid": "e54884b7-e865-437d-b276-6e158ea13745", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024091, "uuid": "671567e0-837e-42b6-936d-e2dbe85cd5cb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60589aa4-1ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773051105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051105, "uuid": "cdc92d58-1b10-4a30-af5b-e6766244e256", "comment": "Malware payload (GCleaner)", "value": "e58b5c1ca4e7dde3b172ac461ef1c6ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051105, "uuid": "87df195e-33e4-4e73-8d13-363a01ae8d1d", "comment": "Malware payload (GCleaner)", "value": "49800443c37496b0fde2e468d69a0979bd31978aff9b06e37340ef5587097034", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051105, "uuid": "1fd499d3-7c8e-4b43-baa3-9ee74689d96f", "comment": "Malware payload (GCleaner)", "value": "4ca11f95e11ad4001e95aa1f79f41dc4b0188ade", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051105, "uuid": "f1214a5a-ea8c-44ab-a109-c684d65e0e65", "comment": "Malware payload (GCleaner)", "value": "25b4f37ff1477994d999b413ae10ca744b2ef26445488a6e8b94fde9ebf05c2e70261a6eaaf62231b8fad2257ac563ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051105, "uuid": "b592fc6b-8aad-469d-be3b-d36750958ea2", "value": "T1CC657C23F1C29537D0721A3C9E5AA65954757D101E2C846ABAF48FCC8E3BF8139272E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051105, "uuid": "31c8722a-dbe2-421a-a786-6726cde69545", "value": "c1d0e759566e996ac6967155960c748d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051105, "uuid": "597955b1-6d1f-462d-9ff3-618fb3c2b277", "value": "24576:ys9ryNwyrX67my/p+5HJHL6GBlB/5SUxDA1awOxSL3v3SBX:ycrEHJeIgUeAwOxSLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773051105, "uuid": "a8fb1cb4-adb8-4edb-8c15-71141ab43ca0", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773051105, "uuid": "9c16a66e-139c-409a-ad54-2705a84e9871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051105, "uuid": "c0ff2a70-55eb-4be4-9728-e75c30ecb97d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b949fa-1bf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773089253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089253, "uuid": "7089b1cc-7f41-4fb7-bd36-92d3d7ed075a", "comment": "Malware payload", "value": "f8188e5be3f02a88324e9df034324c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089253, "uuid": "7dabae3d-c78f-4983-aa97-3bd55d50d1cf", "comment": "Malware payload", "value": "49efc96882b7716945fe0dbd204492207c6994682de30a9755a678dbb4037047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089253, "uuid": "4a2a324d-d171-4e2c-8c26-a88beebcfaaf", "comment": "Malware payload", "value": "b4065fdf755261762bb39c2b6e1fad27e778b5ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089253, "uuid": "23ea6d36-f24c-4e14-b35d-efa2aaf33314", "comment": "Malware payload", "value": "5ab8b6c6cdde4a0e2f59b53d232d755085ac8148624f94556776c54851beb4233b444871775ebb0b1fed8da96d26c9f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089253, "uuid": "eb66183c-f3f8-4f0f-976c-10443d670998", "value": "T1760523B3498D1A23C52EA77E6F48E6B813C25C617B7C48B9B416C5CC215BBDB8D2409F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089253, "uuid": "d051f568-74f1-4cf9-b381-ae21eb2b5f46", "value": "12288:8M6jQ5HK+Y7sM2EqPpSX7gD6r3qIIQ2X6IrtpRiHPNQ1riGj+0By4FE/KVqFK7de:8bXv2qB6IL2XePMrvjPRVkK74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773089253, "uuid": "55d0d8cd-62d8-48fc-a5fd-888ed6b198a0", "value": 850676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773089253, "uuid": "375fa5a9-1a19-437e-99e6-ee0817a4f3a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089253, "uuid": "cb7744cc-274a-4552-8ac6-d65723e5e63b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa0ce4-1b74-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773032082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032082, "uuid": "90d7f593-066d-4a95-bab9-5b95e116baef", "comment": "Malware payload (AsyncRAT)", "value": "9a630278a1f696cd1c4d01840355a48d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032082, "uuid": "e9e660ec-f1cd-44fa-984c-bb806762e02e", "comment": "Malware payload (AsyncRAT)", "value": "4a2e4cca2efac0ccf4a7c8f2b5e4b28f95536ec1707c26127cafe215c1280792", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032082, "uuid": "a33bc389-40e6-42c9-9787-274433be673e", "comment": "Malware payload (AsyncRAT)", "value": "7eae10ff346ada74c46acde9207c4a54fb0a3765", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032082, "uuid": "38712aba-f964-4b94-9cef-512a5dc1686a", "comment": "Malware payload (AsyncRAT)", "value": "de0bb33109ff80b43a43de59ab5f3b41494d458581e2e572b1ba0f25d7c2d1cb1ccfb7a30081e987c59b8bafe4bc9979", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032082, "uuid": "13d0c03d-8e38-4690-970b-69690289a247", "value": "T120033918B7F84965F2FE5B7D8DB182004335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032082, "uuid": "f436cf31-3598-4ed3-8323-04bacaaab764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032082, "uuid": "229dc6ef-3588-4037-825d-70ad1193ebf5", "value": "768:enCIc0pMVGbTpwVRbJpB+WWP7LR1pWj+:eClKaGb9wVRbR+dPpWj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773032082, "uuid": "cfea9c15-3975-4904-b36c-4268dd2c81ff", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773032082, "uuid": "f79fb5a8-2503-4f75-92f3-6d31a2d9d818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032082, "uuid": "7e198e14-161a-44d8-90a7-fa3b04f0d764", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd664ffb-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098613, "uuid": "41657659-1f16-4248-939e-76d6f9308f4e", "comment": "Malware payload (Mirai)", "value": "b7644e741c7c1aedf4d09fa21e34a3c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098613, "uuid": "2609f811-845c-4a32-8762-3567ba2a9b0f", "comment": "Malware payload (Mirai)", "value": "4ac9feaf0ce31b087071e046cb3562f616dc7a79f5fb0e8af4f7e52df91bb3ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098613, "uuid": "eccba95e-222c-495b-8cb3-45a45ff5d055", "comment": "Malware payload (Mirai)", "value": "becc702af73ca0074d39255ab51b70c1b7da3c0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098613, "uuid": "9e748445-bd7f-47f4-ad70-e54bb4f7f4ff", "comment": "Malware payload (Mirai)", "value": "624add960e4fcc418de0745979f64b99ff9cb387f8d07aa46d31b6dbf9b2f9bba51acf8c56d4b27e457d3a8b19c14a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098613, "uuid": "c39254ef-5be7-47f2-be0e-98883f462b83", "value": "T129D33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098613, "uuid": "9de26678-8912-469e-8ae3-6bcf7fd099cf", "value": "3072:JuVeGJFWOgt9ctajH1I7sw41o+YLyXzXgv7:JuVwt9cUH1I7swMeLmLgv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098613, "uuid": "f7238ddb-7b95-49d2-816c-c7561c262b23", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098613, "uuid": "dc498c4a-00a6-40a4-9f67-1e1f069fe05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098613, "uuid": "0eac75a6-3fb8-474e-b034-16cb8fee6a93", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce58530-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037113, "uuid": "6eb3b18e-79c3-408f-a485-80b4ea7f9dfd", "comment": "Malware payload (Mirai)", "value": "4af12f4cfb52391cca721c3e7800cd60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037113, "uuid": "52661e5e-e727-4bbe-880f-a35c47584bd4", "comment": "Malware payload (Mirai)", "value": "4add0ad59d33cbe4cb085a6bf454353d0d321a09c268fbfa9ba9654637975122", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037113, "uuid": "c6f49f5e-1c97-4777-8aba-fb0f8a0b75b9", "comment": "Malware payload (Mirai)", "value": "44bb40a92e0a5d82197ffa8e1a206c6b73ef2543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037113, "uuid": "527b120a-1c71-4d00-8edd-3ccb0d0755eb", "comment": "Malware payload (Mirai)", "value": "55110392708303913d6e79cb7c75ba27356fbf1ad26bb3d6a7b7f70910bc4aab5042100c1762baa8989df0d534c5ed74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037113, "uuid": "501daba7-2e42-477c-ac51-2caeb8e68a66", "value": "T14B93991A7E11DFBFF65D823007B78F31969876D636A18185F26CDA481F7028E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037113, "uuid": "1374bd44-2765-4709-a8a6-99e5608339de", "value": "768:58nfwDCqCEKrU065YAF846NtR4wpyD8I8rJkJoyJkTv2DEe1PIi/:+Y5KrU065YjZSSr+JuTeEeZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037113, "uuid": "2e2fdf7f-679a-4e3e-9599-04d4ba9e10df", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037113, "uuid": "0c86a488-1f97-4878-950a-c15cf54b8232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037113, "uuid": "62a9751e-f6cb-4498-ad77-8335f0817e15", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6fd7ac-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773038782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038782, "uuid": "eff072e9-499f-47df-8d1d-ce3bc7174461", "comment": "Malware payload (Vidar)", "value": "37f05fc1bfe44f211612145090f48530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038782, "uuid": "0209ff78-1a25-4410-81ff-6257f7287a48", "comment": "Malware payload (Vidar)", "value": "4af860585c7158d835a509c63f16bb3c47da668bded0ebceaf1f837003239a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038782, "uuid": "986ce971-c65d-4477-b59d-3fc7fef9462f", "comment": "Malware payload (Vidar)", "value": "e2799e9f9736a3bb1b537362a5f73b4e6d0b8388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038782, "uuid": "be1e15d0-9b3c-4db8-9e31-563c9b29d032", "comment": "Malware payload (Vidar)", "value": "1defb9d8b4c37b95d083242b73a742def7366c35bd9fc0cb7d7dcd32f1c238aab5dfd0e5340f3464ed3f652fac0922f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038782, "uuid": "854892ab-5c80-410c-8e59-516cd99c9ea2", "value": "T1D1D42B7DAC50F326F70C90BBE286E3535E6178410636A99319BEE72001458B39B5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038782, "uuid": "4d7ab2c7-0038-4e44-8d11-fd1d3be5ad70", "value": "57594b14471500698dd38c5d2e664b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038782, "uuid": "ea80353a-6608-4481-9ea0-e1ee03469f71", "value": "12288:qU2FJXk2WjWnLFTM5rdwhFmdV8Bew2/1gdu:12bXk2WjwBM5+XBew2/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038782, "uuid": "ae2c9c1c-d902-428c-8705-b26cd987fc3a", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038782, "uuid": "d976fd5d-88c6-42c6-a71c-d038879ead47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038782, "uuid": "a7f3f3ad-3e9a-4f12-b11f-8107c680282d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7c4ee0-1bf7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088493, "uuid": "6228343e-8c08-4de6-8250-9df82569a2fd", "comment": "Malware payload", "value": "cf18d7bd5b92711721334f8b8cba2c0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088493, "uuid": "4aafd827-0077-4f2c-9aa6-7851e54d347d", "comment": "Malware payload", "value": "4b044b4e9eec63f249e5e8fa4276948cf8002fff4d67b9c80532c7500694fd03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088493, "uuid": "75388067-0f79-4686-b637-89ff7cc61eaa", "comment": "Malware payload", "value": "1eaf499d984df6ce2046d7daf21d991ae11b9159", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088493, "uuid": "7d10e794-ff33-4a35-80ab-d30a60888ca0", "comment": "Malware payload", "value": "68ec5933585b44edb39f7a7ccb7bda3433a30c316f7d66eeae5eb0ac2313061db6f40211f3b9975409e340ddbf211a57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088493, "uuid": "69780c85-085e-44c6-a8ac-e0c70fddfb15", "value": "T1ACC3DF5A489F83CF0205659AC357D46FEB52908F070DC69032ACCA58BF8B99DF1E96D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088493, "uuid": "b59db616-3917-43a3-b903-dccf33ccf16d", "value": "1536:5/cm+JabH9tOwg+rgZkYbN4HJ2nSn3aTqhAqto5R:5/cm+SqkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088493, "uuid": "02a558db-a9b3-4723-b271-132662aa3bed", "value": 123596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088493, "uuid": "b6b4d38f-8577-4427-b65c-950259fd4787", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088493, "uuid": "edb13bb0-ddc1-47f8-bb17-1e0634fcc339", "value": "Meeting_Photos_Temp_6194.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc954039-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773038911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038911, "uuid": "909afa55-0820-4141-9e9b-93f68406ab8e", "comment": "Malware payload", "value": "d560ef9f7a5d1f1880fb862c3c8d3a27", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038911, "uuid": "93063a70-7ebf-47d0-9942-60132e15c400", "comment": "Malware payload", "value": "4b298c1540bb1e53ce17621b5b53783216a2c2e2505274e3764cf48a149cedf8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038911, "uuid": "a83dbe39-0324-4f96-9099-80c1dc269583", "comment": "Malware payload", "value": "204e78f8776abe2ac5d1185c010110ea7781e95c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038911, "uuid": "4ed94bc6-8afc-4b7e-97ac-e287e3dca339", "comment": "Malware payload", "value": "7538ca781b7242c0e3ab10943aef8359b8504b1772fd07bf3ab17aafbfdbcf9535895890a2645e51746e729a4004b842", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038911, "uuid": "14c1341c-f8dc-4be7-93f7-066c4f8b9293", "value": "T1C855544057218010D5B2368EE66B7D116BADF14F74E06BD321EEBB0AD8CB91DC2E53E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038911, "uuid": "5272b6d1-b273-4d37-b614-e6196a6564e5", "value": "3072:O14KqqZwUjiPaPZEEElR7jrLw8yzaPaPwPaPoPaPGP9PYEEE0R7jrL:O14loaoWoeoE1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038911, "uuid": "ece23da9-0926-460c-a9e4-22736a517b75", "value": 1304214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038911, "uuid": "28ce6b44-6859-49b0-ad9a-2ba0d1ea1d3d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038911, "uuid": "bc6459be-3fb2-4c66-b19a-d0416e21978a", "value": "87ofjz.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883699f6-1b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773049024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049024, "uuid": "51a12080-b21b-4c4f-9395-1eb4c7e0e522", "comment": "Malware payload (CoinMiner)", "value": "fd856e6c8d6cc2ce397d9c4919d87689", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049024, "uuid": "41cac88c-baf4-4e37-9937-57912c62d927", "comment": "Malware payload (CoinMiner)", "value": "4c0633a221ae0f2a8cd0211a5be92ac2b4a69a9810ecb9c7b4d7176bd51e56ba", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049024, "uuid": "956486bc-a9f8-4178-9daa-6f944d262025", "comment": "Malware payload (CoinMiner)", "value": "047b946d939928d9f87571d41db4eac592240194", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049024, "uuid": "1160c305-7da7-4670-8e2f-f87e983ef91c", "comment": "Malware payload (CoinMiner)", "value": "8df4c2cd63ee3554f7a5e7d7af43dd3abc4965f02e0fea5b9be49c78102be9f7b79c211264dc3c12d06143f308701dea", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049024, "uuid": "62df938a-5bbf-4565-a346-7d50aaa85c79", "value": "T1EC82CC50E9784EB62399403C5CAC62821A4D461B1EAD3C68751CBC5C2F5C72FF17ABFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049024, "uuid": "d9b38964-ba31-4642-9825-08724a600564", "value": "384:D419yd8K8f86808J8h8o8y8N8iHX8D8n8l838B8kDpq:D4/ydRqRz6I/XudHXqCg2ITDpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049024, "uuid": "c3672e14-44f1-4a4b-82f5-e09683e30cbb", "value": 18695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049024, "uuid": "bf42f1e2-a401-4490-b327-4020d747b66f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049024, "uuid": "04f07b4e-4bb4-48ed-8ca2-8b806d45956b", "value": "super.drx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad4d28a-1bfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773089965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089965, "uuid": "56a2d8aa-61f8-4cb3-a6c7-65ef39331959", "comment": "Malware payload", "value": "67bdb796640b166a41c25ef85f6c54da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089965, "uuid": "de23e644-4ed0-4641-b6bc-0b82099d6959", "comment": "Malware payload", "value": "4c44bd2ce55eb22ff1dbe90e47282cc6cbb7c2697d6210630559448af7ebe14d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089965, "uuid": "356967be-18ab-4671-9632-69a5c60b2a58", "comment": "Malware payload", "value": "ab05fdae47b1827e0f892a6c715af39cf55587a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089965, "uuid": "d486ff32-4f13-4bfa-af1a-1f74aa22eb47", "comment": "Malware payload", "value": "99c3174d48d306361a4d81ac586ce54b8017ca98332c6582fd0fc0dbbe1ae41fb8b648e0f324c251f15c4cb672b21236", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089965, "uuid": "170f5d64-7db6-43d6-ad12-755153004cb7", "value": "T1E2C3D2AC045F40A296E9796DAA1A6C43E761A40F1F07F8C273ACD5F5FF0B53690AE0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089965, "uuid": "8ba1e276-fae8-4324-8490-e4703fae2b63", "value": "3072:xmig/ypPhD0AEESLgwxUmUNUblY7HeGGfdzQzbW:0ig/ypPhD0AEESLgwxUmUNUblY7HeGG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773089965, "uuid": "5515e445-fc47-443a-909b-678097a7d801", "value": 124394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773089965, "uuid": "dc6194be-2377-42d7-9769-f483ca5effa9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089965, "uuid": "485a99b7-cd22-4c46-9650-88ee0c27dd88", "value": "Photos_Daily_v3.0.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591f36e8-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773060541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060541, "uuid": "08a25fa9-4146-4b34-8e45-e99697113b09", "comment": "Malware payload (RemcosRAT)", "value": "b32a167acb8d7b346eae298cac4479ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060541, "uuid": "480789bf-1584-49b1-979b-2a9a93742464", "comment": "Malware payload (RemcosRAT)", "value": "4cde03e51e6a2966aa49e07c0596fbc0703544f0928df0ecb120853cd21671bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060541, "uuid": "c14bfa3a-5b1e-4fdf-8052-68f790cee893", "comment": "Malware payload (RemcosRAT)", "value": "e68c5d90dea5b7e1084db00c479eac2f0fcae0da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060541, "uuid": "8957dc65-c81a-4029-acec-735aa7b8bb08", "comment": "Malware payload (RemcosRAT)", "value": "97ac2d19d9b7cb333b10c05e22c3c57dcdcf46d592928f5cb9054a140235ee6785cc6cdbacbb3d0cc00fc638847c8066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060541, "uuid": "c5ff9bcc-3c2c-4dc1-a48f-8a5f0e0bf434", "value": "T1F7641201BB15D1B2DEE12B301A77A7735FD75F712868862723E09C2DBCB0A018A2E75D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060541, "uuid": "e244de39-b050-43e6-8d26-925943f9f8d3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060541, "uuid": "90098d69-4d63-4489-aee3-d0af61e2d062", "value": "6144:d3yztAAQgo+lu78BmvMzG/u19aZ5zcqp1Yo5OPNWWY+3GEjumKNoMt:d3rABiQmv6G/uePHk7VWWV3GEqmmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060541, "uuid": "0ac246bd-4b60-4ef1-b3d7-7f87a8db327f", "value": 316278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060541, "uuid": "79cc89e2-6374-4acd-acef-df85cbc2cd78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060541, "uuid": "fa7caefb-1153-4f63-b0c9-52acd017c78c", "value": "BL 3425005143.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1424f68-1b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773023323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023323, "uuid": "3a26070e-978f-4166-ab18-d277683fd931", "comment": "Malware payload (Mirai)", "value": "6db0ef79b55ea1ad3365bbf76262ad94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023323, "uuid": "2ec4022a-cd05-4da4-bdbb-67737e19ad20", "comment": "Malware payload (Mirai)", "value": "4e23463d49cd6e4ffaf6a896612f6fdd0b992be6911feb1cd1ad236079441bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023323, "uuid": "94c0711e-b8bf-4874-9372-71bc4227463f", "comment": "Malware payload (Mirai)", "value": "0da30c505ce6daa7eb4070d41a989cc34055f52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023323, "uuid": "1b3fe8a4-8d49-4bb2-bbf1-1504ad3f16f1", "comment": "Malware payload (Mirai)", "value": "628c849e637a6bbe2f70e989b2dd6c57dfe63fb28bb41f19bf71ea005a92b4fea754f361175a29b8cde4565589c5cd21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023323, "uuid": "5744e90a-d213-4a0f-afb8-e7fca3a73847", "value": "T17CA349337E325C7BC5C0A57631E74322E5FA439A50B8961AFD701E8CBB696103317BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023323, "uuid": "d1579266-13b4-478e-9848-ee83960d5881", "value": "1536:oQss70W1J5QgG+aj5g5R1U/wIzZYttMytFo75qDRi/04V0tSybL0Ge7fL:oOEg6j5mR1U/GhDoVckU2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023323, "uuid": "aa7348e8-7d27-40c0-b2de-38017d15f051", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023323, "uuid": "80c33bc2-55bb-47a4-b7ac-a464328dce02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023323, "uuid": "28a3eead-e931-495f-9163-d0e94ea14dee", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e85018-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053800, "uuid": "d279e120-4ae3-44fd-956e-94e25e5db279", "comment": "Malware payload", "value": "d41dc7426132ce607f957e8739e5aa74", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053800, "uuid": "032b1e4a-502f-4e2f-bb05-feb220d62a98", "comment": "Malware payload", "value": "4ec78d52f72e3a89e0ea08ce843be904227c9cad4473333171ff8a07ee372948", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053800, "uuid": "b7fce275-30c0-4a62-a563-13a20e7f5576", "comment": "Malware payload", "value": "54d4a36f4a5a4cf755fc2ea16d7b7c6b72927136", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053800, "uuid": "daa76862-faca-42d9-b8a0-1810fe7b2e2b", "comment": "Malware payload", "value": "01248a4dc0da480920b9aa97b65c31305835baea6226e90c0147ee1003667b0062e0d473334d4a65aa06c1dc2939a3f3", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053800, "uuid": "32baabac-6be8-458d-bdc9-f33794be90fd", "value": "T18DC38993AB8917EC96944CF96209B563B5E3C57B3C1D22B9FDD10683B43EE10B922734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053800, "uuid": "6822c893-e4c4-4ac9-a533-b0605a6fa3e0", "value": "1536:LZJ9o7MNvk90lMoWQC73huO/N5cGsEnYd9VGWp5AyNzCOo6bpF8rq:SJx6FFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053800, "uuid": "e58c3b38-1258-4429-91be-25387ca8fd9a", "value": 120826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053800, "uuid": "048dcf7f-fe4b-459b-8486-1211373de022", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053800, "uuid": "c2876e49-68b7-4489-8b07-adadde76a9cd", "value": "4ec78d52f72e3a89e0ea08ce843be904227c9cad4473333171ff8a07ee372948.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18515d98-1b7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773035092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035092, "uuid": "bd901546-a8c1-45ce-9169-c69c2a9ded21", "comment": "Malware payload", "value": "f310ee836f88cc43d3939f8a88b20495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "SloppyLemming", "colour": "#0E4BB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035092, "uuid": "5ef498c0-f5e5-4af5-a40f-24bf65136926", "comment": "Malware payload", "value": "4f1628821c13cc27fd4134301cc93a1ad32b2a3f7066c3d90f7ba89e02180754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "SloppyLemming", "colour": "#0E4BB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035092, "uuid": "7a572a56-3c73-45d1-ac42-201744924e1c", "comment": "Malware payload", "value": "c5171b00bfe40113f4e99cab21e71f955c397d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "SloppyLemming", "colour": "#0E4BB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035092, "uuid": "261dbda8-cb6d-49d3-9e20-366f6e216ea0", "comment": "Malware payload", "value": "ea868af3768d69d5488688c48b13670dd52886a3e80351d58cbe715876a867be33d78742313e64ceb9171ea4f02b2303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "SloppyLemming", "colour": "#0E4BB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035092, "uuid": "2bf9522b-b627-458c-8035-a5077b867789", "value": "T1D8943B12B69A8878D059C0B4C3578663A6267C890731F5FF23D4A5342FBAFE56B3C705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035092, "uuid": "7d02c1e6-cbde-4518-b225-18ce574e8004", "value": "5a6540455d80ed239b52640f22d38d29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035092, "uuid": "fef1def5-3bee-42a0-af80-8a4703eb6637", "value": "6144:5TkkYh8IGDV9+/9v7phFkP3A0yDYiccTdhz0GDz6bxYdTvmmaQ:tkkYSc9DphGgYiPexYdTvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773035092, "uuid": "cb58fc41-0e0b-4970-909b-1d07988c3b57", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773035092, "uuid": "daf6d31f-f941-4de6-9fbe-dd6d127ed43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035092, "uuid": "b2fffc5e-64d7-449e-8650-692dcba99170", "value": "sppc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d257dc3-1c0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773098800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098800, "uuid": "d95f78b7-08a9-4d6e-9d13-240e9821f69a", "comment": "Malware payload", "value": "b228d3a1d63d39ed2bbaad9bd7878cca", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098800, "uuid": "4818c8ad-8ebc-470a-a057-b8d824e248e3", "comment": "Malware payload", "value": "4fd7597ccd0afa04f322856639eef4354b8b40d8b539cf66c47d664142b7aede", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098800, "uuid": "69f76336-6778-4f17-ac1a-30d77c57b53b", "comment": "Malware payload", "value": "116cd8d1fc5cc775bb5e87c2a2a84a34acdb95cb", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098800, "uuid": "18dbb928-3d4d-4920-be9a-9840c41fac14", "comment": "Malware payload", "value": "2279a8af6c59813bdae48d0694518f83269ad19e02f545c306862a97e15acfc156cba1395e050301049e29d3806587c7", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098800, "uuid": "61da769c-f6b9-43d1-9967-040dc2ed1686", "value": "T1B0F68C1AE2E414A1D027C2388515C233DA7A7C938B75818F359CE7CA1F77A916FBBB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098800, "uuid": "e921bd46-2d70-4d0b-b9b1-35e8fd08fd7d", "value": "393216:7qu9n0adaip68eIao7/gzsiNcVJfixoa5RVMAmRzanD88h:p6hx0RzkD7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098800, "uuid": "7cd48819-f3a7-4ae9-8f61-8554d7b0202e", "value": 15519744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098800, "uuid": "e3bd8320-9e64-4ddc-8b24-deb943158595", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098800, "uuid": "d57ccb4a-a5aa-4af3-b324-cff929d04c69", "value": "1907 sz\u00e1m\u00fa megrendel\u00e9s.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3e294a-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773054319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054319, "uuid": "0e346d3e-715f-4c29-9cde-0b066d570e39", "comment": "Malware payload (ChromElevator)", "value": "48eaed01fee202508d9cac0d7d9a4d4d", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054319, "uuid": "94154ef5-c0f8-4b58-93ce-addcc18f9a5d", "comment": "Malware payload (ChromElevator)", "value": "52825dbf3fc28b9f7c3a24adf78d3425ac714e975769f4d70e8c718ddcbb9856", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054319, "uuid": "e670476f-3872-40a8-a24e-4c13b4f9c106", "comment": "Malware payload (ChromElevator)", "value": "900280370d2bb2ca41f70f215781128c4865891d", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054319, "uuid": "d04c3506-9919-4f8d-b1da-332e1b3b0236", "comment": "Malware payload (ChromElevator)", "value": "162f55cbdffaec1cb3539f50bf330b155a5d1d9229f1312ecca122966cc3025d366f2905a422b215f211609e35417382", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054319, "uuid": "93b69ee5-25cd-45c6-a13f-a5a8f994389d", "value": "T1BED5E11BE36401FCD0B3C2B5CE429617EBB2B8491270969F5BD18E962F23B715A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054319, "uuid": "1ca141be-5901-432c-90dd-3e1f9a61aff9", "value": "3f311bdc866216f8b8a0fef917dbd17d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054319, "uuid": "bd4f520c-efe7-47c9-8ecf-5c7937d95287", "value": "49152:kjbEwo7Ne2sPSTto2qvjQsMOqu6n0h7lzxVZXYT3FpGRBBxnSe:ksf7sPnUsM5Eld/ojFpGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054319, "uuid": "3c9aef2c-eb61-4462-bfa5-5d704549d0b7", "value": 2800640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054319, "uuid": "bbb360f9-5a60-4985-8786-27fc30ed0413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054319, "uuid": "efe719e0-4c8c-490d-8aed-c5fccc682c2c", "value": "52825dbf3fc28b9f7c3a24adf78d3425ac714e975769f4d70e8c718ddcbb9856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19f2f34-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773046946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046946, "uuid": "d98db67a-cde2-48b0-861a-2536c145a6fb", "comment": "Malware payload (GuLoader)", "value": "ab096830d311b98514250bbabd89e949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046946, "uuid": "0fb6a7b4-ec57-4c54-a163-b4e4df5d7604", "comment": "Malware payload (GuLoader)", "value": "5421d0e8b30d3e120b81f571badf3b6ee7352bc87bbe40367698065dcb8ad8c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046946, "uuid": "d636a953-d213-47e6-9d1b-f4733b5f2c4e", "comment": "Malware payload (GuLoader)", "value": "43f6e5c064ff7dbfc3c20078cac4521e7537bdb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046946, "uuid": "2a55b2b7-e73b-4090-9f2e-659734946964", "comment": "Malware payload (GuLoader)", "value": "2664783072c13b0b7ebeb54f43d9c5368c127b409fec59b334d3c6fbda401be7e68f344e4ef924374fc4652c4eb44ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046946, "uuid": "8736c03b-327d-4185-a5f0-85896282608b", "value": "T1E33533765F55C52FDD053B78037ADBEA7EA3AB60024D218703D05DA32EB264AC60D4EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046946, "uuid": "6569a62c-0b26-4af9-b800-3a12baadd983", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046946, "uuid": "c0b21c47-4afa-40cb-8ec3-a71137013338", "value": "24576:yfm/UmHl9jOu5SR2K1KuN5UE8w4a7ey57F7k:3llOF1bkXwBX57i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046946, "uuid": "1b87c6b3-0b6c-4cfa-b4b0-088d230f1e6d", "value": 1111128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046946, "uuid": "dd536e09-e99a-4da2-ad62-f6696704cd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046946, "uuid": "a000ab0a-4a01-44a7-8b87-27b0c4694b37", "value": "0301026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e5d49-1bf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773089301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089301, "uuid": "33aff087-838e-4bec-b14a-4369f81738e2", "comment": "Malware payload", "value": "bc0da3d0f33547eae4c4ebbb32ae17f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089301, "uuid": "16470686-e71a-442b-8ef7-056244166285", "comment": "Malware payload", "value": "557424224d453bd1ced9504ea97a8deacc6714e44709b1552db5f901a0e27280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089301, "uuid": "da11dcdb-a1cb-4a7e-9ab7-876fc3369071", "comment": "Malware payload", "value": "cbda10d7ffda688ee885c64cde767c90e13946c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773089301, "uuid": "cdaf94ab-d981-45cb-bbc8-80536c16acb6", "comment": "Malware payload", "value": "3e010661d5e816b8e6f2d1b86eea1868473eadfe0755a53602adad86b09fac1e3260be5ad4fd6262a729376693f39770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089301, "uuid": "39902f4b-8040-4768-9f9f-ed17dc781f95", "value": "T1AF952947BC9104A5C5AAD2318AA64252BB71BC950F3163D33F60F3B82F73BE46A76354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089301, "uuid": "837c2e11-0569-43c6-bb87-1eabc938b4b6", "value": "49152:m7MBZscUkzB8wYlrb/TIvO90d7HjmAFd4A64nsfJ3x0GoxtFYMg4F1py59ZsKD1:CPx09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773089301, "uuid": "419621e9-0bbb-4e65-b54f-47c7da4ad575", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773089301, "uuid": "3fc56012-3c87-4101-b3f6-8ae1434f2a57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773089301, "uuid": "5429f33e-b46e-4403-8376-1c855db4346a", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a513fbf0-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773077849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077849, "uuid": "11b71fec-371a-4d21-9865-9666f32b5bbb", "comment": "Malware payload", "value": "d29f17c088574f3f04cd28ee0e512f78", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077849, "uuid": "fe8eb440-e057-4112-a55a-50a34a0b73c7", "comment": "Malware payload", "value": "56b5427bc5b26f50ad2cbef7f1f94723222c86a38c58a2be65e80182e109f190", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077849, "uuid": "073bf168-26cf-4c50-87e8-d65abd28b71a", "comment": "Malware payload", "value": "651a24be69e30dfab043bbf70b0d56e0d19a3faf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077849, "uuid": "bbaae043-fd15-4ba9-bdb2-0744736dbca5", "comment": "Malware payload", "value": "d84a5b93ee4e7cbf508247da6f1a4b0c33f7dd2272a3782dbcccb4a9e8c15a688b0731f112ee76ddedb86f6f5c17aa77", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077849, "uuid": "4d118443-5f7c-43cd-bc30-7a3290006ea6", "value": "T12B41317BD60F0FE329A05AE2E1025DCEEFA9023131A204D47B08D86E262D87DCF756D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077849, "uuid": "3f8ea80f-66e6-430e-9584-e9522453e598", "value": "48:E6C8mXllShJSo7lwjKNlIWjhR/jLtjfjZWIHpBEeM5zxAl5Ob8AMtkH4az0:TC8eXSPSAAKNmehh9b9HpBozO0b8AMtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077849, "uuid": "27d0890a-7912-4ff3-acd7-12d73f1165fc", "value": 2259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077849, "uuid": "28aea0de-f69e-4a50-80f9-902a1295264a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077849, "uuid": "2b577275-eff9-4b1f-baf2-cfb9d8a82fe0", "value": "Service_Agreement_v4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0997cf-1bc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773066455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066455, "uuid": "defaaf97-e9b7-4817-90df-37d3311de5df", "comment": "Malware payload (Vidar)", "value": "b9007e7e51f21617a383cc473bd0c118", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066455, "uuid": "5d4e6bbc-7003-45a6-888e-e7b46752db7f", "comment": "Malware payload (Vidar)", "value": "57664d87ff56fdb304b8bb7ac57a6710c09ac8847adfd4e29f40435c0c5995b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066455, "uuid": "797bffea-5c39-4315-863e-bbd2443fe105", "comment": "Malware payload (Vidar)", "value": "c6ec87b5f21ed792dd113da0d3857561bcf06c5b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066455, "uuid": "b709f7d2-3c53-4fb4-8a7f-c1ac73ac2c2a", "comment": "Malware payload (Vidar)", "value": "5d28d260c5a4035379f01a17e51897c4b15299058dab665c3155f9176fe0a00447e596b14911d269125c37895781f4cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066455, "uuid": "20f575a0-b418-420b-97a2-f5e1d0a505dc", "value": "T11AC6F56BA2A48169C159813BC0AE8E47A4FFF175C733F3E3028D17588E129C55D3BA79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066455, "uuid": "02fc38ff-b405-4242-b9ef-3c6e3d222e34", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066455, "uuid": "779a79a5-5e4f-40d6-8d33-99d6cf7b65e6", "value": "49152:DX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNVcXCBz+CO/:CzCoeoT7tBNjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773066455, "uuid": "5e95d701-623d-4c4f-b5fa-eab4fbb7515a", "value": 11852800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773066455, "uuid": "51b12b8f-f969-40bc-98b1-a4904a39f5e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066455, "uuid": "87cae27a-2abe-4553-89a1-8f3911fb6d26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c18b925-1b80-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773037300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037300, "uuid": "6f35e95e-4a3d-4a72-8811-34c453f087e4", "comment": "Malware payload (SmartLoader)", "value": "32f97b5a1891cd88629caab0df0c90dd", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037300, "uuid": "7adde2a5-db5c-457f-91c7-1d4bb5fce649", "comment": "Malware payload (SmartLoader)", "value": "59713850f6070b1ca9183949d619152a577f2b8ed9fa34b781a22fc24e18ff7f", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037300, "uuid": "d6e6286a-689e-4213-81e7-bb2e4c3dec04", "comment": "Malware payload (SmartLoader)", "value": "2e7daa785295eb3322b088b5ddfb3652d225ae8d", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037300, "uuid": "e33a77d0-a94c-4ebf-a26f-66c516e973d6", "comment": "Malware payload (SmartLoader)", "value": "b20fb4931c6893a78bee613eddc6ac03a776324f74bf2efe2290f8e615e77eca7790984eb340713fb41123811a1baf7a", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037300, "uuid": "65a35434-6862-445d-ab58-d567220c2acf", "value": "T1C2B423F193429E0B23A4DAB457A3DB3375CE7292769D9311CA06CA9F4C7072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037300, "uuid": "405f359f-eb71-48e4-ade2-117714f59eef", "value": "12288:+kmht7DrvdyiaCCH1oHF9nJ/qjuyVgoJrrzTPwkc:+kmHzM7H1ELnKVgoJnnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037300, "uuid": "3ae7395e-4127-4079-ac32-204416d4107e", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037300, "uuid": "20f6f638-fd60-42fa-88c3-ee76ca268f5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037300, "uuid": "5e629c20-1be0-4b9a-96b6-b183aa3ef8c9", "value": "set_Bloodline_jump_height_cheat_mod_3.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5668f06-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053905, "uuid": "a755da5f-ed71-4031-b580-9f9ae888cec0", "comment": "Malware payload", "value": "25b835c679f3770b00cc9bc252bd4b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053905, "uuid": "e130dbc8-196b-43e5-96bb-e785b75d5e96", "comment": "Malware payload", "value": "5b61e3887c8b437b8e35b52ec4512c58b3ce0b44505310afa62b6bcb7c7a22fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053905, "uuid": "41ed211e-be67-4de8-a8ee-c64efd5cb604", "comment": "Malware payload", "value": "9b61372d55f684ac826475f9ecab1f49a0c195b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053905, "uuid": "fadcca02-4ec2-4737-a56a-f7bd75c89920", "comment": "Malware payload", "value": "610bced3a6a409be81c3296f90737e0a8f6189cb42adc7fe956a5834c4acd48bd1095aa35db3d286b4274333ad541095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053905, "uuid": "73c75e25-af05-40c8-8b9a-2bcafcbe601d", "value": "T14AC41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053905, "uuid": "aab92a6b-2099-457a-a97f-ad41ceb0086d", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053905, "uuid": "4101fc08-61ab-4323-a697-8f8043787770", "value": "12288:LcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:LcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053905, "uuid": "ea1dc357-d80f-4107-8e26-077dbc58130c", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053905, "uuid": "e275fbeb-83b3-40fe-9f0d-edd9ee8ca637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053905, "uuid": "3d331dba-50d4-4f0d-ba8d-b1f0c4187175", "value": "5b61e3887c8b437b8e35b52ec4512c58b3ce0b44505310afa62b6bcb7c7a22fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f79028-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1773038904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038904, "uuid": "7ce385a3-9a08-40e9-bcf9-b3465540db16", "comment": "Malware payload (NirCmd)", "value": "8d0e5dae3fdf596032aa80a94d7fc11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038904, "uuid": "28711348-c8bf-48b6-b9f7-704f3902ab33", "comment": "Malware payload (NirCmd)", "value": "5c5fb2eb0945683a875a37f7f4ceecbec92ce446bd615e0a007ca5ca96537d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038904, "uuid": "51c1e272-caef-47f3-af11-e4f059a8e4de", "comment": "Malware payload (NirCmd)", "value": "ee3fa3f536fc4c47d3187a0534abc4e267a0864e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038904, "uuid": "1fb9d421-de88-4280-89bb-72677f0658ba", "comment": "Malware payload (NirCmd)", "value": "8c1aeb940ad627e49520e46d09417e5e4f142c21c96238e3631fd1b13eb0a2f064818e0dd2df3ac9e4a715b7a2a12a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038904, "uuid": "1404d30d-0644-4e08-aac9-337b32cfe2be", "value": "T1EDA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038904, "uuid": "ceaabe48-b345-4b52-b206-1ea950c2f248", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038904, "uuid": "ce544db0-f515-4de8-b76c-070f30b86751", "value": "49152:ABRcTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aSTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038904, "uuid": "078ada6a-46b9-4db1-b6ff-1965a16492c1", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038904, "uuid": "890e9189-c318-4e05-8bac-2818a1540d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038904, "uuid": "36dc50a2-ac67-40ff-bce0-bd1be8fe47cc", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeedd9a-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037112, "uuid": "50bfadef-f709-44eb-acf8-2ff5b3b3f257", "comment": "Malware payload (Mirai)", "value": "737498c8f8250b10788710597e5693af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037112, "uuid": "5a21b805-4eff-4b00-935f-61f9f09af12b", "comment": "Malware payload (Mirai)", "value": "5ef23391d205ea6c2242bd439b673adaae6afc7e9787bbdee496c90418219d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037112, "uuid": "eb5c9436-e9b2-4513-94c0-94d6c2bc0440", "comment": "Malware payload (Mirai)", "value": "2379eeabc12676e045469af73c6b4eca454b3d79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037112, "uuid": "2504302a-7b30-47af-ab9e-153599584266", "comment": "Malware payload (Mirai)", "value": "f46e280e24a6419c9ef27acbfa64865dda269e7b22d7b0deb432a88a63385dacd0fd5cc0371c71b3586caa128487b7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037112, "uuid": "341a6349-2e9e-4136-b3ba-7c7221411a0f", "value": "T16493C706FF118FB7C86FDD7305AD8A1128CDB89725A5373A7170DAACBA5618708D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037112, "uuid": "d3d0f3fa-a3de-4c0d-ae8c-3b42171f981f", "value": "1536:u//U62k+PpE1UxdYVOPZhesr6Vx55gYOEnOHYN8JBk:uUHXX/axsDY2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037112, "uuid": "c6e2eb47-934c-4d18-96e8-7274f13c1b2d", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037112, "uuid": "499fa77a-2380-4968-bcba-dea2f1e14727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037112, "uuid": "8756ce68-761a-4711-9420-1484c2eaf5fd", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1c18aa-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053914, "uuid": "7a86e7d3-c859-4e7d-b4c9-f6a818df7f57", "comment": "Malware payload", "value": "bf5cd8e1298f68114f2080854f1a01dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053914, "uuid": "007a63cc-835f-47dc-8f3b-3e19036fe0a6", "comment": "Malware payload", "value": "5ef521c9e72d6eb58337d4237dbdad9cae948dec5b31edd8aa042d4e5e8453cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053914, "uuid": "ea0dd701-584f-422b-ba3c-1db8a548698e", "comment": "Malware payload", "value": "811fe51a6ba26304190bd8985d2dd7b2b9cbd8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053914, "uuid": "cf4e742b-86b5-4a84-a413-95d71600ff60", "comment": "Malware payload", "value": "2cded9f5e36c47387ac8a42a3aebbe3205e32d83628398c5f56d3204a4db20050771d40b1f51eeaab96e0305eb600567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053914, "uuid": "160b3dba-f3d2-4fe4-b507-415d9bafc9cf", "value": "T14BC41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053914, "uuid": "0c249d46-1f31-4b88-a1e9-bf9c5e702b71", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053914, "uuid": "1855207c-e1c5-41e2-94c3-384d82a63e03", "value": "12288:4cVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:4cVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053914, "uuid": "23f3be15-afd4-43c3-bdad-3232431bce20", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053914, "uuid": "8118ff41-ef80-410f-b6b0-73d4d982eedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053914, "uuid": "1eaaca4c-9a02-4a23-80c8-19c4bf185412", "value": "5ef521c9e72d6eb58337d4237dbdad9cae948dec5b31edd8aa042d4e5e8453cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d210cca-1bc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773068225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068225, "uuid": "6b84fe83-2e91-42c9-9aa5-1560f7dba1f9", "comment": "Malware payload", "value": "126e1be64a3fb6e27355bdb427e72bfa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068225, "uuid": "bd1c158c-f9a9-44a5-8afb-1ae23d5f4d58", "comment": "Malware payload", "value": "5f21a32f226330f7bc3b61b7540e7352697c5448f52beaa9ce7a16246db0bee5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068225, "uuid": "e648e70e-ca34-4a9a-9358-264cb5a6039b", "comment": "Malware payload", "value": "53dcae4ab0a99253078138033f17f9bd43f0a1e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068225, "uuid": "6da4f8da-b320-4436-9a92-4698e8352173", "comment": "Malware payload", "value": "0317a7569b921d142cc6d2c508c0d640869b7987954d7c833e152040995d2db0a9d87bf5ca283a191d3c714d42524a26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068225, "uuid": "94479d8a-4e7b-4943-a86f-a8c6402bc136", "value": "T1F3925DB512896C79FBD1CE399F3C6F4DADE8C2C42124A3ACBA0F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068225, "uuid": "85ee8936-8331-4a7a-8ea4-8d3b6a145eea", "value": "384:KFcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:KF8i+BL0SI0FzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068225, "uuid": "cba71104-4054-4ead-ab93-b860403ec5d9", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068225, "uuid": "dc5a7aac-d260-4cc6-afb7-850ac4438ceb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068225, "uuid": "7a0a101d-a406-49b3-873c-c86b50361dfb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f16ea3-1b91-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773044690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044690, "uuid": "ecf51908-f947-4306-be7a-f2499fee7759", "comment": "Malware payload (Phorpiex)", "value": "b897adb282c73be96cf9be4b4d92b24e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044690, "uuid": "49ca2178-c911-425a-b2a0-f575ebb63849", "comment": "Malware payload (Phorpiex)", "value": "62912d57d1863bfc672fb26ed3954b937ea83661ab8ae7ac4db4131ea8347000", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044690, "uuid": "9878007e-c8b2-49b5-9efe-242a6baa24b8", "comment": "Malware payload (Phorpiex)", "value": "ce4e9f045b0ebb1afebfc885e44ebd0efd3997f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044690, "uuid": "74e1e8d2-bfe9-454a-bec5-b45ea50ffbb2", "comment": "Malware payload (Phorpiex)", "value": "5402487fd3478ac88f207aec7a930b3f93d898c332871e662648f7dc2b9c2d9e18e2033cf263420ac0cd28376e011cb1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044690, "uuid": "c46905a3-4960-4cc2-86d0-38889fb4c9fc", "value": "T1B5A20805AA56534AF8B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044690, "uuid": "e5bb5269-4873-4f19-ac92-628b1d05c102", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044690, "uuid": "e38ce3b7-d268-44f1-886e-c8459e93eef2", "value": "384:du1OuPf4/SdfUTQFYhJ4JVB0Ws9UnwnR:dNuPf4/AUTqY+xs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773044690, "uuid": "1aa9156e-5f2f-4022-a921-9073f4a1f8d6", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773044690, "uuid": "7c2d7c75-241b-4d62-b9ae-6a0e130b2921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044690, "uuid": "407f4aeb-f91e-4b65-bb7e-9c66dc06fb4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902969c3-1b97-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773047319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047319, "uuid": "d9b7d00a-3f9a-4a94-84a4-1853ba9fd95d", "comment": "Malware payload (ValleyRAT)", "value": "4dcb274be7e9b1d7122d525f105223ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047319, "uuid": "122d2147-2e39-4f8c-a3b8-9a60f7f1136a", "comment": "Malware payload (ValleyRAT)", "value": "62c3577e51debc95e1ef9f56eb7bcbaf052dddaf325fefb9f7004d9f9c0d02f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047319, "uuid": "e193c4b8-ef7b-437b-8979-3602d36b00d7", "comment": "Malware payload (ValleyRAT)", "value": "39baaea37f67d8b2ccc54743946e6efd85aa1c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047319, "uuid": "03c67730-e692-4f0a-ba31-ab0b07930739", "comment": "Malware payload (ValleyRAT)", "value": "cf0ac83f02f5648cf8f2fe41b56c99c13806c22b94299d9ea99080d451d397f908303364d151dab7279d6675677e2395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047319, "uuid": "b865dc0b-6aa6-4cfa-b187-48fe66bc08d9", "value": "T1F6C533918E654DEECB6C837AA02B2B3F63916F9A440CF1F7565458E33A5BE00058EE25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047319, "uuid": "35ac41e1-0769-403d-9d62-9c7383af91c8", "value": "6f5233a1c13a0b93e9ae102bb57391c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047319, "uuid": "ea71c192-596c-4e42-b51f-7fd3c792fdae", "value": "24576:aWwCL1zS6DAhLohYOg3EbIbTKySeRxmpsIvtzXCUAbe/bd+0mGTswTie1VrUlADT:zAtMzs5eQeH61ajiAsoy4bxtLIJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773047319, "uuid": "d11d937e-e1f2-4981-a2a5-9617ce11a866", "value": 2628608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773047319, "uuid": "4516d646-9eb8-4d96-80c7-ce06f265f5be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047319, "uuid": "9be6dd5e-acf3-4d50-bd39-fb44e783b1bd", "value": "62c3577e51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d524615-1be7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773081647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081647, "uuid": "89597605-2d61-4e39-973a-30a488f7f780", "comment": "Malware payload", "value": "8d9cab586c1823b6bf09ed87fee9fae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081647, "uuid": "4fc9607e-86e2-479f-b938-e7c00a54d261", "comment": "Malware payload", "value": "63583905cb4ede51ba6d555fc2e68a94adc2a5076507fe634c0cc2696083d9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081647, "uuid": "b4ecac01-8aae-415c-9a64-13ec41a9a200", "comment": "Malware payload", "value": "c823f46cb7ba2bcfd8d5b74cbab31c67dd451d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773081647, "uuid": "4b64fb91-0b79-43dd-88bb-37b7062969f4", "comment": "Malware payload", "value": "fb03ed906ae6e9ea97781194cac2e3d748e8504ea48425ae3c559a7a831945fb746f05ba4c248a9f6339d209aa8f287b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081647, "uuid": "3b20348b-114c-4dd9-b680-3c035ee71bd6", "value": "T149B29E8A6E33BCFD11B3B464CFCD11A2EC0622654EA650695C4FF7214A1DBD21E325DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081647, "uuid": "247b48b0-5efd-4f3a-9f0b-530c52122be5", "value": "384:984c8Ik87/RN6KlXh/jWsXtStAHD1U7ePN0X/aQYqWhGq6ab8b5gfSWR2BEieJPZ:I8y/b6k/jWs9S+Hu8N0X6Gqo9gfSWR22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773081647, "uuid": "95ea431c-2882-431f-b308-540704ed08e2", "value": 24264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773081647, "uuid": "bfe30cbd-c12f-4bf8-a540-c2c3a9648358", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773081647, "uuid": "f4551a27-0d14-4dcd-af5d-ec3223c286fd", "value": "NEWPAYLOAD MAIN - Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d36c2-1bac-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773056280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056280, "uuid": "93795aed-b3d2-413c-9097-e61ae37510b6", "comment": "Malware payload (MassLogger)", "value": "2d05743d427b07374cc11f35efc84e44", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056280, "uuid": "5dec77a6-0f76-4ee7-9325-7d1112a8f124", "comment": "Malware payload (MassLogger)", "value": "63a108485dc2d657dbc9065711b1901f7ff7975321eae9fbfe2305b9fb5c721f", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056280, "uuid": "dc15c21a-c075-45fd-88b1-f6ea7b3864e3", "comment": "Malware payload (MassLogger)", "value": "9d5ba0bed79acaee202d8d5d812052a7275aae22", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056280, "uuid": "aec53657-69c2-421d-9bdc-e9dc3f7e008e", "comment": "Malware payload (MassLogger)", "value": "8421531b631c745eee9766655f7c179fbffae49a4b1fd087434a773d19f1ccb979ef0cf9efd9209c014ad27261755d2f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056280, "uuid": "d57b99ed-d084-4c73-905b-560b9b0b955e", "value": "T1E3358AA50F80EAAF6F4817AFA002119FEE025023D397D79015CFBE94C7BD766FA55908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056280, "uuid": "a67a41c9-d32e-49a2-ad16-99b754e127f2", "value": "48:zggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggd:BzhGotpVOCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773056280, "uuid": "12f34649-9905-4a44-aa0c-d89a672b17e1", "value": 1099208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773056280, "uuid": "cd64a569-7f73-4c28-b042-fd15a1fbb629", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056280, "uuid": "42eee1d4-b858-4d1d-9c17-fa99a94a28af", "value": "776mb664732y.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f525ef18-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098599, "uuid": "bb322b91-b913-462b-9de2-165016316428", "comment": "Malware payload (Mirai)", "value": "7e503758ef2d439bc092cf2e77d716d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098599, "uuid": "a47b1c82-d22b-402f-9ca9-8484b3c1a9ac", "comment": "Malware payload (Mirai)", "value": "63fa817916073120ea25a9801b4cdb9044c5c907e5527c2653c4fba6e8ca9009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098599, "uuid": "12727569-d8f8-476f-8125-822d09ecfe2a", "comment": "Malware payload (Mirai)", "value": "631dca057820f2cb9530111ceb4d62d22e443003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098599, "uuid": "359fcd7a-b6fa-40f3-9ccd-249fccd3c55c", "comment": "Malware payload (Mirai)", "value": "544da8d6bff17170b41a2c9d8f71040e2b7a929788db52dc9611cd2818e775e1ecb90e19c0817abdcb57808fe51fad18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098599, "uuid": "619a18f9-e908-437d-8d45-22f63201bb34", "value": "T12A344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098599, "uuid": "c254a841-c8eb-4213-bc8e-e00240fe9bcf", "value": "6144:W8tTPAMOBzabKacEK1dAnJd7iLfdfM/9hWfAU:W8RA9BzabKacE62JEp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098599, "uuid": "dcc87ae3-e3c4-4c7b-a423-14a705744eb5", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098599, "uuid": "fd9304ab-e851-466d-b037-10fc2e19a237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098599, "uuid": "fd87a9ab-ac6b-4452-9b0a-495b63f03145", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eb876c-1bb9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773061870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061870, "uuid": "0f056911-a0d4-4c98-8cb7-24dfd2943876", "comment": "Malware payload (AsyncRAT)", "value": "cdc7b418e431365b895f221a9765e4d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061870, "uuid": "4aec2fc1-97cc-4bd0-bce6-2adbbae58d08", "comment": "Malware payload (AsyncRAT)", "value": "654eb29dae0b3c0f992bd324f787628ab97557d875db96f16f7b60590847b02f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061870, "uuid": "4d2897d9-ba4a-4318-977b-02e828831635", "comment": "Malware payload (AsyncRAT)", "value": "31b2d69e6919580c0c8c4e4ea5e63fb5d9b6694c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061870, "uuid": "ac22c38c-636f-481a-9c4c-4cb0a3abdc26", "comment": "Malware payload (AsyncRAT)", "value": "a89d39e760a1492196f33fef84ff5eea5ac8accf30e65878be1d703fd14525df995c55e41e416170e860494cdb84ff75", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061870, "uuid": "5b89bc22-8960-4b6a-b47f-b4afe617a28d", "value": "T1C7033A08B7F84965F2FE9B7D8D7282005335FA579D22C79E1EC4508F5A63788CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061870, "uuid": "18b91c01-bcf6-49f7-8c1e-834e32c3d4e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061870, "uuid": "b7df02b5-9d05-4df4-835b-87b13ec1fef5", "value": "768:JnCIcEJbMSVnbTpwFRbJpB+WWP7LI1lj+:JCl6bMAnb9wFRbR+dClj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773061870, "uuid": "224aa76e-4c8f-45d6-b197-2de81122a46d", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773061870, "uuid": "73635d29-beca-4b8a-92f5-f845752fca79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061870, "uuid": "21e7fb1d-671f-4659-b189-0e817e058632", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71085d1c-1c10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773099236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773099236, "uuid": "e39604d8-faff-4368-907f-762ba00ca17b", "comment": "Malware payload", "value": "bc980a35a196a014d52e4a9f78052943", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773099236, "uuid": "677292cf-0c34-473c-b62d-a9c48826221e", "comment": "Malware payload", "value": "65c24fd1ab05a16cc72163bb0877275f2cd7cb2eb70eb6f71d69c5f9b1367f68", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773099236, "uuid": "7e637174-667f-4c6d-878a-8fd59fe30ebf", "comment": "Malware payload", "value": "774697577b0198d3d59d5a9e85b40b99fad30add", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773099236, "uuid": "47b20093-4ca7-4766-bf32-4b3ab79f9701", "comment": "Malware payload", "value": "be97473a12d58012853a7a1fa64199d1441667aa5c4abdc0d3109cb3c3fc14a9265c162196976c18e5d17ec3d7dd8d72", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773099236, "uuid": "86bf4769-68ed-48f5-b26e-ae42fac4b26d", "value": "T164B68C15A3A805A5D467C638C656D233E5B57CA28B3582CF0699F38A1F73AE18F3F710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773099236, "uuid": "9ee09afc-de78-452b-840a-8723f9066f07", "value": "196608:4b3ycjijk2MD+n71wsn24PDEPw3u2tjIVS25Grf2eLB:k3yf7MCRwQQIXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773099236, "uuid": "3b66678b-4860-4d0d-8bef-9cb5f51e24c6", "value": 10618880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773099236, "uuid": "cd5f24c4-9792-4234-b912-154d8d369070", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773099236, "uuid": "77fed388-c422-49b0-972c-24904a935e7d", "value": "Szkennelt_fot\u00f3_2026011808.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e21721-1b97-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773047404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047404, "uuid": "3d344193-7c46-4306-a2fe-ec5a9ea1759b", "comment": "Malware payload (ValleyRAT)", "value": "18b7a4caf64d77da31363be1dd38d6f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047404, "uuid": "d9e7fad4-04dd-46ca-ad43-fb2e266398d2", "comment": "Malware payload (ValleyRAT)", "value": "663c0d6458515a159bf2157038e757bd67c73a3cc250454022cb3d9899d68407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047404, "uuid": "663d163b-0958-469f-b3e3-9adc0d21c184", "comment": "Malware payload (ValleyRAT)", "value": "0cd48ec1a9dc76c1714a31983ce41c1458ff28d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047404, "uuid": "85cefaa8-98f8-4611-a38d-c551b4657f63", "comment": "Malware payload (ValleyRAT)", "value": "1f3e20f0842dd35729d56cec1d2ccf3edcb9a7f2fcd818b96a33548e50064128bca78333814bae2b44c753857bc93916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047404, "uuid": "13cdfb19-de52-4163-9883-d94a9f27190b", "value": "T17EC53320DEB96DEBC9BC823C50AF1A5B47813ECC4115B2FA57746263385BF84582F86D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047404, "uuid": "cf0bb6fd-6062-4261-bec2-bfea6ce98a50", "value": "6f5233a1c13a0b93e9ae102bb57391c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047404, "uuid": "519454f2-5dd2-4277-8f24-4e4305ed0c7d", "value": "49152:7Fk2kAv/grjwP2cJu2TwMmSCbUPcnqko7:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773047404, "uuid": "785f5552-9a18-4681-94c1-ba9e314699e1", "value": 2628608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773047404, "uuid": "094a9f52-c1b4-4806-965e-fc7a95b5f5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047404, "uuid": "b5fe888b-83dc-49c1-b5c9-474d381a4e4c", "value": "663c0d6458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea726ac-1b98-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773047639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047639, "uuid": "d4c93125-4d3e-4d90-b2fe-b9a47a0753fb", "comment": "Malware payload (AsyncRAT)", "value": "cb4804e8d74c298f406c1940499f71b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047639, "uuid": "a20bc667-7ee9-4397-9800-228e9829cfc7", "comment": "Malware payload (AsyncRAT)", "value": "665c5e458cefeb7395243c3cdabbadc57b84d78ab4b411969677ab54c8a88fcd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047639, "uuid": "c937a147-92e3-4f71-a742-20698fbf6047", "comment": "Malware payload (AsyncRAT)", "value": "df7210306516f040adbd0a32bd8534586db65d2d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047639, "uuid": "24d614de-2bc8-496d-8d18-5ed18dd7df86", "comment": "Malware payload (AsyncRAT)", "value": "6cfc3798a91188961480d8962d9d882e1577a60f742fdba0cc9749e278834e0cd5e0b2effdbbeb8a604d9ae9c7fa355d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047639, "uuid": "1bb754e3-7d2a-4ced-b508-175fbfa66d48", "value": "T1C3034A18B7F84964F2FE5B7D8DB582004335FA539D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047639, "uuid": "997c01cc-1c70-4892-a44a-148ed03330ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047639, "uuid": "9f8d4b6f-9c39-413c-ab13-548b6c0b90a0", "value": "768:2nCIcE5kt1JbTpwFRbJpB+WWP7LL1pj+:2Clek7Jb9wFRbR+d9pj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773047639, "uuid": "77ea1050-d9b2-4cc7-85e5-8973ee603f6e", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773047639, "uuid": "0a83236f-7022-4b77-8b42-3fe2e0d97287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047639, "uuid": "e2957583-e53d-4827-a819-6df34becbcff", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5342998-1b9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773049529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049529, "uuid": "39991580-e8e6-42dd-951f-4357586491f1", "comment": "Malware payload (Phorpiex)", "value": "a23490bb1e51bed2dc8880198e9405c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049529, "uuid": "6c4c9aac-0409-423f-862c-53d00687847c", "comment": "Malware payload (Phorpiex)", "value": "67a05c8eecd305912724a41549b45bc6e74a8c16013d0784217abdbd79e0f6f2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049529, "uuid": "4183fc68-d997-4f1b-8d5c-c6aa711c3667", "comment": "Malware payload (Phorpiex)", "value": "7d14ebb6c1ee575706bff6d4e0e17f2fca63629e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049529, "uuid": "d0edf1cf-9dfd-498c-a971-1011f12aa224", "comment": "Malware payload (Phorpiex)", "value": "13d73d0181416b3dfee609302288453c72698c52f8bbba6c91d35ebc0a01e76df79941bdfcb8d69177c8ea5f520b8515", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049529, "uuid": "9b8671e1-8083-4bfc-840a-065e78327005", "value": "T137322A0A680A5831E3E204B2177EC29797BD19A333D5F9CBB380AB4D0E753D5C07966E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049529, "uuid": "60720165-2ab9-4e36-853e-9719506e4931", "value": "27080eab3ded4a4cce0697f22f2df921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049529, "uuid": "8bf42e1e-776d-4121-979a-8322bec84fca", "value": "192:y+xeU9R0WX8IUBee+Oz3bJxTNerBthIj:fxTR0IUAqzrBerBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049529, "uuid": "45120504-2505-452d-991f-8f254351cf5f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049529, "uuid": "90581548-6e6a-4dbf-8302-e610b6de8ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049529, "uuid": "ad157525-52ed-4faa-8e55-450f1e484e98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e46b2e-1bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1773064059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064059, "uuid": "23099d32-bf59-4916-994a-31003d5444ee", "comment": "Malware payload (N-able)", "value": "add33c03850308247d55f35592f9e050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064059, "uuid": "bb88be33-011c-44f9-a92e-c3afe1fcfbbe", "comment": "Malware payload (N-able)", "value": "6811c0d8596a0b2f13b780fb42a184b337f1b7e92ac6821d0cc87712afa3a133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064059, "uuid": "817daf23-1513-40c7-9b9d-80aabe5c5691", "comment": "Malware payload (N-able)", "value": "f7597606433bd22e1b26839969b406e413e67443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064059, "uuid": "04966603-cff0-4828-bd98-4c2bbede0f45", "comment": "Malware payload (N-able)", "value": "20952b4c93c40ca8ac6f278212b0253a7536165797a39d4bfcdd04e053a71e7ebc00a26504272d814baa9b3c5dde8331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064059, "uuid": "e9ab8dc9-5b63-46d9-b9fe-6c379c6499db", "value": "T1DCE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064059, "uuid": "1dfa78ad-13a2-4aea-bd12-636c1719b0e9", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064059, "uuid": "2e8e517b-c22b-452e-9e59-2c3730a6e203", "value": "393216:FLF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1h:brRxvoC/7a0jUxX7h1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064059, "uuid": "7b514d6e-44dd-42f7-a910-a3262eec69b1", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064059, "uuid": "9ac6ca5b-a309-4a03-b617-463aaa15987d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064059, "uuid": "e6dfd11e-b17f-40c2-b45b-bff736aa894c", "value": "ZoomInstaller.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1bd710-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773039154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039154, "uuid": "71431e3e-00b6-4715-ba64-0104827d3543", "comment": "Malware payload (GuLoader)", "value": "cd8333c58706deaef1368111f38f38ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039154, "uuid": "1fe7981e-4f64-45d8-aec1-fc82edb44755", "comment": "Malware payload (GuLoader)", "value": "68db7504dc6689ddfa6f5ca341c824f1f34dea654ad653153be12b0dc2c768ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039154, "uuid": "6072f811-9234-4d4f-bd12-2cfd2eef6fcb", "comment": "Malware payload (GuLoader)", "value": "e55cb2ec2a4e8680666cf3015f8a06faee945843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039154, "uuid": "ad7bdf51-d742-4dde-9b4e-e3416c4982e9", "comment": "Malware payload (GuLoader)", "value": "c83bbab0971499dcd4fd88301bb8d934840be6bcda2b6dad56c2edfd8923ef16bedcbb1f8ef4623131ead1dd1ff31cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039154, "uuid": "3dbdb68c-bbf1-41a2-be32-7c07a68d6081", "value": "T15AC4020537619C45D683D0309DA6AD6A9A99BC0CFCB49A733761BAFD3D35221F80F3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039154, "uuid": "7bdca317-17fc-46b0-ae6a-bdd733df388f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039154, "uuid": "214eec56-2b50-46df-8218-0923f98dcc54", "value": "12288:4MwNPjD7QHvdzs2T0zXY6zdtgQ+jSxI2Gcnc5ebAnWJNbD9I:4MwJa1oa0zo6zdt9emQckSAWvbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039154, "uuid": "39c9c20a-b6fe-454c-96d4-5c69931b271d", "value": 594429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039154, "uuid": "e13fd651-41e6-409c-9846-16f7944646c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039154, "uuid": "082f89d0-9def-4475-a783-0ed1bec0c7ac", "value": "Maersk Documents.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d69e7e-1b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042331, "uuid": "7acd6f11-e791-4ea2-8aab-85362f9aeab2", "comment": "Malware payload", "value": "67bfec82f77c78ecd562f19e2644ee00", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042331, "uuid": "904028ee-70d2-453c-aae1-121a505cd0d5", "comment": "Malware payload", "value": "69106a34c3a0d65299cc2468887e69357b2fe9adf66b563301499439688d0f64", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042331, "uuid": "ca78603a-ed0f-4c46-b919-bb59c0f68ad7", "comment": "Malware payload", "value": "fca50922b842654091a8bb46ac28c6d511a7f955", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042331, "uuid": "bda28bbd-6ec2-455f-9c86-c77a80d1f580", "comment": "Malware payload", "value": "3e5862a74f2afa323c75dc7653764ae83aa3ff7fe7778b078db61714ca86816cb1f7d244f094c8ae9ec7449e9e24895b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042331, "uuid": "ad39a0bb-6d52-48c8-b09e-dcac14caa3c9", "value": "T15045A98B5035F3AD1651159343AD6D8746F893801E4429CE23CCB9439C7EBEA85A2FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042331, "uuid": "bdfebce9-2e44-4dc7-8ead-960a6ba48783", "value": "384:J05NtIXjZgdSUVS7V0wn286qXkLAeDW39aBrmoHKJYfO9aF9oY95gagNUcYr2gkI:Lxng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042331, "uuid": "f55fabf3-30a2-4e37-9a3f-db911a630ff9", "value": 1259213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042331, "uuid": "af19b9fc-e122-4680-909c-78f953e41feb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042331, "uuid": "2788dd2e-8acb-4f30-891d-b407119bcd84", "value": "Ntr -0113.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702bbe80-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1773068740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068740, "uuid": "c14397c7-a0c6-4dcb-ba58-6d29b22811f1", "comment": "Malware payload (AmateraStealer)", "value": "2d7b3379ce7f6e8210d1831eb8138597", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068740, "uuid": "ebb5d49d-06c7-45c7-8035-7dc28af13d5a", "comment": "Malware payload (AmateraStealer)", "value": "6a5cd11b8291723d19c0a402a6cc27559278bc458f827bf5f7fa4a48ee5e9275", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068740, "uuid": "8a253859-a8d7-4712-93fc-629f3a8001f6", "comment": "Malware payload (AmateraStealer)", "value": "72d48f5b9d11a2e0700de209b688876bcde924be", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068740, "uuid": "21dfdac7-fb65-4a68-99d7-4212fc6eccef", "comment": "Malware payload (AmateraStealer)", "value": "d6ba8c33ed783989122eb9f8ed3226cc46c14c342aa6d8fe0c570b8884d1ecb65aaa5d8fc885241e4427f1cd3979d0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068740, "uuid": "49db7257-994a-4a11-9cb3-45980b0889f1", "value": "T1F5459E46B2DA06F2FA9FC93F8516472FDB7279191311CBDB4290AE5B6E337C12538A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068740, "uuid": "f5381997-604f-4b90-85e3-65f925b25746", "value": "f9fddb4fe671035e9a92a7f55d38b69a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068740, "uuid": "3e664325-3288-4f47-a23a-705f14c9984c", "value": "24576:jOzckdlJrelY+a95fmxP0kj/Xpmdn1R4lYz54H:OE6LfmxP0kT5mdn1R4O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068740, "uuid": "1fb95f8e-b40e-40f6-ab52-463e3e029fa9", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068740, "uuid": "24e97fad-3061-491a-b9fc-657ae5ba8b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068740, "uuid": "ff44b42a-4f96-4e89-abae-eab3adca9984", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca74c843-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037109, "uuid": "2acb2a4a-e467-4a41-a203-dbf9974bb211", "comment": "Malware payload (Mirai)", "value": "2d9f1d53d142824abf14e3d512ea5191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037109, "uuid": "d074010c-67e0-4127-a60d-21ee7e8d1414", "comment": "Malware payload (Mirai)", "value": "6bce3d42b5c8498a50c00ee135c003bb8a798b4c7514e1c93408bf63fb211520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037109, "uuid": "f8be01bd-9f1a-43de-9cfa-47e7c3253ef2", "comment": "Malware payload (Mirai)", "value": "47b970ddcad116006d31e0277f491baf6f9767e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037109, "uuid": "1b8c3960-836b-4214-bb74-0c70c53d7781", "comment": "Malware payload (Mirai)", "value": "6bfd2a13146abc0de013dbcd7c79b9be483d015462b17d564fd522d692752618441e94f108ab323b1e47b66012a89dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037109, "uuid": "2e21361b-312b-4cf6-b69d-c4acfca03c37", "value": "T16A932A06F9419F01D4D325BAFB9E564937136BFCE3EA7102D9209FA023C69DB0E76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037109, "uuid": "10cb4d55-4149-4d70-bf50-0649046f0ca6", "value": "1536:6on7NPuUV2OG5zJxi+l+yQliDxPUhMYqaaKtY7NjUC:RNPzV2OG5z20xPUhhqaaKtmjUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037109, "uuid": "315f17df-4f3c-4aec-9bd7-80316f973bdf", "value": 90756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037109, "uuid": "bc83aa98-5ef5-4621-bcdb-1c0ca4e07509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037109, "uuid": "282406b2-eeea-41fa-9a71-ac338928a7b3", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43080ae-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042709, "uuid": "7b94510c-bd37-4b70-a345-ea46e2cb7112", "comment": "Malware payload", "value": "2bb8dc80ccb2cea395035ec3e72d6270", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042709, "uuid": "6aced368-f513-434f-812a-8753a6f34996", "comment": "Malware payload", "value": "6c6a9d1f4627b4b51f3724088edd6b1f4bda1764d4860ae73279fbc1eb84e892", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042709, "uuid": "387db86c-7cbe-4221-91be-61f002909073", "comment": "Malware payload", "value": "a55394836f08ce52a55db975fe88a286b517ed80", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042709, "uuid": "736ba142-7aea-46e3-8308-7367258d6016", "comment": "Malware payload", "value": "62552607b82c25cdcd1d52d4f14dcaa45b98a85097e6764a0f8f7b1489c0085b3093d88cbfb7c3ebf2f1cbae50b40d68", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042709, "uuid": "a29f12a9-f792-487b-aaee-c59d38966716", "value": "T1FA44EF915DF84376BC1E2B308911C194ABF9B50DBCECCD337CD10C8B82A6AB9556B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042709, "uuid": "2d2f0a94-37b8-4412-95ee-0a108dd714ac", "value": "6144:UUHxktl5lNXlEMsBkUK1pownvPo1zsCIX4+9N+2tgCHJHJ6wyC:1ktl/NXlQBkUK1Dvgd5mJtgCHbjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042709, "uuid": "4bd6d342-e9ee-43d6-96ec-e8142c0e1651", "value": 275619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042709, "uuid": "b4564a0b-5d83-43dd-afb5-ca6feac19ce0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042709, "uuid": "83a2397c-c7ec-4f20-99f1-39462f859234", "value": "E-way bill.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d677f-1bcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773071430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071430, "uuid": "2f8d1461-c986-4611-ab60-19ce8786f09e", "comment": "Malware payload", "value": "b6ae3d23c96fd62591ce359f2cfe2f0d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071430, "uuid": "07b4d956-9190-4eb3-9dc6-934cee132347", "comment": "Malware payload", "value": "6d55a4ac37e4ee13b06c5b84f81b1958f72c9056c4562b6c92b4cf757c9715d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071430, "uuid": "9c7f8107-6368-4d47-88fd-11ff24065622", "comment": "Malware payload", "value": "07ef968b902e0ac6d986d08aa962f890eb24bbde", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773071430, "uuid": "3b84c381-0f41-4dcc-aed8-4d4a9e98bfde", "comment": "Malware payload", "value": "b314142f69b4e1ccc9c39ade3d2a8c4ba2e8f157e2794b88fea367045353c208daab82dbf703813b4130114f2133cd22", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071430, "uuid": "d171955a-625b-45ac-b146-6ae855c394c2", "value": "T118924CB412496C79FBD1CE39AF3C7F4CADE882C42124A3ADBA0F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071430, "uuid": "e1182a20-9250-4fca-8a06-28a321b1bde3", "value": "384:SYcuQpWx+BL0SWL0gmzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:SY8i+BL0SI0VzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773071430, "uuid": "40c8cdb8-d540-4323-91df-ee472b605e22", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773071430, "uuid": "c3cd48e6-495d-46d2-aa47-a9823e3ba8bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773071430, "uuid": "621501bb-7433-48ae-aedb-9aea33352d84", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d862e6c2-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070633, "uuid": "70f57e43-6a98-4bfc-b2af-5e3e2baeb0f2", "comment": "Malware payload", "value": "ee0e34f58e5d5d56e8278520a03ab121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070633, "uuid": "bcc51eaf-de04-4a5f-b9e0-6b41ed15f0ee", "comment": "Malware payload", "value": "6d6ff00efa652035795869ca6ded58ae1b6f15a6748c5088d326235bdd816bdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070633, "uuid": "8b3274f8-aeb4-44ba-a196-cd5c1b33d283", "comment": "Malware payload", "value": "310f3bc1b8ff70f8f17f8ad22171947be6d93a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070633, "uuid": "ac130d54-9e8a-4c24-9a0f-17aca37be2bc", "comment": "Malware payload", "value": "0a9840c20c706348082623887aeaa4c01a1d7447aa4e0a67cd1768e33ecf2bb73095e5766a2932d38935ef8e0a7fce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070633, "uuid": "9dc3d481-d227-4348-ba36-c68a1c8f0685", "value": "T183B64B03F89144E4C4A9E574C572D223BA32BCDCAB3273DB6B80B6642F727E0A576751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070633, "uuid": "6a272832-1a07-4e03-bac7-5c8ab4b057bf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070633, "uuid": "46d0a47e-bda1-47e7-afe4-f0499a5b86c5", "value": "49152:G+Mzktnj7gSeu0TODqO4S372sRws5qajVF+iRFunQSPHaeJ4Wo944+CRJisJggpm:GKNwFIkAxWNsFpWpOTMeXBxR+4FGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070633, "uuid": "3a717a42-1863-46d0-82a2-c5362c9de179", "value": 10677248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070633, "uuid": "2f225c37-1e24-46c1-89e6-2b8d263db8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070633, "uuid": "b53a41e6-43d4-44b6-942e-fdcb1cd4874d", "value": "x6d6ff00efa652035795869ca6ded58ae1b6f15a6748c5088d326235bdd816bdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a9385-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046567, "uuid": "d54f8fe0-85af-4529-9d99-1b79fa106845", "comment": "Malware payload", "value": "434afdaadb778d7942937ab25a57a973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046567, "uuid": "bc5445b1-39a6-42b6-830a-7e40a685eafa", "comment": "Malware payload", "value": "6ded9b64cae47c26f56f02a7a73eae5fdc94f9331df600452d272fdc3a634ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046567, "uuid": "31919654-81a4-495d-8cb9-982a4dc5f4a4", "comment": "Malware payload", "value": "ae17a8e47f05b36010dc44ad2e20c0001fd19c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046567, "uuid": "69fdf67b-7c5d-485d-9200-fe96c2103ff4", "comment": "Malware payload", "value": "b02ff3fb56f29864435ba23f8de6c7ce82a062a6131f9b60ef8dd0d218d7c73e82b80dcd3984d369747c9a00dc19939a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046567, "uuid": "d1bdd3a2-c0e8-4e1d-ac2a-0bab3f5fdb1b", "value": "T17B940612DB50B565F89349702D39A256782D3D3A2681EC0BB789DF4A3B71683B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046567, "uuid": "3c215ab5-1982-4be5-9293-f1f05320a7e1", "value": "ce91c003b73db25c0e1b6c217bca4405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046567, "uuid": "d9db88b0-1871-49ca-b883-5a67847af700", "value": "12288:7fsOYNuyrkeF8Hc1/rcKZQvdiVIba7itR:IycWdijI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046567, "uuid": "6928d966-83d1-477f-80f5-68e981a060e1", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046567, "uuid": "ce294d96-e8d3-4516-bb8f-f46d8367a6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046567, "uuid": "feeac30e-f8f1-4fe1-a15a-13fa0268ade5", "value": "Cotizaci\u00f3n 2434278 ov 33653 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7380cb-1bf4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773087362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087362, "uuid": "b79779fc-710a-48c7-8457-556ba8e1b19c", "comment": "Malware payload", "value": "94cf73bfac796fc19720ed6b324d83b1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087362, "uuid": "ff518bb5-ed4e-4ffb-9df4-a4b9db2ebe8a", "comment": "Malware payload", "value": "6e095b882040b62c7b6585df52d4cd534f0755c58537becccae4977d25ab6b0c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087362, "uuid": "d5435bc4-2fa0-43fb-8ce3-a09faf0ab6c8", "comment": "Malware payload", "value": "cf32fe36929fa7b196e6945a2f4d133e7faa12cc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087362, "uuid": "71746e58-1e19-4789-8698-6c0d4ab18d3c", "comment": "Malware payload", "value": "05b9abeff7b9118293960648103245183da713625dd248bc140203c494702cb878c13c94c3e9399b98d1b68b62b788f2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087362, "uuid": "dda70d90-6b46-4222-8058-ee43062df777", "value": "T15B4127101BEA4254F5737F39D8BEB98315743D98E532CBCE0196628909B1254D467F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087362, "uuid": "cec06a47-ac24-434c-ac0b-5cf0279cd39c", "value": "24:86l5vtY8jssGaTb/CUkNaKo+C+Y6WZT0BfNxEIkRmHEUvG0pcfOF+KhlEcPWk+/t:86jvOTwb/5LKJVYtmRAUvZpcfOTHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087362, "uuid": "a23ca425-57d9-4ed7-b745-5ece0dbbd46e", "value": 2086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087362, "uuid": "00d4027e-b8a0-4c28-9cc3-c2e3211268c5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087362, "uuid": "7301d86f-bd1a-4df8-b956-c8b15551bd3a", "value": "GIA\u0302\u0301Y MO\u031b\u0300I.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223be51d-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046276, "uuid": "7ba8dc2c-af4d-4ed3-87d3-009740ff0d27", "comment": "Malware payload", "value": "1a2f170572177727af5a7549f85c33b7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046276, "uuid": "12673cae-5c5a-4fda-8762-d524e851d87c", "comment": "Malware payload", "value": "6e9b31cffe38ba8c354a51041f9c0e846a51dbf9f28585aabb69c3f7516b4382", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046276, "uuid": "2283b0d0-c357-42de-bade-b63d6c750a92", "comment": "Malware payload", "value": "66604385c29ce01a0dc5e44500cff393a1365118", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046276, "uuid": "def943bc-f21c-4c84-8b1a-e8bc8dd11b61", "comment": "Malware payload", "value": "183dafb7700eed9b554851518d79ecb476a5b46e29c782d840a478372dcc621e7ed10113a57fe7eb85cdd7892fe8537a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046276, "uuid": "9bb86f31-6f3d-4162-b5d0-ce3737877440", "value": "T1A7F04708D39431C5CD5E8176E93BD131AB248F4450FC7745A225F0112D8B7B0BD42D4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046276, "uuid": "9033af28-215a-457a-b915-5dc3c6d97277", "value": "12:5jBVR6s+nVw8EUhDV2rQoejduNLFJz40TSJg72Ot2b5v4+hg9itaX:996lrhwr7ehyJU0T0g75t2b5Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046276, "uuid": "445dd681-2959-429f-b4c5-54cb9274ca64", "value": 633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046276, "uuid": "f92ddac5-e551-4cde-9408-ae387cda315a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046276, "uuid": "e5a845e0-196e-4771-af6a-89eff592eb7b", "value": "main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5097e2fc-1b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773021872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021872, "uuid": "cfae72f2-caa3-4258-b5cf-0058aa6b0b46", "comment": "Malware payload (Mirai)", "value": "7158148b8095410abd12a47daf4fb940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021872, "uuid": "e7ce2ee4-bca9-4669-8313-27b3048f73f8", "comment": "Malware payload (Mirai)", "value": "6ed82f4c8f41e9ee28bfeb6aa6e757e85d2d811c4b8ef97476622710c9acf53b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021872, "uuid": "12687ff6-9a53-442c-b491-580956e111a7", "comment": "Malware payload (Mirai)", "value": "b423cbf0a2b187b0ec46bdba969582063d794c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021872, "uuid": "29d67450-be08-4dfd-b91b-b5a58c307349", "comment": "Malware payload (Mirai)", "value": "68cae89ed3a6090e12e399a9fa20a36fe7f039031e8109190e9aa9378fcda1ded7aae6be1805155d207fed364aa295ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021872, "uuid": "17ec61b2-0a95-44e7-9cd0-8238d25ab9ff", "value": "T15B141981771D3E63C1D7EEF026F7E7F043E7A8411B926140F1AEAE945276AB12509F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021872, "uuid": "4f354a4f-9c8f-47cb-b3f1-08f6d708e550", "value": "3072:GS88cSHxDefoxd0bO8+XFjy/2iHvn0AlYd8zeLKNZ63b1+:GZ8cSHxDefoxd0xYFm/PHvn0AlYd8zeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021872, "uuid": "910bd2d0-3aa8-4f88-83d8-fd674570123c", "value": 192446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021872, "uuid": "35e9c8f5-49fb-4f7c-87f1-f54f4a898c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021872, "uuid": "0b2171e0-1810-4c64-b6aa-2303616ecca6", "value": "a-r.m-7.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268863e7-1ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054444, "uuid": "964877ec-e4d3-475a-8dac-3b27f2f53077", "comment": "Malware payload", "value": "d76139b659f658e169d64de514a0d1df", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054444, "uuid": "5efbb6e0-4dd2-45b5-9705-f1d70b796afa", "comment": "Malware payload", "value": "6fc0fd48b59cb1a7e8a035a7658e8f8ee77d0a04ee2889df91d359fad3c6d9cd", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054444, "uuid": "8a259cab-918b-4db9-8e50-b78514109169", "comment": "Malware payload", "value": "310364cfb267cf59777354fed721c903811570be", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054444, "uuid": "670bbce0-d265-468c-bc0d-d5927552c0b6", "comment": "Malware payload", "value": "9a9183d6594dfb76be7266bb6e870fbe9f45450bb3f20f014399a8d7bdad1832d2de5908055c553f3136b8e4443d3949", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054444, "uuid": "c87a24fe-50ff-4584-89c1-9374f0b7df3b", "value": "T15301448CA32D6265D0EBE1B049C79903023926234F13790774C4A8D29DCDBC447B6752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054444, "uuid": "8a9da5e3-b86c-4bb5-9d05-66faeb72be0c", "value": "12:5jOJBmivb784nAfzH/0qFGtF4o2Jgj89GbLfmax+ePOorta+:9avnvnAbH/3Fs4o2JgAOLfNMm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054444, "uuid": "cf4187ef-c1f3-4165-a007-0c2b87150636", "value": 726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054444, "uuid": "cc43e3af-92ea-4419-b28b-77a3798d9ee7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054444, "uuid": "f1e6328e-e463-4eae-b8f3-14f87cde3acc", "value": "client_task_system.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0bbae3-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054184, "uuid": "6aa17249-7ddf-4e3e-b4b0-9635324f43ed", "comment": "Malware payload", "value": "36694046a6d7321251257b3a623377ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054184, "uuid": "7e77fda6-0293-47bb-9f8e-85a18089cab6", "comment": "Malware payload", "value": "6ffb66c1c95390c655531e3875af09e448c31fadb15a0dd1b44c9002634bce2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054184, "uuid": "842d2287-80dd-4a60-babc-f88c6ca8b0ad", "comment": "Malware payload", "value": "539d81c72769dad9b8452defc1701e9081761d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054184, "uuid": "db30ee2f-eaff-43e3-b170-22724f12d4eb", "comment": "Malware payload", "value": "e8e9a864f30bc92a3937ebf15a013fc55f74cc4dcee7be2f0305dd8bc56e703066251476520bdb8f013d331ed11a47bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054184, "uuid": "b629a6cd-c90d-4ca0-8190-c7539fdc1434", "value": "T142C4D05473900CF9FD73623DC8638806D6B2B8664761D68F03B496662F337D16E3AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054184, "uuid": "921ed082-13a4-45f2-bace-3dc69bff4789", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054184, "uuid": "f07696bc-ce36-4a72-a28f-918d8b0ddb84", "value": "12288:hR6NN5kmDsrd36U5WVZdivOI2Qz04IxhRuxfYMG3jCPU:hR6H5kmDaveZid2lRufIuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054184, "uuid": "d67d6c95-7af4-44c0-ad08-25ee2c2711b2", "value": 580000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054184, "uuid": "2cd56371-d2e2-41f3-8969-2aeeb9938259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054184, "uuid": "46dd920a-bead-4eef-8c67-e67042562378", "value": "6ffb66c1c95390c655531e3875af09e448c31fadb15a0dd1b44c9002634bce2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e75935-1b94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773045925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045925, "uuid": "3b562657-f9ad-442c-8007-e7bffe7dc319", "comment": "Malware payload", "value": "cd89545e20037909c0cf4c0dab33ed5d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045925, "uuid": "6a43f401-a330-4a5b-8153-3ec9756279c2", "comment": "Malware payload", "value": "70eb45da00c179b8ad99e6fdefac810151ced859fec5b050f8215ce7c0ecb04b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045925, "uuid": "c491480d-83f7-46e4-95a0-597375b6a0fc", "comment": "Malware payload", "value": "e9ce633cc69672df245760468194584ffcb7f615", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045925, "uuid": "8a47f897-a9c5-4f51-9533-92291d96d1a4", "comment": "Malware payload", "value": "fbc873c91dd87bbbad7480c9fef6d84689520fdb77cc7d8df4c6c0987840934f8702bb45e41c8a5d10a7417a5bdd3fe5", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045925, "uuid": "4aa053b2-aa57-410e-b45a-2f00e7256f03", "value": "T17D6401B785E07EBDE80E88F78057743476129E029978B752542F1BDE8C42A8ED7181EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045925, "uuid": "f5a6be2a-ac8e-4393-9f7b-2867e27ae37a", "value": "6144:wHxktl5lNXlEMsBkUK1pownvPo1zVeUV1IDeIPPLQ/Mbi2n7wdfYDhSN:Gktl/NXlQBkUK1DvgdoOIDDnLysWfYDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773045925, "uuid": "15549a1c-7644-4c21-b75e-38ab86fc6a8a", "value": 315188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773045925, "uuid": "4eff8052-e43b-4a90-a9fc-a087b3c430d6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045925, "uuid": "726d7fd6-bc1d-44b1-8df2-83cffae77cad", "value": "PO-4100069747.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3192c7cc-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773042436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042436, "uuid": "a7cf5c63-52fe-4409-91d1-4865793d8bee", "comment": "Malware payload (VIPKeylogger)", "value": "0b51532cd26942a534669a3b93560d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042436, "uuid": "a0782c8a-1a18-41bb-b8c3-efddef7b0761", "comment": "Malware payload (VIPKeylogger)", "value": "7168c95e8a0de10827d0aea4369f3888283133895a5696b51b703c73103582b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042436, "uuid": "e931d323-24b4-4a57-8210-5ee8152809c7", "comment": "Malware payload (VIPKeylogger)", "value": "168070ffc28b66bf5b0cf73d18054fa78166fc56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042436, "uuid": "ce592f84-36ba-4b84-8433-6e83c3dc2c92", "comment": "Malware payload (VIPKeylogger)", "value": "8c3f20d07fc2520341ce120934b4af128a518db64952dd4854f25311137f3eaff89ffa3193c6088ae2cdfb5570f77e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042436, "uuid": "ebfe41d1-eb8e-4e81-8e2d-2630ba48d2fb", "value": "T145B42226B7A8D423DA15887006A797BF6D379E67BC100B139B503FAF3D3E2049D1935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042436, "uuid": "9d7c7819-52ab-4701-a162-b39866bb19e6", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042436, "uuid": "72dbaad2-2902-45ba-adbd-bc6f4c7fbed4", "value": "12288:keG9hpO8Fze80e5JMh8Fln+HVTe2DcqLp34HWdRNR7bfLX6aprM:03ze8x5KhMd+1WM42dtnfr6aprM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042436, "uuid": "5fd2aeca-2157-4f9e-993e-06740eb73a67", "value": 508944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042436, "uuid": "d0a32dac-9edd-4840-bbf4-ce9245f76af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042436, "uuid": "d3bcec96-03a7-496b-b594-9700f3448834", "value": "Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5807bcec-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054097, "uuid": "6d7e1b78-df1c-4244-9d12-34aa44f714fb", "comment": "Malware payload", "value": "c8557d4dddf1429601c0a9a729768806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054097, "uuid": "9392621c-4e54-4882-836e-43aa530cfdf9", "comment": "Malware payload", "value": "721c33cb680d5a4e6db89e24cfded8a29d1aad02a78ac8fc26d512b34513999c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054097, "uuid": "70096ad6-1042-4f0f-8142-08fa9bdd098d", "comment": "Malware payload", "value": "15ff886ccc64f88a92660bbfe7caa3c58b6eace3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054097, "uuid": "6a60b5ee-9d1e-4777-a8bd-3a9000aa9408", "comment": "Malware payload", "value": "6e1f31fc5e7ec13912e8cd29bd5dc1cde348724bfb0ad303dce7b9fe83b3ce19777e97cf085aa1eb74290d77c69a1359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054097, "uuid": "9f93cd51-83db-41bc-85ea-69431288c5a6", "value": "T1E7E35B45B3E500E9E1B79238C9B61616E677FC061B31DAEF03A043661F336D09E3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054097, "uuid": "445aaaeb-de2f-4f8c-b9a0-a045df904fa7", "value": "24d44c019508e0e950930582319f3fbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054097, "uuid": "5e05e125-b2a6-4c5e-9ac1-dc315569923d", "value": "3072:gEuBBzs8oL+EAtM1gKTM2E/RK6qeQ9h7lnL+plmPQ1:ksM2EUhvlnkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054097, "uuid": "ff5ad438-80b0-4cd8-9a1c-8a13cfe2141b", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054097, "uuid": "34c4bd7c-1d68-42f5-ab3f-dddad6b8be27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054097, "uuid": "5ed805d0-e579-4b06-89bd-cdef18343894", "value": "721c33cb680d5a4e6db89e24cfded8a29d1aad02a78ac8fc26d512b34513999c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf5d455-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098610, "uuid": "7ba8ec75-6fe0-4f66-8158-779c9403f033", "comment": "Malware payload (Mirai)", "value": "fb038caecd212b6bdeb88f70b9b7499a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098610, "uuid": "22011a62-7ac5-48cc-b070-cb556c43c1b3", "comment": "Malware payload (Mirai)", "value": "729a477837cc51276aeb9649c2ed471ece8a1cea7888500f141318f9f74c2301", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098610, "uuid": "1adbd953-074c-4baf-ba56-df6de5886818", "comment": "Malware payload (Mirai)", "value": "52743b45d748d372dc229a3a5fdf487f1ade0211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098610, "uuid": "e62ca626-d6bd-4b0b-81c5-a41c0362ef11", "comment": "Malware payload (Mirai)", "value": "dfce3d57af4629fe055786d4fcffa84490f857d458af087b2b1816ab0bd3db64debb8c2cd811a85f392f43728d0d3575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098610, "uuid": "05bd7f98-7c79-4332-9d1b-ebce2cf2dbd4", "value": "T16EE34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2577C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098610, "uuid": "2396ac1d-0956-49c5-a759-060c87ef2358", "value": "3072:CotWnBLigk1Tc3ECC0DvZe1k6aU6zL6EiueCo2kt:VWnligqTc0CCqeS6axIueckt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098610, "uuid": "8987c110-ceff-49ec-96bf-c68bed75c927", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098610, "uuid": "c857897f-9460-4f32-acf7-b458120dfca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098610, "uuid": "499a4870-a6e0-4ac6-814e-d5b7b85fddfc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd9c92d-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053785, "uuid": "a40758e9-8c5c-4cf9-b523-e211220ccaf7", "comment": "Malware payload", "value": "32191b5f4046db457f9439fca17925a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053785, "uuid": "e1ae2f56-09fd-49ae-b9ea-1645552d75d2", "comment": "Malware payload", "value": "72e5ae4aba7fed560a03a73bc36537d027c4bdb69a26e7069d737473a3ac7cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053785, "uuid": "59b4a25c-5883-4f57-8d00-34924f0863b3", "comment": "Malware payload", "value": "d73a5410f114998d585b1bc8a1790b622649a169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053785, "uuid": "33379ab0-6cd1-44a5-80ea-ed1af0f8f510", "comment": "Malware payload", "value": "af3896e562538297c60a4ae70cdd4baadbbca6e5a662add7bd607d6dc0f70395660e11dd17f16ae09b00eb3b4df6351e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053785, "uuid": "7573a9ed-3943-477a-bdd5-9d329f7afd04", "value": "T156665B03ECA145E9C1BAE23589669353BB717C885B3123D32BA0F3282F76BD06E75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053785, "uuid": "e47ab7dd-f06d-4e30-9a43-fe977242419a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053785, "uuid": "25311f36-821a-4509-8968-3f701ffb6bbd", "value": "49152:bxapuEbBRP9SKJpgwThIulxVPm+yPviJCKBLtvZRSv2dcd4UF9W7VOuktz9QXfKf:b0cwPIilLtBEu84m08edfIGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053785, "uuid": "be02a4ec-98cd-44bb-9a5b-2c8acd1d2b32", "value": 6630912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053785, "uuid": "1b4174ae-7a30-45d4-86fe-e4a2dd20b108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053785, "uuid": "84add73d-f83f-4845-a6ef-3a35a2cb73e9", "value": "72e5ae4aba7fed560a03a73bc36537d027c4bdb69a26e7069d737473a3ac7cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a437e85a-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1773077847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077847, "uuid": "72fbd846-d0f1-44c5-bd65-e7b116481cca", "comment": "Malware payload (N-able)", "value": "ed83f17e8ceee70654d88be2c3aa537c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077847, "uuid": "bd89f447-e934-4f86-b359-17803bbff9d8", "comment": "Malware payload (N-able)", "value": "7338a3eb6266fba2bd98636cac12ec91feef40ddfee4b3ad891aee32d915e069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077847, "uuid": "39ef5ee7-b29b-4012-91e3-cf907ac092e4", "comment": "Malware payload (N-able)", "value": "6a2d6b5d3f77fdfddfabfe4b35db5e1a52c59f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077847, "uuid": "5fe4b48b-c188-4ae1-9f11-59c2cc9dba0f", "comment": "Malware payload (N-able)", "value": "053ec7f9c6bbc966b5909973ecc1445a112ade80b034a5b8f0e78579d6f78666d1663ba69f6f14d781386f051ab0ecea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077847, "uuid": "012b685e-e8b3-48f2-be83-d1e43dae6795", "value": "T160E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077847, "uuid": "fb866092-6e0c-4bfe-b51d-e8dbb8d564e4", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077847, "uuid": "8488c000-e065-4ce8-819c-92c665c093ce", "value": "393216:kEF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1W:TrRxvoC/7a0jUxX7h1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077847, "uuid": "a2883cc4-44ca-4b9c-96ff-86c590592ba6", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077847, "uuid": "9f1033c7-811e-40a7-9890-47eec5b78e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077847, "uuid": "1935e845-c5d9-4479-b7c3-33745405f415", "value": "turnerlabels.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bab4c4-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037108, "uuid": "0ea64227-54a8-483a-9737-99f5a95bc032", "comment": "Malware payload (Mirai)", "value": "09004e58bf62d8094144d30fe2e74e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037108, "uuid": "e666a1a9-74e9-4457-8e5c-e9b7a269dbe1", "comment": "Malware payload (Mirai)", "value": "73bb2f4b0856beed814c7e28727f9aee38d1d4472f4ceae6cebf8dfc68b6bffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037108, "uuid": "c574f997-de10-4b05-a36b-cb409f15cef8", "comment": "Malware payload (Mirai)", "value": "697a7a647a8d1557db86ec3e8bdaab947d10dc46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037108, "uuid": "edcf70d4-44e7-4fdb-86ee-0f5ddc126050", "comment": "Malware payload (Mirai)", "value": "3c7070e9b6677c3560d9a92c1cc92302705788d4daeec3399ff198f40ba327a316a0b1a35cbae3144c54ecf8836cd056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037108, "uuid": "cbdc4c87-e9c0-450c-a649-f986a3984d7e", "value": "T117532B17BA82C7BBC48B81F41BEF6D229D32B8FA1672719563E0FDA15E55CD02D0DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037108, "uuid": "d0acdeae-3952-42be-9653-fb20ff465caf", "value": "768:VQ8G9tVjQuswrWYD+gRlC2MO2gMsZ2LgUGbJCnwPBdd58o3r7GHFX9hyvuXh3Rkz:gtVjQwyEljMO2eSgUGbvz3WHpGfBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037108, "uuid": "fdd4556c-8c21-4f95-90f8-91933d723947", "value": 61144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037108, "uuid": "14a8c0e9-723a-4415-841c-ff47d6552583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037108, "uuid": "009e178f-85a1-407d-b7fd-e82c1034afa0", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4badf227-1bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773063955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063955, "uuid": "0921c50d-f3a8-4343-9df5-82192589b88d", "comment": "Malware payload (Formbook)", "value": "857a18aaf868889abbbe23dcfd9b2aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063955, "uuid": "125b59f1-3fcd-43bd-8d59-32d8a5af6f7b", "comment": "Malware payload (Formbook)", "value": "7425f75e57727ed43ef7c9cc4a646234736b2151641a51ada14db20152f2ccbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063955, "uuid": "f8b9d78f-ce5d-417a-9f41-afbb240a60ec", "comment": "Malware payload (Formbook)", "value": "d874d295df59b1f25dfe8eacda8d6db1f98f8941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063955, "uuid": "6cd08f18-245f-4d36-86ac-517f10d39b87", "comment": "Malware payload (Formbook)", "value": "d5d3835b17538316e8dbf6acb0235110f268c8d4404e4cf8e961fdf55ed3e064956394aa7a09ba3e72166891a01a26ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063955, "uuid": "56fcab31-072a-4beb-be34-b1952bca0612", "value": "T19A45BF0273D1D062FFAB92734B5AF6115BBC79260123A62F13981D79BE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063955, "uuid": "5103854a-6846-48b1-99b7-da49ffa6d144", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063955, "uuid": "1702b0b9-2529-4476-8078-7f8d5e398760", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1ijXdaU+USklzWMxzmXDNP:uPVt/LZeJbInQRaUTlaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063955, "uuid": "c42e9e35-3f17-4fac-8915-9942b994dee9", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063955, "uuid": "01909e43-6171-4c04-8a5a-fabef84682b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063955, "uuid": "6fefb6b7-89b3-4666-9e85-fa4adef98c1e", "value": "6606339-SHANG JIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73666732-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773040829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040829, "uuid": "b16d50bd-2742-4239-b431-bdcb34f40a36", "comment": "Malware payload", "value": "306c97c6a13ccbdf21a04e1e1484141e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040829, "uuid": "a1679197-1e62-4661-9199-2c4367f104ff", "comment": "Malware payload", "value": "74b63a6915b3cd7a00d1c64e901064e9f6f3578fde2e7a2ead372f89bf351dbb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040829, "uuid": "295da94d-333e-4d73-9e89-32190525e115", "comment": "Malware payload", "value": "ba58f7daace2ccaa8f68d78de5a3de29a5ae6580", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040829, "uuid": "4a989fc4-6a94-4d72-8610-144173aa8989", "comment": "Malware payload", "value": "6a3050edc78480b0d58c000e9594c27865db10d4397d31c8cd650e307aa14b55694dea0977833d1f025215a49163e658", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040829, "uuid": "40a000e8-0c61-4897-b62c-76ed9df5be68", "value": "T109C412B34AE1BEBEE55C03F7654774B033960D064674B892262367CC4E2663E9A060FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040829, "uuid": "345983ca-79cd-4d54-b25d-49f3c40e876d", "value": "12288:oktl/NXlQBkUK1DvgdplJ+x8kjIXKcQTXiL7yv+wzqYhBgU79vicyEWG:fx6k71D4OpIXKcddwWiBgU7FrWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040829, "uuid": "ada07980-e4a0-430c-a589-3882d707f663", "value": 550598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040829, "uuid": "54c29c7f-64f8-4fe8-bf8f-f3b113c828ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040829, "uuid": "7d00f40c-4167-4112-a023-933955248319", "value": "PO AD31250192.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f284dd4f-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773038894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038894, "uuid": "0b40a604-3f73-4ff0-868e-d2ffe1164e3e", "comment": "Malware payload", "value": "290f4aeb7208024539f1e289fe6cee74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038894, "uuid": "0dbbec07-c1c3-4aac-a31b-7a04dd93dfd0", "comment": "Malware payload", "value": "7532cd95ad9fa18a64673685064258632b3ff4b3028cb77e968a3be5fae2148e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038894, "uuid": "18e79eef-a3d6-4b18-a42f-e28c6c71e895", "comment": "Malware payload", "value": "116df8735974a61e5cca3c8de4dbf8750cd94744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038894, "uuid": "20b33a4b-978e-4c84-a146-8f81f5098b8b", "comment": "Malware payload", "value": "229c2bf436d409d576da63f755ff4dc90fc82e6f30f698c7f2f0bd297acf09fcea05aa44f00580fa5f8bcabe3cb43360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038894, "uuid": "7bd16185-38ec-4ffe-a987-e3c8fa34003a", "value": "T1BD46CFA1E1AEB8B2D3AA843EC37D4A3942D9D82B05F7FB72A9F1586510035F771135B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038894, "uuid": "da999eeb-deba-4514-b829-d31b30e2584f", "value": "903cdf1ef9d315fcd2c563c14b28e134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038894, "uuid": "cb02732e-fbfa-4453-a928-007a64eccd97", "value": "98304:6KmlHMY9rdkwwW0CqJPqRFNIFbQqVbYNPlnLX1CN0/4wvzcTD:eRdkXdhAIJ5RYNPpX1CNzw7cTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038894, "uuid": "b781bf3b-9a29-40a3-b698-b6637601f2f2", "value": 5498178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038894, "uuid": "9d8b99e6-f829-4049-ab6c-5359f8e9176b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038894, "uuid": "353a7728-732b-4701-b5a0-1fc28d59e60c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6335cc6d-1bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773057122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057122, "uuid": "a8ebfe22-afcc-48cd-bbaa-3d39a38ec9bd", "comment": "Malware payload", "value": "50f3bfb02a26748075bbb09d55d2ced3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057122, "uuid": "321926b4-7cd8-484c-98e2-b4ad1e139d57", "comment": "Malware payload", "value": "75a5663b7b0b0100688f8004b99630041134c77c457bea2a3f9b55d68b4015d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057122, "uuid": "2187e6ac-38fb-4480-ae8f-d5c0dfcd8de3", "comment": "Malware payload", "value": "658e34990a7c66a0d52ce6c2b33c03be789b1b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057122, "uuid": "b0c319df-0b6a-4918-956d-ca1691069542", "comment": "Malware payload", "value": "79fb0aaa6e0d6760e8efa145f7142879233143d8b839513c29130a37265722db9ebea535616189470e5d6bdcbebcf52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057122, "uuid": "d6d4d9b3-2c1f-47c8-adf7-e406ae9be8c8", "value": "T18586E123F246683BC0AF177989679794A93FBA2135166C4B6BF45C8C0F39141393E6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057122, "uuid": "835322d7-b675-4906-adba-8b4ae8cc190c", "value": "548509f0620e68f2d3273e70899aed7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057122, "uuid": "fad9df5c-fd36-47a0-9c58-ecddead613f9", "value": "98304:EG0XRj4FPgSJuq6Ky9olzWTHld0TILbBCadQ+YOu2YTZ:olqLQq6T9olKTHvSyt/CgYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773057122, "uuid": "6f737c40-80b5-49d2-8e4e-bc6506c0e79f", "value": 8234264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773057122, "uuid": "d2db599b-9823-47c0-adeb-adde66941cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057122, "uuid": "1a73c476-6271-44ea-8f0c-3d90270112b4", "value": "PDF80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4874bca0-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773046769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046769, "uuid": "47488be4-369b-41ea-97d9-c54718b60b43", "comment": "Malware payload (GuLoader)", "value": "8e538ed6e557782156e49e51e8a0f502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046769, "uuid": "dde1bb20-0695-4a95-9d3c-e2d305505ca3", "comment": "Malware payload (GuLoader)", "value": "75efc5a6ef53bc3248c347b26adf208851d643ee054a49e3da1d2c17905ef7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046769, "uuid": "33f49943-3084-4a1e-b9cd-cba50c4ac808", "comment": "Malware payload (GuLoader)", "value": "6aa1054f4b4f79a37e821955f0d58a24bf344904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046769, "uuid": "cd32d893-707a-4f68-9565-1fca0af8e1f3", "comment": "Malware payload (GuLoader)", "value": "682c5d0f043909219eac06209a1b953d0aad8391eb8d22c02e22316f784648b5eee6293c088cc48e8a0c9e186816b64b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046769, "uuid": "4dd86523-91b2-4836-afc9-f70f57e5c259", "value": "T11E3533661B82C59FDC503574177BCFBAA6A25AB0214D358F13D0EBA73D363198A0D0EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046769, "uuid": "0a604a44-c28f-4bbe-9ea9-7abe3c533f84", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046769, "uuid": "decf85af-799e-4a67-b6d3-cc0ea25832a5", "value": "24576:RisTHLJORXbePIOu5SR2K1KuN5UE8w4a7ey57F7k:ssLMRXC5F1bkXwBX57C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046769, "uuid": "32424325-be99-4c46-a0a1-f4f776d03212", "value": 1077912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046769, "uuid": "2ea62ab3-ba41-4769-b4e4-a933fc1d8f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046769, "uuid": "0bd173a4-c9cc-4d11-a816-a4eab909574a", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaeed80-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054239, "uuid": "4089beb5-7912-4424-aa7d-0f6130d42a82", "comment": "Malware payload", "value": "ac2c67586d679baaeccc0bccabaa2116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054239, "uuid": "66221aab-1bca-4b92-9eaf-cd0b96709174", "comment": "Malware payload", "value": "763bbd7c85b5c97d98204f88ffbf31d20872d8286876d2dda7cee76b259f8405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054239, "uuid": "21c22bda-347f-4a19-bf2e-1cdc9c91a5b2", "comment": "Malware payload", "value": "0063cd58db7757bd9530821a70ef0cdf88c14ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054239, "uuid": "03fcfb95-c782-431c-82db-d74af2dea939", "comment": "Malware payload", "value": "09a273d1d7899be8bb40df79a1b722ef3effcc4a44a565c181a5198911a0520109922ad1a20ab268ee5cde694afc776d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054239, "uuid": "d6462323-cf70-49a5-9476-a8ab8a230975", "value": "T14BF6334442A00AF5FD71883DECB0A959C1ABBD6627F0C54BE3F80762AE237D16E1D653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054239, "uuid": "40ceec41-8f6d-4be5-ba4a-5809851b4268", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054239, "uuid": "ee6ff7ac-0720-4892-b945-607a5aaf8d3d", "value": "393216:Qo/cZBQ1lwGaa5wEMiuHClSXMCHWUjrrRQ7XbFsn6h6eRGP3gWBH:kqgaGziuilSXMb8rrRQ766AtP3gWBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054239, "uuid": "90b34ba4-b368-4ddc-b6a9-a1e6ea5538cb", "value": 15370000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054239, "uuid": "21658370-9011-4354-b374-6d9abd60f3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054239, "uuid": "e7d3b783-578c-4f6f-9225-79113c532054", "value": "763bbd7c85b5c97d98204f88ffbf31d20872d8286876d2dda7cee76b259f8405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dab11b4-1bf6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088010, "uuid": "1441b012-6a3c-4243-958a-3adb30a8c5f9", "comment": "Malware payload", "value": "95928acfabc1baf56457a554bd3c00ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088010, "uuid": "b58c758c-6e3b-46f7-a099-46be252e0950", "comment": "Malware payload", "value": "778b52ec09f97cdd7fad6af2f2fa17078e6ec59b40e9664b5b82a176ee2b2cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088010, "uuid": "049ddcc9-eda9-4bfe-aee7-f4f2b7627675", "comment": "Malware payload", "value": "e3309ec50ff5de575836220e5fab04b9c2191b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088010, "uuid": "aaee02ad-3e77-4576-9cab-3c22f63559a8", "comment": "Malware payload", "value": "376739a1f51734529adb48ce23dc7d7b53f93df5228a98127f5e34aaa5ec75c3c2be945d6788946d3588288be5e213ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088010, "uuid": "f4473317-4ed0-48f9-a0d3-6a9d556aa9a3", "value": "T1DDB6B46B62DC4D77C15A8D3AC36ECA0099F2B074372A85F7CEF00718BA215D5ED3A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088010, "uuid": "a707ea51-e8e9-4421-b0b4-5e2f5e8b0a99", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088010, "uuid": "517bfcca-8c93-46bb-b2e4-441f29e19e32", "value": "49152:P1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpTfMdPHQpt0HHsfNa3id:P3L31Poeo33pOHHsfNa3azUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088010, "uuid": "7582e997-db7f-4af9-9a0b-3f9f41144f09", "value": 10872320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088010, "uuid": "e46bd63d-5c19-4485-99be-999d5f839635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088010, "uuid": "8ede35fd-303c-4509-9253-e6d8dda7dced", "value": "SecuriteInfo.com.Win64.MalwareX-gen.13864596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb9342c-1b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773022998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022998, "uuid": "b95bee39-728f-4614-9aa8-42d3bfbc8441", "comment": "Malware payload (Mirai)", "value": "181ef78b3dec812d5428b3ad52380a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022998, "uuid": "05de47e4-a940-4bb9-ad72-463dba36b813", "comment": "Malware payload (Mirai)", "value": "778d264261cd4a4f59463458bb23d6ce4af3de3b524e8f588e94bba05f483ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022998, "uuid": "b798ff8b-96df-4019-94d6-2aad1a6964c7", "comment": "Malware payload (Mirai)", "value": "e052b5a2c3938614353a1e6007a61c52e3738d69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022998, "uuid": "d6cb1d4a-ffaf-4112-a7fa-632f50e6bbf9", "comment": "Malware payload (Mirai)", "value": "a7a413eb28bfb2de445bf623dcf1d8b5823349d7540a115d228bbfb00f42e4bb4ec211fb3608687818298b38132e3e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022998, "uuid": "95b3832a-9499-4159-8ae4-bbc8505c3d9e", "value": "T1D0835AC1FA8B80F5D4074830116BF73FCE32E5654261C62EEFA9DE36EE63542A91664C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022998, "uuid": "077c86cd-a982-4a59-a9c0-fe8e06d16c88", "value": "1536:xe1Pv8ucnATIyOzw+wMKj8ybS6YWjc0HheIc1cgrE/yez/zU/:wJv8ucnAcyOzw+wMuLGOw0HRc19r2w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773022998, "uuid": "1347d8f0-64d2-4e3f-bf25-33796d06801a", "value": 87440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773022998, "uuid": "bd073ac6-5a01-45d2-82db-cc7cd8f59340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022998, "uuid": "951f0619-5041-41a0-8cf2-edc57a4b0035", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574bf149-1bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063974, "uuid": "8a227da7-2aa0-45ab-91d9-b4471934f690", "comment": "Malware payload", "value": "f725a5e8abbc69b34f815537763432ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063974, "uuid": "1f4c2981-f97c-4de7-84b0-0b05972bdc33", "comment": "Malware payload", "value": "77db9e1f1bc033516f75bf128f8d62d1b8ba991614adffe89fd9794e7a43a41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063974, "uuid": "6cc1b3ea-b142-429a-9612-e45aaeb3ed0d", "comment": "Malware payload", "value": "e2ce1bc55d22d1c63f0286723652aecf3efccbc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063974, "uuid": "cbdc53ba-b7e2-4d72-a4af-8622d4c206dc", "comment": "Malware payload", "value": "45ef370f8606016e4b60fe3d11a14e5b681f71c4ef89355aa8b0e830de0492d1bac64a623f74de2dfa89e498b8cc173f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063974, "uuid": "175a554d-109b-4e41-8c70-985fd28d8686", "value": "T190F4FA7F99629126DA4A80FC35494B625971B33B03B41FF301A69130271B9B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063974, "uuid": "38fd14d9-3c62-42a5-b93d-e334a2c42ef8", "value": "12288:WjFObfG7PDux33ZR6b8vekr7eDVcq+T8xuVzrtw2HVUKD3ELFYsS:W0bfGzDuxHZR6bUe3jQw2HVUKDPsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063974, "uuid": "77c0385c-0ee8-4d41-a80e-f3b18d6f5fc3", "value": 731008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063974, "uuid": "1f9059bb-2202-478e-a19f-546b324f0c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063974, "uuid": "e88bb278-3f17-40c4-835b-07350ba3fe39", "value": "lincense.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97407cd-1b98-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1773047872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047872, "uuid": "b2965e72-4b94-4f90-a388-03e115518058", "comment": "Malware payload (Hajime)", "value": "f66a7576b06410e2e076a707a9b5adb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047872, "uuid": "b20ae685-8859-4806-8cf1-73ecee2091b0", "comment": "Malware payload (Hajime)", "value": "79c7c57600290bf10ec9cf82891b03750e49161e7d662a51e8167d93f99e4a04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047872, "uuid": "6fbb0647-a83b-48e5-b8c2-91397e34e025", "comment": "Malware payload (Hajime)", "value": "b69797a18902faae580a512bcc3cf7b24967cce3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773047872, "uuid": "1a88e753-7f84-41d8-838e-7f1f4fcc48f7", "comment": "Malware payload (Hajime)", "value": "e621853916bc808b31531fd6a96cdceb64f49e80cca672f8ac666b31764dd5b9e186499bd04013968a04879c43723b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047872, "uuid": "5db2d42b-95cb-4e7f-a8de-f8b8c10a39c5", "value": "T14CB2F18323883743A5635AF4F27DBE8A72167D689FBF543B81543163A07321E5648C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047872, "uuid": "b3f3bf36-e9bf-4a55-a24b-d36f304c6eee", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qs9LrEQSXmV:YTYIDfYG6ZmewZ59+Nw1qsREH2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773047872, "uuid": "0370738d-f032-474c-a73f-68f6342f0df3", "value": 25612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773047872, "uuid": "07335073-bf18-49b5-bf08-5bf9270f7f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773047872, "uuid": "86d6c2d5-df82-486f-ba5c-dc932b214c08", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f219729b-1b65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773026009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026009, "uuid": "42fe978e-c2be-473a-b321-1e80a15a4e14", "comment": "Malware payload (Mirai)", "value": "7b590a38351a1c5dfc8a9122497e2f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026009, "uuid": "d980d64d-b61f-445e-ae02-9b57165af74b", "comment": "Malware payload (Mirai)", "value": "7a094cc508986462989a3bcd0cf9b65bdf0c1650f2577218d5398e5564980c4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026009, "uuid": "f092b283-a5d8-4056-9e69-356998bc9973", "comment": "Malware payload (Mirai)", "value": "e9970a45667362f5bfb080c1e04fdd5fa7fb3d3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026009, "uuid": "93ad5f3d-e05f-4fda-89dd-1b3ffda16c22", "comment": "Malware payload (Mirai)", "value": "c250b5469fca63094e5be243b5af59b2a5996cefbba26ea2238a69bc2ee34a82513fbc9aeff5cdb7cb08e980e096e1c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026009, "uuid": "d9b9931d-9675-4346-8e7f-a5a371860a38", "value": "T130A30759F8829B12C9C105BAFF4E51893313176CE3DE33169D248B74378BA6B0F7A916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026009, "uuid": "a43df66d-b8c1-4543-997b-e275f20c03e0", "value": "1536:cqnd6oHk+pgnOF+BPwzYyxcNpa76LOMMni5NX4uaeK07G65Z9KjfWe7pZ:5Hkc+BPWBcNpa7aNXHae3C6dKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773026009, "uuid": "26a5073a-fb22-4d99-a112-25eb24e174e0", "value": 104708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773026009, "uuid": "bba9303a-b3d9-42bc-bde5-95d32cab972d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026009, "uuid": "f1c09e80-a509-40db-bd30-ba8ba89b7df4", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b17742-1b60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773023683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023683, "uuid": "4640179a-5110-4449-9678-2f716dd9f7a2", "comment": "Malware payload", "value": "8ec45cc6b36f047d1d272f147cfed35d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023683, "uuid": "70429a44-99ee-4e3e-a18d-bf2f77e622a3", "comment": "Malware payload", "value": "7a5c1a710407536af3a44313a332821b384c76191408d82ffcf04a5860608acf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023683, "uuid": "99ab5f84-5d72-4c0d-81c0-6b1189d5ef7b", "comment": "Malware payload", "value": "edca429888b67bc4c20c43654ccef93812c9c7e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023683, "uuid": "75460454-a5c2-457c-8f0c-0944e225d984", "comment": "Malware payload", "value": "eaab5abd39e636052c81cdf0bfe78561c27885c4897f857c5b8d5512449e8e056281ba365cd2c7d1d35785edb7692455", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023683, "uuid": "d5379ec6-31d5-451c-8945-83aa3d7a08ef", "value": "T1B3925DB512896C79FBD0CE39AF3C6F4DADE8C2C42124A3ACBA4F39215A1166DC70534D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023683, "uuid": "7a2c309c-15d6-4520-83c7-8b888477a452", "value": "384:oFcuQpWx+BL0SWL0glzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:oF8i+BL0SI0WzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023683, "uuid": "b60432a7-eb78-4e32-96c8-ff95f009d054", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023683, "uuid": "b7a21254-d8e7-4d4a-99c3-066d3da56d33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023683, "uuid": "5b63567f-386c-4687-bffa-bfa7e59d2bce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945ed4d6-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070519, "uuid": "c2c006aa-f1ad-452e-ba84-61aca60eed83", "comment": "Malware payload", "value": "dcc2c9a08044e8b3e445f17461d054f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070519, "uuid": "e7e42620-1403-46f6-b823-d552a3bd3131", "comment": "Malware payload", "value": "7b35b332a999d56d65241a4f35bbce2e9ad2644a84c09f7dbae42e39cd559bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070519, "uuid": "be9f8c92-8cb2-4f63-88d3-bf42eb438e0d", "comment": "Malware payload", "value": "c5535ff9d3b0f43a66a56225be24e7770fdc8ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070519, "uuid": "fe997d1b-8871-4124-9659-a7568299b2d1", "comment": "Malware payload", "value": "06644a04ca484ca1732e3e288d37c61cb477e8e2b8170be784be696ad2fd787a7b16ef35b856db574dc15a45c15358c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070519, "uuid": "364d10a6-9c1a-4dc7-99d0-533e9bbf04a1", "value": "T146B64957F4E10C94C4F9C6B495368226EA317C4C4B3A33EB8790B6742F327E196B6B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070519, "uuid": "31fa5930-6db6-4796-951c-9fdf3112b60a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070519, "uuid": "5bbccb3c-2186-4b3b-923b-dcbe6d6b8b8a", "value": "98304:KCI/kGHQqNQExM5hScaVeE7az7BbWebj1aZjjqX:KZ/dQmnW5I7x7aBbRBax4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070519, "uuid": "3664df10-f58e-4449-97d6-13268f8f98ea", "value": 11455488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070519, "uuid": "ea8e9de2-0a24-4914-be47-e567125d7e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070519, "uuid": "f15e3469-e236-447c-9542-d5537fc1e4ba", "value": "1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc52dc-1bbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064388, "uuid": "2829fcb0-0e0b-4c87-ba6d-900bece42969", "comment": "Malware payload", "value": "ce2dd8e98cde74732fbeac6f953e9be0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064388, "uuid": "af7bf8c1-df40-4d7e-8420-c220f3021715", "comment": "Malware payload", "value": "7b5fb8202bff90398ab007579713f66430778249e43b46f35df6c3ded628f129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064388, "uuid": "b36413e0-d65e-4798-afb4-fdfbec004db8", "comment": "Malware payload", "value": "39b763ffc57236353681bc7cc3b57ad26be024c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064388, "uuid": "0f64be43-5f16-46e9-a0d1-88b03ea07a94", "comment": "Malware payload", "value": "152a58dfba439ac84b70189f27e28ecc214b0aad68d7c0388aa6d016ca0bc26fb899554ac91118cb97569d58ea18e50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064388, "uuid": "2a100090-912e-4264-b5ce-d307f0a09495", "value": "T1F9A65CDF1593318DF4E5BC70D0425B86E9E17A3DFE19D8E1C17EF220223A9D82A19762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064388, "uuid": "cfb49753-4219-479c-8f53-b5628dd3096c", "value": "119d0184548b794c65ccdcce7eb848ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064388, "uuid": "1a793ae4-a7a1-40b9-8cab-e2591e091d33", "value": "98304:y4bk4ZYbEXRVUyLQdQi7KEqlZokCVIdgaNVYA8i:jA4ZYbUUyLQdQi7KEaZjCMtND8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064388, "uuid": "8ceb3b45-650b-4c06-8d84-d00bbbebc4ad", "value": 9741136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064388, "uuid": "72f307eb-59d3-48b0-a539-e0aa2db94c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064388, "uuid": "ef65f8a8-f264-45e4-a0a2-7fdc09a5d27e", "value": "7b5fb8202bff90398ab007579713f66430778249e43b46f35df6c3ded628f129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41579d72-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773046758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046758, "uuid": "81859dcd-f6f6-4b96-84e4-49ffc056bbd4", "comment": "Malware payload (CoinMiner)", "value": "5360792d48d149d76d1af073c8ac8a61", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046758, "uuid": "a5753ff9-75a6-4da4-8e64-f10b9a78cd82", "comment": "Malware payload (CoinMiner)", "value": "7c9beb95e8446810183545d5ed57c3eb3b183af570fa5081f039c6101d244e58", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046758, "uuid": "c4363929-9d1e-41f9-a52f-2e8032c27842", "comment": "Malware payload (CoinMiner)", "value": "0bc3edce8b8a9f0f32336e500ae5fcbc4cbf79b7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046758, "uuid": "5b5a7c1b-a83c-417b-93dd-69b696b055af", "comment": "Malware payload (CoinMiner)", "value": "9dfaadc53509d201efccaf1a495486346781f32cbed93235b3995edd6c08766099810df65779190379fdbd8739f6c630", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046758, "uuid": "f890a4b3-c3a4-4d68-9ed0-c2dd4f6b74e2", "value": "T16E4219076D994131FBE008B1197A524B86BD3DA23BD1AC9FA740F5462DB2760C47167E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046758, "uuid": "fcc83a39-12e7-42ce-9ded-cbc116a1111a", "value": "3eaf5807ffab1e2f73dcc6c476f60324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046758, "uuid": "b6cd6a4a-5738-412e-90b1-6a33605a8ac2", "value": "192:P2eTbgOhmKkvYDleg7z1yEHEjyMJxTZ3lk9nAthBsuNOk:uITwJYD0ABOZK9nABsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046758, "uuid": "234e4dac-c22d-425b-b187-8b6361d56b4e", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046758, "uuid": "217be9b0-1605-4915-87ca-abfa7521aaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046758, "uuid": "8a9e12f0-c9fe-49fa-a223-1b30353f1f42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e5b47d-1bbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063106, "uuid": "1197c8e9-93f4-4b73-b0c5-55e7c44ef96d", "comment": "Malware payload", "value": "5d8de56e2c494343c1070618cfadc599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063106, "uuid": "d9c1f4e3-e7f4-4d13-ba90-48d37a89666f", "comment": "Malware payload", "value": "7cc267b2bdd31033470b16ef985f592db6c091306ba54dfd60475a3380279537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063106, "uuid": "6ea70a14-1893-44d9-9eae-055620c7e28f", "comment": "Malware payload", "value": "c5195d08e976fe08d897cec072d46fcf075f9991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063106, "uuid": "01d41f45-f1ff-463f-a7eb-dfb728b855c4", "comment": "Malware payload", "value": "bf52272529de0c82102e0d8a208db9d2175196ce79554b5e32dde53503c5a7c80f01816ae8998374d6ab35275cfb137f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063106, "uuid": "acecbd35-e066-4e84-8c16-e7f36b31e5f3", "value": "T124363395379C4E32D06E8F3E88FD8866CB353009A628E756284D6BDD5F31B864C527B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063106, "uuid": "dc2d6673-c059-4d1e-abfd-7f5c6779dc80", "value": "98304:s5x6FSXMQAHi6Y2rVHeUaNia7oqz87lKDtAjskOn6Q9TYr1QKksmrq:stXzAHvY5RNiWzclKDEu6QNYZnsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063106, "uuid": "83eb30ed-c838-4954-a072-0e13a03e79cb", "value": 5126656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063106, "uuid": "255c0c1a-f3a5-4c05-8a1a-ede6c2d8b1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063106, "uuid": "a0225d88-72a1-4da4-b33e-0feb61d9985a", "value": "SecuriteInfo.com.Trojan.InjectNET.14.20091.22542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9463be06-1b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773049044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049044, "uuid": "2524e757-5ba7-46d0-9031-d2c2baca2ad9", "comment": "Malware payload (CoinMiner)", "value": "88ba93cc81c2f2c175fc7b521e94fc00", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049044, "uuid": "31370830-faad-4bf3-988b-7d43777657dd", "comment": "Malware payload (CoinMiner)", "value": "7cde0ffc28a6a25867655b2616cfc6cb01b08e9ba5ba043b26446b5eb8e248a0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049044, "uuid": "10c8216d-d2eb-4763-8868-e1c6d7e22de2", "comment": "Malware payload (CoinMiner)", "value": "34f8d06a39154cb01c75b2c37221a0d9e3002998", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049044, "uuid": "af322061-8350-4410-80c5-30dfdd4bd157", "comment": "Malware payload (CoinMiner)", "value": "8538d2733d2bbafdad2d1c5da074d62866fb8eafc4b6fb58f1cad3dfb63a8cdf2ee13b9f30ace1c02af08534aac35ba4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049044, "uuid": "968aabcc-83a4-4ab6-8cdd-aea0852f384a", "value": "T115E533F8636BFAF7DF6D0B1594F507625686A1A361AFEF2C9EC870174FB811406D2082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049044, "uuid": "29bf3a88-46b6-47e0-96ee-d63546cbb792", "value": "49152:GqZSbqOjnVspdnMQ3mscf04pJgXD3iCGE7se7/xjceUGdbF4URK29PtVeL9Raoym:GYSbZhspdnMQjcc48XfGg/xjcFGJ4URU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049044, "uuid": "09a6e404-cdfc-4a64-89ad-95ead2c008de", "value": 3053824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049044, "uuid": "4721f75d-8b16-41d1-9cb5-04cf0b6d2179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049044, "uuid": "cf560e39-d7d4-4dac-bd3b-1ffc55e5114a", "value": "ldx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc51e503-1b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773022939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022939, "uuid": "6a005330-8cff-4ad7-a34f-97a3025ddbf3", "comment": "Malware payload (Mirai)", "value": "c778b76eb215655fdc29e5b5146b5f51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022939, "uuid": "cee94455-11d6-443d-909e-fc9a4ddd968f", "comment": "Malware payload (Mirai)", "value": "7cf3f417110eac59f230573294ac93382e1de0848b1596db51102185ae5a91d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022939, "uuid": "35372934-b7e6-47d2-82e4-5bc232c5ed51", "comment": "Malware payload (Mirai)", "value": "4e990f6bd09c5e9bd03aff67fff26ea8fdf2f0ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022939, "uuid": "420faf20-5672-489c-808b-f76f52eae1a3", "comment": "Malware payload (Mirai)", "value": "7f651f0dd14ef182c5b88b490f45bae5161db2c97e2bf5fc96f6a458a5510391fa8ad7865feff1a2fb75031b792a15dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022939, "uuid": "84741168-8586-43bf-8bca-ba084fa57589", "value": "T1DD13F1E2E4A5D344EDBE11B628D6228F5440766E4829FDE6C7C12349BB837B5709CF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022939, "uuid": "6ad1cb5b-04f4-4b63-8f97-499b63f426d9", "value": "768:wIz4nYXX626Oy6z+R3zjbs/S9EEYZm655F3haSVOsznbcuyD7UHQRj9:lz4nY626Onz+hzjbGMEEgm655psGnouE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773022939, "uuid": "c69f0594-78ec-4abf-bfd9-3995b9ee606c", "value": 42920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773022939, "uuid": "0dd8bffc-9142-42fb-9965-9df070abee51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022939, "uuid": "bea5898b-410f-493d-895c-059cc9430df4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f2bf2f-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773077872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077872, "uuid": "793bd452-f818-48c3-ae8c-c3c5b6d302f5", "comment": "Malware payload (DattoRMM)", "value": "216645c976817427eef68ecf989c02ec", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077872, "uuid": "4b61062b-fc2c-4d95-9573-3e54fffb424d", "comment": "Malware payload (DattoRMM)", "value": "7d3b5d7a66fc119fdbc90aa98fa7c7e8c4a0bd7aa73eab8714b8e6f42c29fb6e", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077872, "uuid": "7b5803fc-88d0-4d88-9c34-b5dc3b87e707", "comment": "Malware payload (DattoRMM)", "value": "901343ba16d4e44a3dfd839b34e8fd95f6d8f33b", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077872, "uuid": "80d6bd67-8588-4509-a7cc-a77b69bbdbbd", "comment": "Malware payload (DattoRMM)", "value": "91c873e79420e486f86bbbf9d52c89a8e55dfe19bdb68905457d429872c6d5c1040d608dee9cfbf9cd85173e33c57a49", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077872, "uuid": "5f6fe10a-80bd-40a9-b9a6-aeba47cfa1f2", "value": "T127B63347D9778DF0CA330B3890D21A6B3305980E445BF4C9E609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077872, "uuid": "ed2218d6-84f1-47ac-9a18-5e79a7b37c7b", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077872, "uuid": "7e89ac01-0d83-4a16-a5ed-0c0b11e761fe", "value": "196608:paZk+wtP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s21:NnwmzZFw5S9pE7Asjp29qIT0jarlZr8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077872, "uuid": "159b8dea-b036-4791-a61b-1a2f8e986d10", "value": 11056048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077872, "uuid": "a6fb0fa1-8181-421f-bbf8-30bd6b47beac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077872, "uuid": "26a54b60-a3ea-4107-874a-76b9a28796bd", "value": "CateredFitCorp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c209aa0-1bcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773069458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069458, "uuid": "4c70d17d-66eb-471b-bcb4-24e4a3070238", "comment": "Malware payload (Vidar)", "value": "2a4f1dea3ec9ba87646421fadac30b5f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069458, "uuid": "9775468b-ab7b-4500-819b-db837d7c2c21", "comment": "Malware payload (Vidar)", "value": "7d3f3b8966fd945285d4ba2bacb706c4b47e4ffb9c84ee4264660d89a5232192", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069458, "uuid": "3721b4c9-247c-428c-9f63-9dbdadd0cfc8", "comment": "Malware payload (Vidar)", "value": "87b98213ba31ca2cd28d60160de258fd2f5fcd56", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069458, "uuid": "43fc8f5b-8392-472b-86a3-a41f52863ec9", "comment": "Malware payload (Vidar)", "value": "b9a77c17290c0fee66e91cf7c8e010263fb7d690298391de9f37c4e590e89db3e90a5522071d8face4d1ef57849ebc05", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069458, "uuid": "6028f5d2-869e-4e9e-8578-f336131ea4ae", "value": "T161C629AB62E4C268C16D813AD0A28F00F4F3B1750737C7E7729107998E269D59D3BEB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069458, "uuid": "411d649e-926d-4c89-a54e-229dfe7f9c56", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069458, "uuid": "1703103f-dff7-4f73-9f63-ec38f900b73e", "value": "49152:3X18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNOcXCBz+COh:+zCoeoTetBJiP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773069458, "uuid": "67af4f03-6676-4719-bb33-e7bbc5eb1476", "value": 11844096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773069458, "uuid": "dccfcd92-e181-4891-9395-63e38b324341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069458, "uuid": "e66e4fd7-d0c9-4e26-b016-3a554a6d97bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b926053-1c0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773098663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098663, "uuid": "952ce6b5-dd9c-43c2-a1a2-ac527f7daa3c", "comment": "Malware payload", "value": "81701673e8b862932d59ea4d61ca8037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098663, "uuid": "d752a067-3df6-4da2-868e-5da25eebb081", "comment": "Malware payload", "value": "7e10c3c3b60036c65027b25ec8296f4ac32d08b04ad31c6babf9dcf5eaddfdc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098663, "uuid": "321f9abb-35bd-4c37-a52c-77a5786b6020", "comment": "Malware payload", "value": "66306605e3eedb4f3c72d8c5dfe266fca6d8b1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098663, "uuid": "80993754-04c7-4a6c-8344-9bf899e224ee", "comment": "Malware payload", "value": "8ef585f096df4df80c00bfd88311a668d83561d28969f00e509ee8f7add111419afc1ba10e287af10d075f7237e4fb89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098663, "uuid": "d7f55007-12b1-407a-9d1b-daaa6c92145d", "value": "T16FB6F5AB77AD7279C15A823AC0568B00D9FE7FBC072FC5D30EA317199A319D45D3A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098663, "uuid": "d458afdd-d3ae-4daa-978d-dc5b20d8c73d", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098663, "uuid": "4b52e610-2c38-4d7b-bb5a-9e5e2fdaba5f", "value": "49152:o1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpnfMdPHQptGHHsfNaWI6:o3L31Poeoj3pYHHsfNaQ2Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098663, "uuid": "d445a29a-e1ac-4fa8-b960-2998264c4362", "value": 11381248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098663, "uuid": "b3918314-927b-4bc2-a3cb-a4c622f59fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098663, "uuid": "37f25e2f-0e6c-4380-8e5f-5bfc8a24a2d0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12323773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511a455c-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070406, "uuid": "114c6686-d869-4834-8a90-14efc61bda36", "comment": "Malware payload", "value": "ea53ed4e07dc79e75e41a14d053ce988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070406, "uuid": "32f9ebdf-4fe9-4786-be21-32209663c783", "comment": "Malware payload", "value": "7e7c92e5c99d35b1f47acfc6d533da90276c1d3ba1636cf1a89430dc5647fd88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070406, "uuid": "7c505986-375e-47a7-aeb1-f9d475a93cd2", "comment": "Malware payload", "value": "f0946b18d688bcbe007ecb17da5f7ac11d080e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070406, "uuid": "db7cd085-d4bf-46d7-bf55-8d68483a4905", "comment": "Malware payload", "value": "b406b71b34aaa1aa8ce05e4f86e51d735f8b06d83e7edbf2fba5f72960fabfcfadb5500da4e9ff5f2826fc9f652727d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070406, "uuid": "0cf5f483-8ba7-4780-a61e-38c8ee1bbdcd", "value": "T197664A07FCA115E8C0A9E23189A39252BB717C885B3123D72BA0F7386F76BD06E75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070406, "uuid": "f21ba61e-f5ab-4789-b313-063c2ad6edb7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070406, "uuid": "49bf8b52-aea5-48c0-a2f3-c9baf20b9903", "value": "49152:NpJw4Ypqk9WKXDaHAaxZgC4ZxUukz5t/dZdtK+OZyUybWec2jOXqk5OEtPfKiK98:Nv3azYHoSuw/djtLlH/a63Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070406, "uuid": "608490e1-2614-43d8-bc8d-8401cd4f1730", "value": 7019175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070406, "uuid": "4d0fa58a-6e93-4c40-9528-30829cc10dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070406, "uuid": "95178fb4-9c77-43c9-ba2b-7552c0115099", "value": "x7e7c92e5c99d35b1f47acfc6d533da90276c1d3ba1636cf1a89430dc5647fd88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c731858b-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054284, "uuid": "2ec6c77c-efc7-4bcf-a092-9c910ede4e20", "comment": "Malware payload", "value": "48221bb8cb691be2daf4bcbea2da5b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054284, "uuid": "61ade095-7060-45f1-99fc-c3dd4dc4fd08", "comment": "Malware payload", "value": "7f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054284, "uuid": "ae849e2e-0edf-4007-9995-10fe26995d71", "comment": "Malware payload", "value": "215872ac2b863298c0e130f6fe1e2cf605a00bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054284, "uuid": "5c3d7eb1-3cb6-455f-9efc-f344702994c5", "comment": "Malware payload", "value": "8c3fc2a408130b97ffab7b81272a51a0aa78de93d6b4e3fd8d5a3eb48cd743ce245a30134c58961c737a6e05a1c32aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054284, "uuid": "af32c2b9-f005-4694-9cf8-368b194fcb74", "value": "T1A8E34B17B3F530FDE077867989914A46E772B8761B219BEF036086661F272D08D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054284, "uuid": "bef9ad49-8d00-43b9-b898-4b865281783b", "value": "34e541635bb6d4a4414cbb443f23f29d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054284, "uuid": "c06020ce-9aad-4ec9-9c71-5e846399178c", "value": "3072:ij3KxovhoZX62lMnZsSTVd7FJB70QHH8HDs4D0f/:W6xopU6KAZso7FvLQdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054284, "uuid": "28c9a00b-78f1-4d1a-ad3e-1d7e56f03638", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054284, "uuid": "a95eac4e-b917-486a-80f9-04a4d9541ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054284, "uuid": "6502fc24-daaa-4fa8-a8d6-e4662abd099a", "value": "7f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee6f5d6-1b86-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773039908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039908, "uuid": "61f67195-87b2-44c7-b0fe-02b0f1e94af9", "comment": "Malware payload (AgentTesla)", "value": "e13ddb2b642d1ec212c82c80b8a898f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039908, "uuid": "34a37d42-e45a-45ad-8c12-7d901872e12a", "comment": "Malware payload (AgentTesla)", "value": "7f5a747b4b6d764111f908bd247fbe2064606e1bdbdbb46b97d3d0c3c70344f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039908, "uuid": "95660d9f-1e89-45cd-b08c-1885e3c65788", "comment": "Malware payload (AgentTesla)", "value": "f4d7ceaa564cff2f45bddd9940c121454fd5e3cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039908, "uuid": "dfc191b3-8e72-467a-ab26-c52a55cd9615", "comment": "Malware payload (AgentTesla)", "value": "92472a1e76d96a665db625978c5e0bff397dc4295870b0015c8e3dfc85f8a9743cd6949710df0b694a1472550e471e07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039908, "uuid": "fed364ae-56ef-4676-bc19-b38c13c8c41a", "value": "T1C045BE0273C18062FFAB92734B56F6115BBC79260123A62F13981DBAFD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039908, "uuid": "74fd2d34-6203-4b0e-bb12-7cac7a2a7bc3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039908, "uuid": "613abac1-137f-4014-990c-94c3020097c0", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZ0bu2HA9an4L:KPVt/LZeJbInQRaZSHAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039908, "uuid": "e49ca9c0-72f3-420b-a79e-89c1090bd879", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039908, "uuid": "3642ae61-f54d-41a5-828e-f97f2068349b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039908, "uuid": "4d32dd3f-3d98-4c22-99d5-b31a7e2807a1", "value": "PO-03-2026-05053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1b9737-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053839, "uuid": "07f080d6-c180-4c1c-b252-cfb27f1430ea", "comment": "Malware payload", "value": "de3c9e26c723d1becdc64724c6774737", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053839, "uuid": "4b8c89e4-d93d-472b-b2e2-d637db952b84", "comment": "Malware payload", "value": "7fd35c11e0dae00f5b16c3295695fda97a2adf7056515d6d253d1db0833682e7", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053839, "uuid": "8e38f7cd-60e6-4cbe-9c93-1a3b03c1dc38", "comment": "Malware payload", "value": "fd9b85262d1d4f00b4aae1abcb8dbe859d51e370", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053839, "uuid": "04333641-ef0d-4ed0-beed-a5505c696e6a", "comment": "Malware payload", "value": "9772e0069034400e900553bc255a5c020e30abb2a29f45f9084c64b95cf57530b616fa4dfb3d49e62b3b382f90eab61b", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053839, "uuid": "eb5fd682-5ce3-441b-9b41-977348482e3f", "value": "T1D5839C93A78A27EC96948CFD6309B913A5E6C97B3C192278FDD10583B43DF11B922734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053839, "uuid": "20e26b2a-9d09-4f73-b292-6a896bcc2722", "value": "768:rTtp1gfGste5aqBmFBnB4LlavOyUaiE4mOYBdrFTJNo1Ty22+yrL1cjLF42brD:v16G3MF0LlavOy/zBNFcTyJoL62j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053839, "uuid": "f67ac703-9377-433a-91b4-1cb742401690", "value": 83701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053839, "uuid": "4b58ae79-974d-427f-8aaa-6a8f1a14e5a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053839, "uuid": "c5166c1d-1d8d-42b1-8efd-c5a63673b690", "value": "7fd35c11e0dae00f5b16c3295695fda97a2adf7056515d6d253d1db0833682e7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12242fa2-1bf6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773087910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087910, "uuid": "83f9f50a-721e-47c1-88e7-5f94e59d0e35", "comment": "Malware payload (RemcosRAT)", "value": "e9bae8dfee1150f29d83a401def30f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087910, "uuid": "9b5d7b06-c6ba-4ad0-b3c2-62228299f298", "comment": "Malware payload (RemcosRAT)", "value": "80e2868c6cd6c3b7e0b4b5584cbcc180b7c7ab049d20b0ab508e2b8be14a8522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087910, "uuid": "24ef3752-52f5-41c3-a015-4fac18839be9", "comment": "Malware payload (RemcosRAT)", "value": "1f26813afebe2bcd86dc1dca7aa0d46023e2e588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087910, "uuid": "a31b71c3-dbf3-49bf-ab22-8f553a9aad6b", "comment": "Malware payload (RemcosRAT)", "value": "e63217e4ce0f4ab62a46859943d7cb63ca7c3a6faf99bc0fa36fb4d528c931ddad730bb55cd56a49989d0d32d2839967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087910, "uuid": "85901f04-2312-4735-afda-e0bc431425e8", "value": "T1D6B4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087910, "uuid": "4980a6b9-9571-4c97-ad94-92057de6b8fd", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087910, "uuid": "decbc8cb-0768-43f0-adb2-548e6e955062", "value": "6144:UXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBceS:WENlHV9FGeDWv3jADnyYiCNrsPZlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087910, "uuid": "18bb5810-70df-4298-a0f2-02b09b5c8cc3", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087910, "uuid": "8445e904-7856-46a8-9290-0f493c5fe6c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087910, "uuid": "50fe70a4-8e7f-410b-b6c6-b2de76487477", "value": "80e2868c6cd6c3b7e0b4b5584cbcc180b7c7ab049d20b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366cf3e3-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039008, "uuid": "90d4a14b-fe80-44d3-936b-397b8385ddba", "comment": "Malware payload", "value": "c09b1c84096cc0bfd87eb4f2b37556aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039008, "uuid": "a82a4b85-e476-4353-bcc6-3f0a8ecb9e8b", "comment": "Malware payload", "value": "810aa1bd5e88dc8a280670e44300c8cabdca58fd9e3c04c8e6f4a2fb015ac89a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039008, "uuid": "9f9c5572-dfe8-4887-9f32-0f6cf1637b13", "comment": "Malware payload", "value": "2b1d16adeaf546018386267e89304b317fd77e25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039008, "uuid": "a15fdaa6-0340-41e4-977d-ba0b4adadbf9", "comment": "Malware payload", "value": "13d52deec997e908dc119d782ca09789a246252e5da826716d51cfb756002f9fc7d3b32acd054cf79189f6a8193e8c50", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039008, "uuid": "6a3f9709-9ee8-484a-940a-c76e00e883fa", "value": "T1F745E6F07B34684044A6A87F51BAFE58DEDF180065B25CEB731D95822ED4ABDE2CC463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039008, "uuid": "93caf8c1-4836-4ead-90ce-69e44409f1ed", "value": "6144:TgzJVzQveOY3wSLqJsOZewW9h8OHOaO0aesWa3hHs3xW9hxvKszepTlUmz3vgzJP:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039008, "uuid": "83a45506-827a-49e5-a096-84cb66e8c626", "value": 1177805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039008, "uuid": "e316be63-5a12-44cd-ad01-c0ee73080a43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039008, "uuid": "7fd84739-2eb2-4833-a858-4d6893de3047", "value": "payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea6f133-1b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773021869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021869, "uuid": "19df3b97-8d5f-42ea-8f2c-e352774662cf", "comment": "Malware payload (Mirai)", "value": "bc2b0fe1f43883d554ea75ffb51cfa21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021869, "uuid": "857a1f5c-1f36-4539-80b6-d1035aaa8820", "comment": "Malware payload (Mirai)", "value": "81bec5933e0561d3f6685358bb9e7362ed3c63c373e6592e3d387664a5081d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021869, "uuid": "31c3bb1e-1b4d-4051-b6c4-31ab0d33ce1e", "comment": "Malware payload (Mirai)", "value": "63bfcb62f6bee6edac46b7f219788122c552be10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021869, "uuid": "f778ee7f-5520-41b6-b835-7ec5079e0c89", "comment": "Malware payload (Mirai)", "value": "91bf0b5b76481c0137cd583e658b6a59ed6000ea8c4045c757a97a52868ac93bec1b9d7c9626004144a53ab20d19d1ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021869, "uuid": "e27a4159-0114-400b-a22e-769b364bbbb7", "value": "T14F2418C3B905FEB3F48BEB7204D3872171B2BB614B531622B29779759A3A2C43426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021869, "uuid": "2fef2aba-7131-4be7-846a-e776081f4a9a", "value": "6144:JF8I9yZEgL2rBJ276kxULjq9pNvY0NlYd8zeyKNP63Zt+:B27KqVvY0Nly8zeyKNP63Zt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021869, "uuid": "9bc805e2-bcad-40ba-9cb7-dc18985f19f1", "value": 213544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021869, "uuid": "592e5dfa-faf1-453a-9e1c-5f57e39185b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021869, "uuid": "9bf60617-da5e-4b93-a757-2b37a93bdcab", "value": "i-5.8-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd13eca-1be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773079289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079289, "uuid": "1cf88d49-eb54-4af6-9d89-08d25f377ccc", "comment": "Malware payload", "value": "3b2d57a3dbb86f6a2d9dd5b43d78967e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079289, "uuid": "e86f6036-de99-4357-88e1-df567e9d8e24", "comment": "Malware payload", "value": "82447740e38310f28c47a61c7cb743dfa075d4194bb5588812a08895e02c89ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079289, "uuid": "d1e71935-3c9f-4797-90c5-f4c1a938fdea", "comment": "Malware payload", "value": "98d893a751fa878d4d97e0bd69df7193abbac35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079289, "uuid": "d3f36ef2-f40b-47d2-a5b4-15d01131f885", "comment": "Malware payload", "value": "51b4874e716ad037eeb7ff55b5b7286a4681840a5f5257d3bdad1bfd1708f914489aa3734be75e0a5c9e8a82fc03d460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079289, "uuid": "d405f387-8533-4207-a16b-8b21100c950c", "value": "T1F4237C44263C9A13DB4E0ABE649517CB1BB0A322A941F78BECD8C6F925C77C027552DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079289, "uuid": "d7d8a262-57cd-4e96-8d35-2b21fe49f8a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079289, "uuid": "9724897e-9c34-4fd2-ac71-06fa65bb64f3", "value": "1536:734O9TTTeBUFy4znNIxp+ogbKz1KzxgDX5oyFV3w:L99TTTeuwp+okwKzur5oyFV3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773079289, "uuid": "1a0a9cf5-1745-448d-a015-9ddcb97b749c", "value": 49416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773079289, "uuid": "4cb3a7d3-e1b5-4e07-93e7-deae0a35f192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079289, "uuid": "ea80c22e-b9c4-4914-aee1-a19ed0777548", "value": "Feedback.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b119f365-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773077869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077869, "uuid": "c54fd171-7e8b-4403-9ed0-9154d8d8ac2a", "comment": "Malware payload (ConnectWise)", "value": "5ce22df6305e1deb347f4e80bd3a45b0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077869, "uuid": "a1063de6-a0ab-4ab6-ae91-9243c47447d5", "comment": "Malware payload (ConnectWise)", "value": "824c9bd950fe5116b503f0f9fa9c17e7ba09464ed6e5b4450ab4354d67259607", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077869, "uuid": "86c1cdb1-9e6d-49f7-8b2a-3317443a1a94", "comment": "Malware payload (ConnectWise)", "value": "97794ca0e2ab77b8f4d5ecc38dd7653d82a08c0d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077869, "uuid": "fbfa971d-759e-4c57-bba6-f215921088f5", "comment": "Malware payload (ConnectWise)", "value": "7c3b73b8f2fe6e41d356a35dfec8a288d24ea1114bcefddad4250cc13c3e39819e5c289d049cf44fe96992c1afe091cb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077869, "uuid": "7505a987-3a7f-40f8-b2f2-e2e8d26de118", "value": "T18CA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077869, "uuid": "68d5ef1e-82f0-4917-856f-6c1b10620aef", "value": "196608:DBn2hg5kEWmXhcfKjSV7h7vGehBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVS:tgdEEijsDG6gdEEijsgdEEij8gdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077869, "uuid": "d20a1951-3381-4ba7-b013-64e51f4a5205", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077869, "uuid": "03249291-4be4-4ecf-9999-c42bed1ac694", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077869, "uuid": "077ac7e5-a8e2-45b4-be17-347507908d6c", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b36f8b-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773041044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041044, "uuid": "de0c7f69-4ff5-4b0c-8cee-c4b85ac0a7f5", "comment": "Malware payload (GuLoader)", "value": "07d7debb74571fafbbc42de26c583943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041044, "uuid": "1c605ef2-afca-4247-886a-99204f0488b8", "comment": "Malware payload (GuLoader)", "value": "82d67bc03d1bdbe0a8df5a4838f4b03d4e3d26f5784fb62744d792d5d2ae55ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041044, "uuid": "da3eda8a-2b76-4948-87c5-aa8711c9bc8e", "comment": "Malware payload (GuLoader)", "value": "afeb1f841707153db0fda68afc26afe668d4d36a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041044, "uuid": "3da38df7-96bf-468e-b47f-07a639254ef7", "comment": "Malware payload (GuLoader)", "value": "269574ec1b25fc8c06736679b29e7e94b23bb603b054599670c0ff76f8b2f093a6a63f40e097cc40005d64c6e7592bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041044, "uuid": "1a3c3340-6a96-4b19-a197-cdee3ae766e1", "value": "T108E4F123F630C621C6E94271C4A5D7F987A97D43B41085BB33E1BD2B74F56A3BB21A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041044, "uuid": "8a229e82-4fde-4e2b-bff1-abb13574d351", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041044, "uuid": "c525f2c6-09ff-4862-ba6c-0aba3c515030", "value": "12288:mfYBkQYhcml0Zd6ZnEVSwyKVVFEB5O8MdmoX:mfYihcmlNZEVbFV7Yat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041044, "uuid": "1b7d99c0-800a-4301-ae07-fcc61fa8cf98", "value": 704304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041044, "uuid": "a0033935-824d-4b91-a1c1-c2b22ed18a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041044, "uuid": "6c60fc29-8664-4545-b5b7-fba83ce95321", "value": "Payment Advice Note from 26.02.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7905fb87-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043415, "uuid": "2dc21963-6a9b-4bba-a405-29bc0fb15405", "comment": "Malware payload (CountLoader)", "value": "9e066401759ab08ed0df4de7fdb8ea66", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043415, "uuid": "9ec70a6d-7010-4e71-8e73-151d60bb09d9", "comment": "Malware payload (CountLoader)", "value": "846380ab52cc2fc432352c299742e0bd110770779a48db48c4e0765a1290e5a4", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043415, "uuid": "b2898fd6-8592-4eea-ba51-7bfc89fcf2f8", "comment": "Malware payload (CountLoader)", "value": "69a5625330148046626d7c367a7be1fa49741409", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043415, "uuid": "2b6b9187-30b0-4512-885f-632dfe2a4361", "comment": "Malware payload (CountLoader)", "value": "4694192b2e6b181cc1f668831b5fe066827bb44f8a837a37cf5ffc41a27063f26a06638802720de089ea7bc07f3e6e6f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043415, "uuid": "d94626f2-0d0d-4f57-ae51-010992351273", "value": "T106C3D19A185F10A107072D22169B0EA7AF76A1174304C7D6FEFDC3E5BF68AD450FB298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043415, "uuid": "f6284d95-947d-43ae-a060-b39f2bb8d85a", "value": "768:KQMtZuZP/l2dPwBWfbBIFFvZuIFAIZwTEQ/GLwVbQjnCOyIOVqpUsuddWn0UAu0C:K9IZuPZbYGTLbQjnCOyIOHOU+fXO4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043415, "uuid": "85a97115-6594-485e-a37a-bffa0dce7c62", "value": 124612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043415, "uuid": "df340333-d3df-4eab-8cdd-d5481c7ca7aa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043415, "uuid": "8ba6ee68-cd2b-4399-bb4e-c6f8cf5810a6", "value": "Design_Quantum_Video_584.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b290ae26-1b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773023325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023325, "uuid": "8254809a-9af3-4c96-8e0a-28427042dedc", "comment": "Malware payload (Mirai)", "value": "9c55a3f8d79261fb949048cc7d39b635", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023325, "uuid": "d51aa1d8-28e2-4087-ab58-0665b1a90dfe", "comment": "Malware payload (Mirai)", "value": "84dbbefd653fbfb4f0753ceaa757987098a87bf08f792425470d1e8a43bbe0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023325, "uuid": "d9486e24-d582-43c5-a6ad-69dd1a860beb", "comment": "Malware payload (Mirai)", "value": "b0e69655be73aaaae3d5e5de286e48a95b633de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023325, "uuid": "087d05a6-e780-4890-9ee9-64fa15f786e9", "comment": "Malware payload (Mirai)", "value": "cac8c74f0185457f189a5d463b60f899183b2b297259a1deb53cd6f62bccf6f1ff63eb389656714468a0e1d45d007e51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023325, "uuid": "12b6a1cc-4466-4fbe-a8bc-0c85e326b0ab", "value": "T10904F893E9667E77C1C6EFB562A3DA640BD3E8144B430B46B1AADAF04507DCCB804768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023325, "uuid": "b588181b-2777-49dd-a4e0-32ef981f277f", "value": "3072:hxaKAN+UGB0ubxi2Wcz8lZ5tNSlvgCAlY48z79KzZ636tK:raKANHtNjcuZ7wlvgCAlY48z79KzZ63v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023325, "uuid": "6469bf30-43c0-4c2a-9fb9-1e89e6a666e4", "value": 176373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023325, "uuid": "75b7df2e-c4b8-4120-8d10-c5d4654d951e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023325, "uuid": "b0245e0c-c4d2-4679-bf5a-d7d5fdb87341", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cc298b-1bc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064822, "uuid": "b4f429b6-44ad-4915-b0aa-c999b9e23dfa", "comment": "Malware payload", "value": "2602e97fddb13b7e25f3776125f35313", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064822, "uuid": "8021196e-68c0-4b87-90a2-3555aa443138", "comment": "Malware payload", "value": "84e9311f356d95143049ffbd343453ffc535c4f8c9427609993153f4e504e41b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064822, "uuid": "cedb98e8-97f5-4fd2-a2c9-7bfeac410c1b", "comment": "Malware payload", "value": "f33c4714eac2c1e3e4507988d7fffd971b313f6a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064822, "uuid": "63cd3e5f-adce-47a4-b1df-45f0a27d145a", "comment": "Malware payload", "value": "7041808abeb154266dea85983aebe2fa62c9a72b725308ee17345d9fbc71a29dbbdb73a7d68c724f68748224ec48dca9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064822, "uuid": "81031a3d-4f5b-43d0-ae40-1e696f8fbb0c", "value": "T10A5385D937BB8474C17FAE76E2C7224B6DB541A3B902E2450CD266D26A01BC5CD0ECF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064822, "uuid": "68547a87-b52d-48f1-b0d6-b21d89aaadd5", "value": "768:ubgM8hJ3/FodOX+p/OjveLR7DED9b7ABgfubVfVlHM:ubf8ndC4OLR7Do9b7ADVd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064822, "uuid": "15c4b1e1-f190-4e3a-8238-161e33ad9c83", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064822, "uuid": "28ae0ea7-ea88-459a-915a-a80d0e52899f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064822, "uuid": "53aab3a0-e582-4aa4-b873-88e5e78f2fb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d9c311-1bbb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773062870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062870, "uuid": "79d209fa-f304-4faf-bc3e-5baf5fea4cb7", "comment": "Malware payload (njrat)", "value": "77b02e0f8651bd735edcca3d2666ba1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062870, "uuid": "6e8dc6ef-c04c-48d1-89f5-51d09ef40eba", "comment": "Malware payload (njrat)", "value": "84fae604e319f9bede31f822019f1b35a9a893c0873b195d85b0a9c486f40e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062870, "uuid": "691fd6a7-7014-47c1-8919-fbac7ce272d7", "comment": "Malware payload (njrat)", "value": "ee803a4f85baedab1c4eb71872fdc71b79611516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062870, "uuid": "3cfda1f6-1544-4b83-a9db-15147237cc13", "comment": "Malware payload (njrat)", "value": "4bfb0615b0f655219fbe64711120a1489909644661571ac5675336a3baf1f69eefd92de3d56f47a0f1100a5b84b9abef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062870, "uuid": "a58f853d-c1ab-47f0-a024-1ab166001159", "value": "T1C5B3595EB74189A8C71C4E7B8523508C42E9C9A77527F73F2AE85DE19C368CC898F984", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062870, "uuid": "52bed579-3504-4ea4-a577-462d83359c71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062870, "uuid": "afe6de4a-cbd6-47f7-94bb-226adc2391dd", "value": "3072:atBg0zKSHielHLHx7blLPTundZXrYbeVEK:atBX/HrHXbuXYbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773062870, "uuid": "b82e0a9d-5fbb-4030-9299-6d900c064544", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773062870, "uuid": "51054aa4-38c2-4f2d-9321-f3c75a7d34c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062870, "uuid": "71341dba-9444-4a27-8b55-f6d6cfd568d8", "value": "Token GrabberV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4c02ec-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773046425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046425, "uuid": "8e55904c-a6ee-4ce4-971f-682e78a8ec5c", "comment": "Malware payload (AsyncRAT)", "value": "da419d80021bea964a437aec4cef5dce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046425, "uuid": "f95e237c-f864-4a4a-a8c4-c67bf1c2f1a2", "comment": "Malware payload (AsyncRAT)", "value": "85e630a240fcb06832fa731e1b81fd607bcacab06665a12827e014a3bf6a7a34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046425, "uuid": "136b4ad7-a720-441f-a705-1877de2801b1", "comment": "Malware payload (AsyncRAT)", "value": "bdd304d3029fe2652ca13246c57c7cff98fd0b5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046425, "uuid": "93c572dd-4a85-4622-928d-5631544ad409", "comment": "Malware payload (AsyncRAT)", "value": "5d13ac5a1018ec432d3b8f720155a70b25b6edd612838bf19d75ca12a964af29ca038d682ec6cb4ad5c504b4e9089bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046425, "uuid": "fa09edf2-b84e-4737-aaf6-7df48b2c7c8d", "value": "T16C033A08B7F84965F2FE5B7D8DB582004335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046425, "uuid": "f9a54839-8ef9-48ff-9fc1-e7481080378c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046425, "uuid": "7146c087-6463-4df9-a340-2ca1d9e81db4", "value": "768:InCIcURKolEbTpwVRbJpB+WWP7L714Xj+:IClGKaEb9wVRbR+dN4Xj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046425, "uuid": "cc0dc4a8-e0ad-4129-bcdf-0ae642776f7e", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046425, "uuid": "63dc2053-c486-4cff-bbb8-b43f5e404d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046425, "uuid": "7ad615c9-2a1b-4357-9540-62c17dd16a71", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa5b292-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773046325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046325, "uuid": "9b6ac447-1082-4328-9e74-3006296eced0", "comment": "Malware payload (VIPKeylogger)", "value": "08362e21ba758743d19b3fc1c1eee62e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046325, "uuid": "464a294e-a669-448b-ae91-fa70cbd90c88", "comment": "Malware payload (VIPKeylogger)", "value": "85ed68d81a1222cf788424e398bf6314d02cfa6cd9224aa98cf4071f61af9991", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046325, "uuid": "7e0d49fb-4040-407e-a1e3-1d1dc6a75d07", "comment": "Malware payload (VIPKeylogger)", "value": "c6c77d6179802eba6cc970977dc6eaacaeb887ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046325, "uuid": "6ee0611c-e309-4f35-9eb3-d557de687db4", "comment": "Malware payload (VIPKeylogger)", "value": "ff987998eb585d8ec214b199797259c5e689d58c78a84233ad7d5bad11ecc80fe10c5d42a3668db338bac9b3750f6470", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046325, "uuid": "1a36763a-f211-4972-a2fa-1d63a9211abb", "value": "T13816F740F08086C53D237D36A6E470A05AD3B6DF7D97B502F81F66B1FBB69C1A921236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046325, "uuid": "cd9e399d-cfea-45cc-b943-0649ab2a0142", "value": "98304:ZMw+u15daburZrbFSAXwjQKIhKmm6s20HssV9c/a5j8C7AsAOsFwoCGkhurG64hN:ZF5nVx/XvNhHs/vVS/aOWAsZsFwzP64n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046325, "uuid": "b96d9e82-bb8d-4cd7-b756-15f89744b491", "value": 4302485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046325, "uuid": "a258d257-2d75-442b-a04c-b906e09d66dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046325, "uuid": "fbe356b6-67e8-4671-b821-d2bf2857e082", "value": "Proforma Invoice.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec27ee0-1bd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773072765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072765, "uuid": "2903c69b-d102-40f3-8cc6-040073fbfd6c", "comment": "Malware payload", "value": "911a05b82264078103c0d8afd610d561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072765, "uuid": "72672e9d-2bdc-449b-965f-2b718cb89bba", "comment": "Malware payload", "value": "863074914d88d72874e616de171bfababc9c11bc53bf39216b3db52ab02c11b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072765, "uuid": "94f9765b-4c40-468a-93b1-ed28c4d20715", "comment": "Malware payload", "value": "8bb5284a0189770c519f0b2579685b6c1917d324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072765, "uuid": "fc150f58-b8b8-4c93-b2c9-302fae5b862a", "comment": "Malware payload", "value": "5e0357cb4f13e9b8da79c3135872f73c34eb71feb744437cfe9133c9995709fa1244f89efd69fc863fa977802d37d326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072765, "uuid": "20825616-8d0f-49c7-8ecd-125c26fe2d7d", "value": "T1712733CFD1B074A3F256F67E6111A2408743F9C4B2C1ED1873D093835BD6BAB79A426A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072765, "uuid": "913cc3a1-92e0-4aec-bc07-91d1e1f6452a", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072765, "uuid": "cb7b9a21-e35d-436b-a791-b06e6c272ac0", "value": "393216:j79vpxNhD5aZOfFuRbwrQy/OacEBV266DOrlvMFoObnlW9jA7WNcZejz1/pNFC:j7xMRA/OaVQWlvMFPlW1Aad1TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773072765, "uuid": "4c73dbdc-0492-40b7-82ef-5cecc9bbae21", "value": 21860360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773072765, "uuid": "8608d0bb-bff2-4629-baa0-91154cdec447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072765, "uuid": "d6c284f8-bbf1-4a87-9694-d80fc662a6a4", "value": "vm-supervisor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afe87bd-1bda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773075899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075899, "uuid": "045c6c53-d4e5-4d2f-97b2-c509684e92a3", "comment": "Malware payload", "value": "30f56dc05d2ed7aa98df88698aae3cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075899, "uuid": "c158a10e-7ae3-43c7-ae75-d12f7aa73b1f", "comment": "Malware payload", "value": "865827b75a22b69bea6f6e569c2313ff901102eb30aaa41c7fc3de89b9535c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075899, "uuid": "7e1f22a5-a562-4bd0-a70d-31458bb80c70", "comment": "Malware payload", "value": "9e1466a0c10e51740004f31de07fcd75d6be346c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075899, "uuid": "3149a3d8-7a71-4697-a8b8-8e577356a39e", "comment": "Malware payload", "value": "5462ba8044566fea94c57ebb0a53642f8b7213ec11c79fc16bbcc3616c0633e1bc70d0fcf967cddb1ec49fe88bc61c3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075899, "uuid": "e2e8fd18-5d28-4395-8450-246fbd2cab49", "value": "T120C6E6ABE2A4F168C359817AC1628A00E4F371770FF7C7E70292C7748A129DD5D7AA74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075899, "uuid": "52a70b49-3ff4-4d44-bb5f-0782cd469f54", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075899, "uuid": "1e34509a-d1d0-4d61-a5e7-fae9577bb26f", "value": "49152:jX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwN6cXCBz+CO+:izCoeoT2tBJTtJte5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773075899, "uuid": "912144c4-ff82-46e6-ad0e-5e9512693d37", "value": 11781632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773075899, "uuid": "285089f5-25bc-428a-b058-386c90309c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075899, "uuid": "81cd9ae7-2fed-4d83-a7be-27af19b5690c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.36749466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bd7643-1b90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773044292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044292, "uuid": "156d522c-4e37-406d-b7be-2172c96dee6b", "comment": "Malware payload", "value": "bdc248b7ad0e4e28d30ecbd476a8e944", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044292, "uuid": "a9e9776a-fab4-44f7-b2e6-03eb5a96a6bc", "comment": "Malware payload", "value": "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044292, "uuid": "179cf950-5590-49fa-afd6-36d67dcbb667", "comment": "Malware payload", "value": "f12acf3c9d123277961ab11c57ac480f74440e05", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044292, "uuid": "9fa6c4c7-a007-4b7d-bc47-859d4fb8b505", "comment": "Malware payload", "value": "341c46f876c7502e2f22d0941e306b40d590b90a4630b9df2d27639429a91e5359a87d117f5b0e0ccb4b4ec4ce1bb361", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044292, "uuid": "5884ab61-baba-45f2-8fb1-bf4ee6f45795", "value": "T19A348C0676A558F9ED77813D89528A0AEA737C450321EAFF03E043626F536D09F3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044292, "uuid": "261995d6-4547-4138-833c-035a805b4242", "value": "7c443e2d238a0838878ab4cae0571492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044292, "uuid": "b4c4669f-6113-4619-876d-d2f94c25ae7d", "value": "3072:N8h1DnnA4tDw/sliLbjlJ6Bd4MD2vUQz+K1fKiKjX6mNasZ74mGhzfx7:NS1DB+ZbjlYT1cUQz+yfKVOYZqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773044292, "uuid": "570c7514-fa84-4316-86da-3524fe60d3d0", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773044292, "uuid": "ab1f1dbf-6d2b-4714-a633-492b4ed83531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044292, "uuid": "e9af356f-a00b-416d-aa28-47e23270a329", "value": "dump.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c115b0-1bff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091973, "uuid": "5807c1df-68b8-4c20-be65-1d322688a59f", "comment": "Malware payload", "value": "164d7f11406aeaeea2b814a700176a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091973, "uuid": "dfbbd91d-dbc4-4570-ba21-233aedbc8bd9", "comment": "Malware payload", "value": "87c266e14685da69531d6e6fd8128c8727a4e28cdc372a6b84718d85c804c705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091973, "uuid": "8e5db0b4-7f40-4d8a-b64c-4867a52b7451", "comment": "Malware payload", "value": "5d753f117d68283b967f7cc1068293265cb2509a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091973, "uuid": "75e7daf5-546f-4465-8511-064071fe1e68", "comment": "Malware payload", "value": "ebb3981263a86721a6b2ad87f104b330d0685f118bddcbf11670c207a5ca9ef57ac9e5741ac4721c1d454b3035b78813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091973, "uuid": "b04dda17-ebac-48ff-ab58-c3b30a62f384", "value": "T1DDA5D03FB28B753EE06E5A367A72E210593B7661A4168C1697F4C84CCF250B01E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091973, "uuid": "115382de-8ed9-4eb8-9d30-e416df54fdfa", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091973, "uuid": "a542275d-5501-4256-a9e8-82993234e79f", "value": "24576:lXNrSLScusMmOkKIhzvLK4c7RTVqP+GGDu+uZ2w6OqCu5+EmcB9535T0we6CRwHI:muI5h1S9kP+bDuB63Cu8E9Bvd0/Nrbz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091973, "uuid": "1f4f5ab0-c125-45a7-a902-13dc5d3748f1", "value": 2094616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091973, "uuid": "2aebff38-1dbd-4ad0-974f-dd1eb2540b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091973, "uuid": "790e9275-4f8f-43cc-8918-8d6ad0482bee", "value": "CryptoVista_Installer_fSRqK__2_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db82a0ad-1bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773066344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066344, "uuid": "c5897270-e094-45c0-b292-ba2ac31a7e72", "comment": "Malware payload (Vidar)", "value": "091fa9bbcfae5ea1efd130272b662bef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066344, "uuid": "1d548234-7ec1-495a-9d3a-7fff6e819528", "comment": "Malware payload (Vidar)", "value": "8a887f3bd529c10a4cd8c86bbeedc47494416a6444bf0590fbf66dddeab3ee30", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066344, "uuid": "7624ba27-3249-4956-bbe7-50d153ecc1be", "comment": "Malware payload (Vidar)", "value": "345403f03ed737354d32c5261c6b16b5bcb04cfc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773066344, "uuid": "24bfb9da-16c9-4fa4-b2bf-0618e14138f2", "comment": "Malware payload (Vidar)", "value": "9ef747a55e7fe775529128b10fcac58b0490a37a7b035cbacf8656fe62d18ac0ccc931bc5c0c2c3ff2b23c23ef0c3083", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066344, "uuid": "0452b099-72fc-4609-b101-acc92a8de182", "value": "T10BC607AB72E4B368C35D823ACCA7BA00A4F371750737C3E7029147558E169C5BF7AA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066344, "uuid": "d8f136e4-0cf0-420d-bd1b-19cd33eec2cd", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066344, "uuid": "51f1c7fd-6f58-4ab7-a38a-5235558fbe75", "value": "49152:8X18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNCcXCBz+COn:pzCoeoTOtBi2evl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773066344, "uuid": "29917479-6d3d-4aea-a2e3-637465f8e6f9", "value": 11781632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773066344, "uuid": "5907e138-7343-42e9-81b5-95d9f919cb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773066344, "uuid": "7ef47b76-3ddd-4fa5-935a-9f92afc5ec34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c2c207-1bbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063703, "uuid": "75c70a1f-5696-4190-b3bc-c16683a965ca", "comment": "Malware payload", "value": "9fcfb6f2f4c429410ba73da4023105d0", "object_relation": "md5", "Tag": [ { "name": "188-241-219-55", "colour": "#87FEBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063703, "uuid": "51715f7c-2837-4063-8520-83d94621c60c", "comment": "Malware payload", "value": "8adcea233db10edaf4931971d9980007fd4ee2c3bf22a664d3603ec73afc8178", "object_relation": "sha256", "Tag": [ { "name": "188-241-219-55", "colour": "#87FEBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063703, "uuid": "fddaca8d-1623-4d35-9ae1-8dadf5fb49f8", "comment": "Malware payload", "value": "7fec4ca368d78d05d5935721e8702c62f29a8354", "object_relation": "sha1", "Tag": [ { "name": "188-241-219-55", "colour": "#87FEBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063703, "uuid": "b7ad7c86-783d-4ee1-87e5-048b2fb373ce", "comment": "Malware payload", "value": "c61c2ffd10e835a06c511c1613d31aaf005d4f14b8f632e837b057fdc2356001a9e9dd7fd9ef497bba6db02e003d2ec3", "object_relation": "sha3-384", "Tag": [ { "name": "188-241-219-55", "colour": "#87FEBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063703, "uuid": "9b2636c3-8352-49af-b707-a535a5bd4059", "value": "T1CFB65A87E8A115E5C1BDE13089669263BB717C485B3023D72BA0F7683F77BD06AB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063703, "uuid": "7014920e-1c36-4d09-af0f-7e1ffc09c1c0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063703, "uuid": "dc838604-2fff-493f-960c-1bf330c63788", "value": "49152:FLW2PrEZVHsPS36p2yWspW8ipAJZs+/EPESppZ2XS0OuZ/oFsI1Mp8a/vmuwQ1kG:FLXFiRuEc6mE1O0QCeD6e1mPibjTXfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063703, "uuid": "b3cccad3-d174-4ac4-9163-27994c542b09", "value": 10883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063703, "uuid": "ab2ad832-dc55-4f45-95ae-5e7a272664d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063703, "uuid": "26cbb981-1edd-4fda-a966-33770da1743e", "value": "peer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b1b6c8-1bbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773062554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062554, "uuid": "203b61d3-686c-48c2-9e77-990ab47fd1ce", "comment": "Malware payload", "value": "588f68c85151b4936756adf8625c934b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062554, "uuid": "787c853c-4b7e-4a1a-b13b-460481691ad1", "comment": "Malware payload", "value": "8b334de90d7ad69ac7720bf110e03b2883bc6f4870c177be2cae081c291d5d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062554, "uuid": "9c8f145a-05eb-4da5-b437-804408ffea1a", "comment": "Malware payload", "value": "cc3042b4197068904b958ab0ab396e05e00c241d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773062554, "uuid": "301b40b6-1cd9-434d-a743-4ec6732fd74b", "comment": "Malware payload", "value": "0e2de97d57378bfcb1679eb7e018bb56725da20bc5fbb1a17b29d83fbe9fc4f35a4fb13ae02fd8d0dd2483acf0bd0bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062554, "uuid": "88e3636f-56c0-49ba-ad40-ee91ce1c0117", "value": "T12A363395339C4A33D15ECF3E88FD8876CB3520199228E796284D6B9E9F31BC64C117A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062554, "uuid": "fa17ef56-08f2-4d28-a79b-5965a42ff581", "value": "98304:lvx6FSXMQAHi6Y2rVHeUaNia7oqz87lKDtAjskOn6Q9TYr1QKksmrq:lDXzAHvY5RNiWzclKDEu6QNYZnsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773062554, "uuid": "adeb7079-c70f-4cf5-b994-58a5d8481e3a", "value": 5115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773062554, "uuid": "83721282-e2e7-42c1-a2f0-fdb15ef2ed92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773062554, "uuid": "a401155f-f6a8-45ab-b347-ee32908d693a", "value": "isxodFn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b021bff-1bb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773061726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061726, "uuid": "a10bf2ad-0740-4dc0-9d14-095628779793", "comment": "Malware payload (Vidar)", "value": "07b7534205d451423062fa20ebbaefb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061726, "uuid": "c0b26638-12a9-42f8-813c-356116c33b2e", "comment": "Malware payload (Vidar)", "value": "8ba2f8ed214293c731f0ec15db00fd8555f2bcdbec4c58c9d9b8cd4bbcf7d657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061726, "uuid": "46e62fbd-2878-4be9-9284-4cc648a98fcd", "comment": "Malware payload (Vidar)", "value": "6d7ac5fb2cf79b10f799a13c7dc3b0c4d09fe2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061726, "uuid": "6228dc17-cbc9-49d0-9f4b-e68dc610bea3", "comment": "Malware payload (Vidar)", "value": "e528f03965f1689c1d6a33bb7a48a87bd250f3273a4c9bf4b4aeb11192be3f1d544b87551ddfc91fbc7ada9d67969205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061726, "uuid": "73edbab0-fe25-40bd-b451-434cdbf19472", "value": "T1A3D58D03AC9188BAC05AA3359CB65292BB75F8580B3273D71FA367742FF27E05939744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061726, "uuid": "bc8a2fc5-126a-4f07-b8e3-c24f21f523bc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061726, "uuid": "8dd72651-2376-45b8-bf41-60ac47d85e2b", "value": "49152:jmEEDmDYpoFqsziNOiO14Brvbo8zSsmd5260Bsp:jXhWo4BvtSsmusp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773061726, "uuid": "ded61a29-9b34-4d3c-88a0-9475fe85530c", "value": 2774979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773061726, "uuid": "30623d62-52d1-4733-8554-91ad38a4e871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061726, "uuid": "ba0fccec-9651-43b2-9138-6add2028e2ca", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9813db-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1773070994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070994, "uuid": "93e3a3f1-bcd9-4383-936e-dec706cb9c5e", "comment": "Malware payload (Amadey)", "value": "99a8d3cbe6f6c2c9ab6f420e6933defc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070994, "uuid": "bc60dc46-aebb-47b3-9303-d5be2f162fd5", "comment": "Malware payload (Amadey)", "value": "8be7f594f8773283f61d37ce24b74985e5569d9c1396c07848e1469a81cd3f5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070994, "uuid": "f7a260cf-7c06-4ee9-bba6-bd715a5b0c3a", "comment": "Malware payload (Amadey)", "value": "1bab43dd447d6097352985652758f560313433eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070994, "uuid": "d18587c7-5d9e-4576-a7a3-d2ee7ae7bfba", "comment": "Malware payload (Amadey)", "value": "cae19595f9955c6711ce0a104e0ec41c63e2c5dd72aedfb06a7779cb165232fb03a3b2b90b9328421287dc365c24a6e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070994, "uuid": "389d8603-ce08-4ef3-9aca-b862fe454a16", "value": "T1A7C5E137B28A633EE46E5A3759B2D2205C3B7A61A41F8C1696E44C4CCF2E0601E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070994, "uuid": "cc136501-b4e2-445c-bdb0-c985df5818ef", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070994, "uuid": "36a67f4c-1f92-432a-a76b-2a1bead061ec", "value": "49152:kN61T1mUVRGHtuigPt/rYmtasswUJbnbVfTRhx8:kN66UviuPPtzY0arw6pfR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070994, "uuid": "74212c16-85b0-48c0-a144-78bd4f0e76e8", "value": 2740927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070994, "uuid": "6bc5eed4-8049-4569-8b75-e0c21b3151db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070994, "uuid": "c34d9e6f-9cfd-4c23-ba10-601b56e2c44a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9d2ad4-1bef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773085245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085245, "uuid": "bf86d19e-c904-4efd-a139-86a556128492", "comment": "Malware payload", "value": "a929ec3955d6f2494323109caad4e0ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085245, "uuid": "3ddbe781-a33e-4490-8071-482d042996a7", "comment": "Malware payload", "value": "8c5682afe2a14bf8d28f9ae3d9c46e9cdd9484cc91ab5d038eae70e50487b7c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085245, "uuid": "7dc27749-2d61-4d9c-b22b-c7911e825261", "comment": "Malware payload", "value": "55694ccbcfe253f8201b068b03c8441da6d42cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085245, "uuid": "e9d09cde-aecc-4ee7-887c-9b674ed67311", "comment": "Malware payload", "value": "8e774c75e785f9f06f6a07bf766809634deb4ca636fa84136b5c7c587d8f48d9533b574b1a8dcd2108edda772e9a2cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085245, "uuid": "7460b0ba-0197-42d5-8c02-28b7ab9e374d", "value": "T1CA21D859477E969BD692397BC52F0374FE555D2CF6A1F20B83111308CF1405E2A19889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085245, "uuid": "b722bbce-6dd2-45ad-8659-4fcb78a5389c", "value": "24:3h+99UWWRrndQTUl0/qaqOMFvoQuLZMGdaYplVkriAEiwF4t02ZD:A8dY1iaIuL1TKQFCzZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773085245, "uuid": "c6a22f79-6bd5-499a-b66d-e0a84f489b32", "value": 1388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773085245, "uuid": "b0e2ff56-2fb8-4205-acd7-6b7ac2b77452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085245, "uuid": "9dfda3cc-ee99-484a-a8be-ac4c39e0f5a7", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28276afb-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773068620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068620, "uuid": "1bcb2737-5215-4306-a1bd-93c557f84854", "comment": "Malware payload (VIPKeylogger)", "value": "c4ecd0f56ebc2082ead07ce12cda1509", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068620, "uuid": "25e11121-ed4d-4de3-a541-559c78e47560", "comment": "Malware payload (VIPKeylogger)", "value": "8d1f59c65ebe64d0e817ffe7ecbf1d5a4bc3768d896c934b00dfd57263c3fe15", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068620, "uuid": "e7ef47c3-e487-40f6-8535-094df63dce4e", "comment": "Malware payload (VIPKeylogger)", "value": "3b13d5ee129b49358ab1d1741de9cc886a96162d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068620, "uuid": "a18dba4e-88cb-46f4-9107-bc3fb87703f4", "comment": "Malware payload (VIPKeylogger)", "value": "2f7f0f54bbb9c2db0ba209207997e75c0b37af88c1b0d64eac18e6d6550a5574c09780bbb86b0113aecd3100d56055ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068620, "uuid": "51952c88-b261-4496-a8cf-680a04698833", "value": "T1FF358207AECF35B30CDF7D763C8856F9E014414B752439E96288ADAA293B0E795EE311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068620, "uuid": "384f8193-d32d-430a-baee-0eb4cd5846bc", "value": "384:MkAxX72zQvyjWgF1Ro0gMONwFXGdChGpzAwZ5YGHGW6RXF5V7FyFbvBk/Fy5LzHo:l6f4KXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068620, "uuid": "38f41f38-9462-4855-b0df-c00ad5922e93", "value": 1125502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068620, "uuid": "08cc9e0d-d1de-4363-be6d-8fecc6472a0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068620, "uuid": "b4114bfe-1b4f-4fd2-b334-66ba92663429", "value": "Purchasequotation784...vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eff4c8f-1b74-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773032124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032124, "uuid": "808e0416-052a-4a90-9c8e-e0232376dbb6", "comment": "Malware payload (a310Logger)", "value": "b810f518edfdb5d0e4dcd008132413bb", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032124, "uuid": "01e8e49c-ae64-4c4a-986f-aedf3bc26c7b", "comment": "Malware payload (a310Logger)", "value": "8d9f8265ce85222ef929005522d3c45fc185cccd1ffca0b365ef3b2b165d7868", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032124, "uuid": "01a26ec5-ec48-491a-9913-ad536f90c588", "comment": "Malware payload (a310Logger)", "value": "e87ce37d8c0621eabb3defc0b6ccd2567b1d5b26", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773032124, "uuid": "0bf9ec59-2191-468c-b05d-d5ad05f1d39f", "comment": "Malware payload (a310Logger)", "value": "c3e75c5f8b057befb17b0cc14594bc6dbc9e9a0ac6f8fc0e03de79b1f366056fdedbb6564a9c9bf2e14288b702e7b597", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032124, "uuid": "ee9255c4-383d-41c1-a79c-767485c1ec54", "value": "T13255CF0273C1C062FFAB95734F56F6115BBC69260123A62F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032124, "uuid": "e9692b62-9142-442d-a3cd-cad00f12c87f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032124, "uuid": "8a5a4361-55b2-4f55-a378-9d9e44be12ae", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXdawpgsmmOUuGixPFiuIgIENHnUs6x:IPVt/LZeJbInQRawpJsNLIl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773032124, "uuid": "75e1dc13-ae69-4193-99cf-ec33a9e5b376", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773032124, "uuid": "cd37e7a5-9ab9-4a7a-9b64-edf9c831f86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773032124, "uuid": "be323857-fc80-4af3-9f8e-de8470c6ff16", "value": "MT103 - Bank slip.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2249f8-1b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773034753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773034753, "uuid": "1094dcec-64f1-4a83-bc0c-e492a940a37e", "comment": "Malware payload (AsyncRAT)", "value": "7da679775374929471b9140aa84bcfb1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773034753, "uuid": "a33faf46-e500-4451-abfa-b042801402ab", "comment": "Malware payload (AsyncRAT)", "value": "8e09b0322b18cbb0be8a32eb58374fac7a1868095f68024f87c41e89649c133c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773034753, "uuid": "fbee3613-5f9a-4c09-971f-3c4d3412639a", "comment": "Malware payload (AsyncRAT)", "value": "8e41ab546ab256dfe1f2c66b24161517476e717e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773034753, "uuid": "3618a8ea-56e0-4e1e-bd4d-c080a65c59bb", "comment": "Malware payload (AsyncRAT)", "value": "4405920dab06821583bb6cbdb667ffbb44c0922ed802a9f3366d87d4440ac4d4577c85170299d44beadb608b30f445d9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773034753, "uuid": "fbe53198-780d-4753-b4ac-3d910efbc986", "value": "T1AA033A08B7F84965F2FE9B7D8DB182005335FA579D22C79E1EC4508F5A63788CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773034753, "uuid": "9b7b26b1-0ac8-41d1-8603-a116286201b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773034753, "uuid": "220465a5-f596-4c3e-a889-b24d6af250d1", "value": "768:2nCIcEJbMSVnbTpwFRbJpB+WWP7LY18j+:2Cl6bMAnb9wFRbR+dq8j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773034753, "uuid": "e11adf0c-074d-49c9-ae83-fa8ea06b2a24", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773034753, "uuid": "70f335b5-6ea5-4522-b6bc-7592f5f9b58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773034753, "uuid": "64f6cff7-5f6c-4885-a410-c53e24adc135", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77be86ac-1ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773051144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051144, "uuid": "a946141c-5b70-4ce5-b5b3-fa6de8692f26", "comment": "Malware payload (Phorpiex)", "value": "362fc53afbda6450184b73746802a6fa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051144, "uuid": "0de76e94-3022-4550-a2fc-a00dedf52556", "comment": "Malware payload (Phorpiex)", "value": "8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051144, "uuid": "b206ad6b-8367-48c2-b633-2ea8d5ff4d6b", "comment": "Malware payload (Phorpiex)", "value": "4c289f978c4c464da05cee4c33101ea7f5291d7b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773051144, "uuid": "917fd87b-a91a-4ef5-a574-0946f0ff8434", "comment": "Malware payload (Phorpiex)", "value": "b53e747b9d036e5904201f7bfa94077ad555d84eec9c0f362ec44c1323aeb4aa7d4dd4318118422fbabfa4e0af590fc4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051144, "uuid": "dba90a00-150c-4fcc-a90e-2566582e02f7", "value": "T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051144, "uuid": "9f63cfde-9dc9-46fc-a454-e71c9ee481e3", "value": "27080eab3ded4a4cce0697f22f2df921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051144, "uuid": "bb117971-4176-474a-b2a6-b71a7d21d6e4", "value": "192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773051144, "uuid": "ff406ffb-6256-4189-b2d4-6a7d2cdc604b", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773051144, "uuid": "59f61a2a-f142-46a2-8bbe-13b6d10907ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773051144, "uuid": "5056ca18-f60c-4743-9cbe-f561c0b78d11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677907ed-1bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773064001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064001, "uuid": "8ab82f49-36fc-4355-939d-7ce065daf776", "comment": "Malware payload (Formbook)", "value": "871faf43e48c37ed1d378331ef109c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064001, "uuid": "4610c2d1-8d8a-4697-8529-efe35cdab66f", "comment": "Malware payload (Formbook)", "value": "8e59fd060314be874b16a85af69bac2ca32bb8570698d635d33aa18c9b0d558a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064001, "uuid": "7f05dfd6-0252-408c-bf45-58083e937bca", "comment": "Malware payload (Formbook)", "value": "c9842e3dfb8f6f44ff08ff5790b231ede99c57d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064001, "uuid": "c862f43e-b489-4103-b680-e2ddc8298bed", "comment": "Malware payload (Formbook)", "value": "9ae90088f05367d52e5607f5e658a2214c2f7fba9bc25a51802eff7f9aa40120fb5b444966c1fedfa623795b08c2bdea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064001, "uuid": "fa9ff41f-6758-456e-80c6-70fa56b16e28", "value": "T1D845CF0273D1D062FFAB91334B5AF6115BBC79260123AA2F13981D79FA705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064001, "uuid": "24977fb9-44ed-481f-ae17-e59c36a3a747", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064001, "uuid": "e2c58843-007e-4c89-b98f-23b4418535c7", "value": "24576:/5EmXFtKaL4/oFe5T9yyXYfP1ijXdazWBcpfAjbvj9ppcq:/PVt/LZeJbInQRazWWpfAjjzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064001, "uuid": "d2c041f0-0d14-47d5-a3c7-9cc586f0a367", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064001, "uuid": "888866d4-a590-4722-95c0-080650a377ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064001, "uuid": "688cb66e-971f-4399-ac55-847e99314bf6", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c907f8e9-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037107, "uuid": "461ecf1a-b1f4-4bb3-8584-9841848bb98c", "comment": "Malware payload (Mirai)", "value": "e92252b97ba294840fbe789f4489bd81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037107, "uuid": "f6c54500-91c2-4c68-a3a5-d85a3a5c4d8f", "comment": "Malware payload (Mirai)", "value": "8e6a4d844efd3d5a35dbe03ae9fe56e6d7be214a0fb516bd2c6601511cd84c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037107, "uuid": "c723e922-2029-4f97-8a7c-35c7f2ec3d8e", "comment": "Malware payload (Mirai)", "value": "5387a120fc6571b5863d9e4f5c388601b4bfd374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037107, "uuid": "8b9bda4d-1f1a-47c1-b49d-d61687a7ef3f", "comment": "Malware payload (Mirai)", "value": "3bb50e3ec2f39a4253e511ba3ddb4c530eae5b7cec8490b29ca84f8d5db3fbb6e23e38f9c27c3f2e8a8c4bd431858d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037107, "uuid": "d29b30ee-5206-4b9b-90ae-7fe5b05f0ff4", "value": "T155631793F901DF77F40BE3B604D748127530BBE60E925A72722378AAEE760D51922F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037107, "uuid": "9ff7554e-8f3a-4255-90a5-85f575715014", "value": "1536:ksCsDpDpqqRUw/AGeEe9C8XA9fwxynZF1UdcOzX2FwoTN:39VBUwdeR9GfwxynZFydc3TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037107, "uuid": "c8ef4713-bb5f-4413-8f48-bf700c9d49ed", "value": 73188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037107, "uuid": "055002d8-c1d0-4d05-863e-44fa737f1491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037107, "uuid": "e97b0286-176a-41bc-87e2-7f9b99d81d9f", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897ab446-1b60-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773023686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023686, "uuid": "e9b9815d-08bb-4041-8938-0a91cd1601db", "comment": "Malware payload (Mirai)", "value": "788c90aefb3dd3577257bf86fdc4ec80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023686, "uuid": "5dffb860-efcc-474a-82ee-96e0d91a9395", "comment": "Malware payload (Mirai)", "value": "8e91a2e5e6a396a4a772c8da0a4c8467faa7b7f3d1841289f2f950e7295a92f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023686, "uuid": "483e29f2-2f5a-474f-a38c-392adfe958dc", "comment": "Malware payload (Mirai)", "value": "970f8d148e97b3cca78e46d86be25d466aa48cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023686, "uuid": "3548dc59-476f-4c33-805d-fcbee0e46322", "comment": "Malware payload (Mirai)", "value": "b4e2b89c21e7a2eadb556e474a895a60215b95a050897ad9877d1d1b0f009a8cf5bf7abd1cab9567cca27de20c28b337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023686, "uuid": "8420631c-342f-49ab-ae23-8b41409ab144", "value": "T12F936C41B30D0A57E6571FF03D3F2BD883AEDAD051E4A58A361FAB858271B321487ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023686, "uuid": "22ce7544-0ce8-4081-ade6-02afd4f629ec", "value": "1536:8nHxZZjOCUsIBppBaUFzUXBRz9WmVBfsglwNoBH3JLgOqAZQWe7u6:89ymIBppBrUXBRIyBNlwNE39b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023686, "uuid": "ed4a82fa-0acb-4b6d-b443-c17e834304fa", "value": 93908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023686, "uuid": "9dfdf83d-0b98-4335-8e51-cea44b0df97d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023686, "uuid": "2b8cd5a0-e20f-4afd-b08b-b3ce843c43b3", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b551bd-1b86-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773040101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040101, "uuid": "a42f30ab-1ea1-4b53-9290-4b4689db5a9c", "comment": "Malware payload (GuLoader)", "value": "0f517aa8e002ec3e5167539ddb7daece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040101, "uuid": "7ad87171-4170-4706-b7c0-f5e26d21e0aa", "comment": "Malware payload (GuLoader)", "value": "8f0eb8904bf7e5d851a5dad363c6c9523de8006cbc8b6f824ff7647a582c80ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040101, "uuid": "a3d0d94e-399e-4c2b-8193-4d37f7a8d589", "comment": "Malware payload (GuLoader)", "value": "50fa6ea48a0322a95feca8d1f020dd531c9e75dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040101, "uuid": "31e7ea4d-2d3c-4e74-af4b-e90d68cbd3c2", "comment": "Malware payload (GuLoader)", "value": "f26637d33da7f57304973a3f9a8e66eb6f6eafe6569804ac3d8c6af894d2f3280c9442193859896f06dd4131d737f3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040101, "uuid": "738a5d62-7e39-47de-8b43-1a87a2e8e19d", "value": "T186D401123B90D945D397C4304EA6BC67A599BC0DFCB18AA72311BAFD3D75322A84F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040101, "uuid": "2eac98c9-a313-4fa6-8461-4b736023806f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040101, "uuid": "ec3fa43d-7679-4a4b-b0e5-8dae04622475", "value": "12288:vMwNPjD7QHvdzs2T0zXY6zMtXGCbF4XNVX5l8ym//GW9w:vMwJa1oa0zo6zMt5bF4XNVJl8bGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040101, "uuid": "f682641e-c9bf-4c71-a56e-27bc2d60dc78", "value": 606776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040101, "uuid": "047aa4f7-8581-4b8a-9088-c903d7c47a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040101, "uuid": "f244272d-1e07-430c-8f00-71777731124b", "value": "Bank Information Template.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df52ac00-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053895, "uuid": "a28344b2-5d7c-405f-9cc4-1801583357a8", "comment": "Malware payload", "value": "c2cab1b7f7f5c7f4ebb8b0bddf89263b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053895, "uuid": "e4b42896-5398-4bd2-b8a2-da3e6925050f", "comment": "Malware payload", "value": "8f29241c7a0c4a40da465c0ad335742d3ff04b94caece5e7ae1ff41d922e4b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053895, "uuid": "d84f5d89-9ad1-49ab-8f04-40b681a33d9f", "comment": "Malware payload", "value": "69dc8c65704f3f419e276c1f41a40334203ce28e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053895, "uuid": "a9d6931d-e9e6-4a2b-92d0-7afb918ae0d3", "comment": "Malware payload", "value": "ad67b63346f74f20aadd7b49c21e29d582b114f914949119147c08fdc0fabfc61eb560b3b7aa1d1fdfb673dc68b3b68d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053895, "uuid": "cface7ff-d22c-4349-9dc3-af71a4b0a3b2", "value": "T165240A0B63E30DB8D667D17982B7D7729932F8100334FD1F1668DB326E65C604EAAB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053895, "uuid": "9afcf92c-1a80-409c-b22e-9f8f8ad967ed", "value": "15d6a885172edcf02adb086de45c77a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053895, "uuid": "22930352-1645-4d59-a8d7-bdbd4d23d044", "value": "3072:QTiSR5qh9SamLilfj5EQCM39dStlEC8XLfDSZOSmgBpDAxKoUGvoiXohBU0Ti4zE:O4waZdC8XLfMbmgBpzBU0bw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053895, "uuid": "994d354b-d9a9-41a8-b66a-c9c30ddec2a5", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053895, "uuid": "9aa4184f-a21b-4666-b20a-c7ea2ecb3a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053895, "uuid": "9b0486b2-28f3-453f-812d-01c296ef7a46", "value": "8f29241c7a0c4a40da465c0ad335742d3ff04b94caece5e7ae1ff41d922e4b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9107b886-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042596, "uuid": "807dddc2-817e-4f30-a72b-b71313b3cbf4", "comment": "Malware payload", "value": "088d36504d2bba261d41e263bdbf1d9a", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042596, "uuid": "2d1d898d-da6e-4bc6-9613-432167658ff4", "comment": "Malware payload", "value": "8fd0ef6fcd50b9646244289d7ece7cc523d1efe6521551ae59393f6a37be0b64", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042596, "uuid": "3b6b8ca6-7528-46e2-bbff-d3327fd39de6", "comment": "Malware payload", "value": "a1568172bfc2a48a2df380396a176d06a1dbd4f0", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042596, "uuid": "69918fc9-12bc-4efe-b842-d2421558d515", "comment": "Malware payload", "value": "839444a427d6a03120bf0de0ae401c55da8121e6d26aa71669f58517c8bf5434afd412657362733176948b5ee2043225", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042596, "uuid": "e7bbf242-31b5-4b4b-b228-3d26e2f9588c", "value": "T11844CEA059D9725DFEDD62B8723884FC52E80546BEBC1EE92D01E60CE44F03E46BB94D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042596, "uuid": "35da2d79-903e-43ae-b52e-c5637b2993c6", "value": "6144:YHxktl5lNXlEMsBkUK1pownvPo1zD++/Hvy+HcqAv:uktl/NXlQBkUK1DvgdDtN8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042596, "uuid": "e44092a5-2656-41dc-8f02-e1ec966c06aa", "value": 274143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042596, "uuid": "fdc98a36-db71-4e1e-a898-0ed961f3aecf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042596, "uuid": "1d2fc667-42b6-4ffa-a5e6-b3c259d96d6c", "value": "PO AD31250192.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e4139d-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037103, "uuid": "a6b203b2-216f-49a4-b77a-5ecfe36fbe58", "comment": "Malware payload (Mirai)", "value": "c874a3654fdeeda25cbbbd653ee4630c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037103, "uuid": "f6404e2d-604e-448a-b5c6-71a5080a8b7f", "comment": "Malware payload (Mirai)", "value": "91ac5ddad74a971b477d374bb73262b2d1fbcb46bada79d7980fe025f5466667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037103, "uuid": "5c398444-0451-442f-a69e-c4828ab901e8", "comment": "Malware payload (Mirai)", "value": "6170f83f19ac6c700fe15645270c0831308b0485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037103, "uuid": "023627a3-ad80-4fb4-8227-7db1a2dea6b9", "comment": "Malware payload (Mirai)", "value": "95019afa2b53b0138713e17d92f05d7670dab6f6559a8f19e755f1f2bb97c59392165d0d616624e6fe7590ddcdb48d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037103, "uuid": "0747a1dc-278c-4384-9f45-46068ef9ccdf", "value": "T1F9433923E9264F17C00355F065E99E325F22BDEA4E571EBAA171EAF84043DCDB405BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037103, "uuid": "c3af6e10-a1de-4016-924c-2e060642cb03", "value": "768:jRvmK8DU5EN2AuuoQv2t84OtHX/I5E7K+uF3aDuoxnf/TACG0I:jRvTicLxQG8NXvK+uFKDrMCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037103, "uuid": "4fc3fd04-0b8d-4340-aa47-4ab56359218a", "value": 57680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037103, "uuid": "0ab03be6-30a3-4d3d-aad9-2c382fdaaf8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037103, "uuid": "6faa7ae9-e058-41d6-a00a-8631cc59485b", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a12dea-1b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773048050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048050, "uuid": "bd4d58c3-f335-423f-935e-6ebc85d04e91", "comment": "Malware payload", "value": "52f30b94615f37acf042d01af24eeac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048050, "uuid": "601db609-516c-4992-9334-5193bff24483", "comment": "Malware payload", "value": "91bc167f0fc3dbf216acdd53a2f56e70b3c7290ee5eaa1a1fdf3000fdb0ab66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048050, "uuid": "eba145c3-a7e2-414b-96f8-93a0ae50ee9a", "comment": "Malware payload", "value": "74092041eaaf2156099dddc62be1e7f0a6124edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048050, "uuid": "69cf87e2-2924-49e6-a15c-b047c0307b4d", "comment": "Malware payload", "value": "08e7d7beee466db81f5e1d2ac3e2299a67a53f289528409b5a6bf4dc38915ca47c633abf845ff970b9c94404b4321549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048050, "uuid": "97033c78-c7cd-41c9-824d-2ffce7b08463", "value": "T17DB53339DFB84C8DDD8B2BBC91A5FE3497958879530D84CCB9900E8F3997729A60314E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048050, "uuid": "c2455a1a-7355-440d-bf8f-c7d67c6f138e", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048050, "uuid": "c1686de3-515b-4f1c-9c39-1a1698063700", "value": "49152:MFQppzx8z09IrXjZu6bYWUtOyjILrQOPamgJapj4k9o:M81mIVWy0XQ6avJ2zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048050, "uuid": "d311cbe8-19d4-4d5a-8494-f9c122d5752d", "value": 2361856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048050, "uuid": "a6954cb5-0a41-4300-b892-c6ea6ca0e29b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048050, "uuid": "75159871-7c82-40d6-9194-524f6caceb06", "value": "Payment copy.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24a2473-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773077844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077844, "uuid": "0f1494ac-aa08-4b48-b9c3-82b7c7fc2b97", "comment": "Malware payload", "value": "819b942a7f5038a23c68174d707cfeae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077844, "uuid": "bb0dfb5a-ffb7-4bdc-b1b6-56a2aeb25604", "comment": "Malware payload", "value": "91e94cfedf3d3b81d54344cbe99c37c372606f398b6cb175d3c2e251e80b7827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077844, "uuid": "23ecd1ac-6a38-4345-970a-3d11946b269c", "comment": "Malware payload", "value": "564c0a2dfaa067ae150aca08a0668bf3fd0297bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077844, "uuid": "aeabe6e8-0635-46c9-aca7-c5f305497ed4", "comment": "Malware payload", "value": "3622aa8c3ba300bea8db7d7ba9e1a9adf1c7c85c04b3ea5c60c1472f33e72437f72f8de27d98410281296e8fe9f9d863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077844, "uuid": "4decab53-0303-4eb4-85b0-3ca3a07190da", "value": "T1F7E46B22B6E1C236D1235130996492A555BA6C60CB358FCB73CC7F1D6F326C19A32F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077844, "uuid": "4d3a02ab-a4d8-499e-b7db-bd57148edeeb", "value": "98f9ba04d081d569b98618887d1acd7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077844, "uuid": "d07e7a8d-5235-4ba6-a564-431d044f4d73", "value": "12288:dO1YiLJzK5xo+B+LpmSfuDupBHf874MtflkfATd:dsk5K+B+wSfcupJ874M9i4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077844, "uuid": "2dbfc992-9043-42ca-abde-53180685fc7f", "value": 706120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077844, "uuid": "e819cbd9-48cd-465b-863c-1c938b92ca2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077844, "uuid": "e330acde-f37e-44c3-a70f-ee3e1791308e", "value": "SSA_EndpointSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f17a21-1b6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773030008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773030008, "uuid": "612ec93b-add8-4018-9756-3518d531ae94", "comment": "Malware payload", "value": "326683813b145cc5469dff1f77c701e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773030008, "uuid": "6c5aebf4-f269-43d8-9ca5-c5d52bcd2e30", "comment": "Malware payload", "value": "93439fe9b45d7b6e9fcdc5e68fd47677ea17025e4eabb6f1468cb9ae98ee8a5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773030008, "uuid": "98a2f9ce-cd5a-443a-b81b-d2622dcac2d9", "comment": "Malware payload", "value": "b31eb0e91c6e70719a15dd61e7e374ce2b7782c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773030008, "uuid": "8c42428f-480f-4a77-8996-0ddb2a47eabb", "comment": "Malware payload", "value": "59759ce51d68803aaba89e1ed08825a2d1492a2f3fa6fe1bafbff4bd21a6055304b4401883dea392cdf3661401105863", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773030008, "uuid": "8701c21a-c06c-4f00-89b3-a03e07ec4bca", "value": "T18F945B03F68180B7E61F0135229F9B656EFEA5106392CEDBC3F009B85E767D25B32958", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773030008, "uuid": "afa89396-6c23-450e-b7cb-d2c515508d81", "value": "f86ae2df15d743de85c724c15b1dad25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773030008, "uuid": "e523984f-db0a-4ef0-8ba7-94401ea7a47c", "value": "6144:u9rSWpovUahUzo+NY7+c2wkYUL8NuS3ZCXfrUNfu:u9TpofojwjUL8IJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773030008, "uuid": "cabf1f15-d252-4a7a-b78e-ebe93e8d5b17", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773030008, "uuid": "75eac8bf-281c-4cf7-94a9-4ff306a64517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773030008, "uuid": "28b2b7f1-34bf-4bef-bd2f-b13187aa8c4f", "value": "g2m.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad4260f-1bae-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773057001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057001, "uuid": "2d580e1e-4840-4559-b70a-e30ba6218bc1", "comment": "Malware payload (QuasarRAT)", "value": "c7c677f4d824b6e894476c265f0c40f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057001, "uuid": "98196986-600b-4e84-b1e0-214e99801c9d", "comment": "Malware payload (QuasarRAT)", "value": "940773be1f5061eb206c7bbf3030765aac7b973f5a9915c62ba893a2d97b28f2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057001, "uuid": "4611eab1-58de-4410-807a-aaec843d5fa4", "comment": "Malware payload (QuasarRAT)", "value": "8b935947b5442b4afb7a0519cf8a107f2aa82e09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773057001, "uuid": "24b30209-73a1-482d-879c-d366790c008a", "comment": "Malware payload (QuasarRAT)", "value": "df4d85e3698e34bcca9f70be6e1604f903a9ba4b70c55c59dd4c0beccdfee954c1c7d6beac33d611cb688abd2704cbf5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057001, "uuid": "f325c65b-14e3-434b-b258-9dbd7ce1207d", "value": "T140D4122037F9864BE1BF66B898F161416676F663B623E74C1C8462FD4433741A9C33BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057001, "uuid": "e6d92671-0bd2-4974-99bc-504b6b49fb01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057001, "uuid": "9d669577-f00f-44ac-aa6e-5604651b122f", "value": "12288:cPRb9qoSjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfN//TT34:cJ9mjkqjVnlqud+/2P+AlUDcPt1aKFHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773057001, "uuid": "f63e03f7-a12d-47a7-945a-ea5794afda3b", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773057001, "uuid": "6759062e-403d-405f-bb1d-e40dbaf8219f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773057001, "uuid": "113c7b08-428a-4ad0-a331-5de27700e322", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b77fa6-1b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773048995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048995, "uuid": "526b2612-a995-470a-b7c2-d559372cb283", "comment": "Malware payload (CoinMiner)", "value": "295126398116841abd2091d4cf70445a", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048995, "uuid": "419acf73-00dd-4654-98d8-f696283d125a", "comment": "Malware payload (CoinMiner)", "value": "95c31578e0ec157248749c8ff43167130cb3c3335280586d830b69b1ce6fdb17", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048995, "uuid": "2f061535-8aee-4a26-9d01-6abdf2397c54", "comment": "Malware payload (CoinMiner)", "value": "a4d8d75cd1d84b9800090e7228e6530ebc4dac18", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048995, "uuid": "4e22b4b3-f4ea-493d-9f65-b4a36a39d943", "comment": "Malware payload (CoinMiner)", "value": "c6bd6642c6d06f112b67ccabc72d63a46b5d48b547dda767d7e571f8afe21e8bd12ea0521e2bad45e37fda35043d19c5", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-1731", "colour": "#5C51A2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048995, "uuid": "6244d458-a280-48d8-9bba-bb6232c1700e", "value": "T138F2B669E8744D753B95482C5CDD6240164D521B0EAA3CA8F41DBC2C3F5C32EF1BABAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048995, "uuid": "5d9fd779-7f8d-42c7-a275-7bd506e1a124", "value": "768:+xlT2wDuWvWi7IdRqRz6I/XudHXqCg2It4XyWR/3yNFxj3K:r3RqRz6I/XuNXqCg2Itwyu0FR3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048995, "uuid": "148152ba-4ca0-4622-bdb2-1e0c6e6bd276", "value": 35277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048995, "uuid": "8d6e37ab-85e8-4815-9230-e76843bfa494", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048995, "uuid": "74173863-fa63-4617-b93d-3033e040c00e", "value": "blue.drx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4b30ae-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773077866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077866, "uuid": "b481e51f-7b49-4a73-b8f9-598bc6e22978", "comment": "Malware payload (ConnectWise)", "value": "bf9e0ec952a8dbae5d9f535028952f05", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077866, "uuid": "b700a850-bdda-4dd9-a533-14679cb2aed1", "comment": "Malware payload (ConnectWise)", "value": "96a41ae0f5d9c14fb505c506862a6e7947f5a20dd705f48aaa133ba0513dd3aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077866, "uuid": "e206fadf-aed8-4100-9a96-120f1401500b", "comment": "Malware payload (ConnectWise)", "value": "34f87786199c7b1021e2eed26c1d1803507deb88", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077866, "uuid": "11e3363c-8310-4952-89e4-92d1858d809e", "comment": "Malware payload (ConnectWise)", "value": "c41e87b1b7a9f2d1ea05ec922bd039ddb36916740c64dabfc0fad6df5693aa417f15d7f57f43f5c73287f1b992c0c96a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077866, "uuid": "18327c43-c93a-4a52-9dcf-a557f95a9bbd", "value": "T1FCA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077866, "uuid": "14219345-7c99-4a71-bc90-d46932c50bbb", "value": "196608:CBn2hg5kEWmXhcfKjSV8h7vGeCBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSV8:+gdEEijhDGHgdEEijsgdEEijCgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077866, "uuid": "e10f84b2-9e7e-4898-bd4e-00094610e12c", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077866, "uuid": "15128fbb-c82a-4d99-bf26-cc961c15bff2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077866, "uuid": "2183caf7-b34e-44fe-b810-b64eb140fc92", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2b6b0f-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053867, "uuid": "4e5e3420-4451-4d4c-9caf-fc5414e60ef4", "comment": "Malware payload", "value": "7df80ecbe385f469450ddebf67bec7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053867, "uuid": "ddad366e-f03e-4464-9e86-798b4c4022f1", "comment": "Malware payload", "value": "96ac85b0ba96f423aa08b878923b55e2ff3a64fca62a6df7d0907d28cc7c0a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053867, "uuid": "8b059481-a33c-4919-98cc-840095d6efba", "comment": "Malware payload", "value": "7bd7ef5ddcb14f0e6f3c6be7da1885227c4ace0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053867, "uuid": "643c8496-79bb-40ba-9445-bb590ad3655c", "comment": "Malware payload", "value": "652c7da9c9f8c95e2758c7b1162a88f02f7d776a3967ab2ec29987126c18bc32fe92e9f96aed1f1e87583815254d05cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053867, "uuid": "f3f79ef1-85af-4810-8b47-376053507355", "value": "T188E72356A2FD00E8E47BD178CA5B5627EBB23459173097DB226486692F33FE05E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053867, "uuid": "b94f2969-965c-493b-937c-d4d546916d3e", "value": "b5d3ce44460b794187f3e238adc502a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053867, "uuid": "9abac3d9-d0d4-4403-b242-d8a5026fd3dd", "value": "786432:emRdesMUPGA2VBwe46lvcm+hRIAjB4lS+P70e/QKdf2Z00xTN6C0lxjn3SxleL0v:e6A+GAA+e4iUT2yZ+P7xIY+00xTeSlo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053867, "uuid": "a0466511-a362-430c-8aea-d2b41e200c2c", "value": 68972547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053867, "uuid": "78b8b528-eb2e-4d50-9f07-4995237622b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053867, "uuid": "b2b306dd-ba60-450f-b704-98fe39bce6ec", "value": "96ac85b0ba96f423aa08b878923b55e2ff3a64fca62a6df7d0907d28cc7c0a00.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19458050-1bda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773075896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075896, "uuid": "b1635152-e989-45be-830e-73d76bfcc76e", "comment": "Malware payload", "value": "d5bd6ae35d9e8f0aadd8a23860f378f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075896, "uuid": "4208e191-62af-4b74-9d23-171518aff0b0", "comment": "Malware payload", "value": "96c1e27805e08957209d004fe48ec0643c12ff2cfab6fa0e944f5aaad67bb291", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075896, "uuid": "370b844c-afdb-4420-b5dc-27831ea7f294", "comment": "Malware payload", "value": "e0be34b951e974292247f44959eb1afc38af9c57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075896, "uuid": "112eb6fe-98b6-4cf3-8567-67fabe936281", "comment": "Malware payload", "value": "28c4ce146fb15b7993a4338a722200c0cd7d1ee4338a893d220d7a8d2a24f04a27ed4b2af1b2ded2a678d6fb3327d5ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075896, "uuid": "8facce78-233c-4214-b00d-32084f470c2f", "value": "T13AF47CA1A66759B2F56346358523530FE3303A086B00C9EF83B1696FEE3B7F27135586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075896, "uuid": "ee2e320c-2091-49cf-86b8-4e4fc00e75b6", "value": "92a14f5f423e96c4d043bd342582b6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075896, "uuid": "b76b43b0-284f-4e9c-a6dd-95cf3b8e7ea8", "value": "12288:myIPrt01zGqaQ/F+BH7VTpPjxoAo6PWNdZX3DOsnMpew2JluceRvV:myQrt01zGqLF+BH7VTR6AfWNdZnDTTLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773075896, "uuid": "39d1baf6-fcbe-4e5d-99a7-24b6b6a2d2ea", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773075896, "uuid": "098fc54a-11cc-40ce-a84f-677eb4351bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075896, "uuid": "a3247f9d-0048-4537-9d9d-67891000ebd1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.28255581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594aee43-1bac-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773056247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056247, "uuid": "36e7ed38-7dd5-4a32-9122-762898e29d52", "comment": "Malware payload (AgentTesla)", "value": "38b54d5f56ade68d752ffbef7b1a8df5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056247, "uuid": "b3160ec3-4cda-4562-8a52-706ab9652147", "comment": "Malware payload (AgentTesla)", "value": "976d47936868a8baa50f82d8d3e338c12d227c3ae32193c9ec999a05048ede91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056247, "uuid": "5649bf59-dce7-40bc-9c13-a47290114baf", "comment": "Malware payload (AgentTesla)", "value": "3ea8a70a178f1a11be2866140ec8c4a7d68dc18d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056247, "uuid": "d933934b-e937-402e-8bdd-e4fb98b69e23", "comment": "Malware payload (AgentTesla)", "value": "004cc8ef9a82d5a420abb13f050d0e1da2217626f7abecde886750822def5b32720079b3088731dc807a6b01ae95f73b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056247, "uuid": "a61996df-3ba5-4742-8e3a-8cdce385b503", "value": "T1DF452250F744D4E0CD5486F1993BC1AABAEABDFCC6A00D5B3399B75B3975214802FA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056247, "uuid": "6f60c85e-bfda-4ee9-8f33-7a63906f5a1d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056247, "uuid": "8c48baa4-b83f-4330-a076-5768c67460fc", "value": "24576:lxL9Ofi4EPZYt5KgbAx0BmvOQvjjlaJNqNOgdXGyazrqw9KOrk:bLMfi9ZxymvOpM8rV9Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773056247, "uuid": "df3c7756-5e84-416c-842b-5bae5a002878", "value": 1243096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773056247, "uuid": "6ae085ea-8f12-432a-a253-b055bbd485ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056247, "uuid": "300b21da-cffb-490c-ac0d-5730f5b16db2", "value": "Pagamento 00202603090708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dda770-1bbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063163, "uuid": "aec57eae-7a49-419d-8adf-b3ad386bdc11", "comment": "Malware payload", "value": "968b345b548080daa5e0fbad5face5b7", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063163, "uuid": "b9ba3aae-a22a-4d32-a938-75671ed1a191", "comment": "Malware payload", "value": "98ade9bf9ee00cb5efbb40e9b53c7af2e6a189dd5a0eabf329b33e322467283f", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063163, "uuid": "591b5660-2b2b-4d00-bfe9-67af8a40dfcc", "comment": "Malware payload", "value": "bdeeee4c38916662babda90cd1071943404549ba", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063163, "uuid": "7a6953ad-c395-4df2-8b49-5b4d34d4ae81", "comment": "Malware payload", "value": "a97065e2d8014415ddbf6f6c59eacd54b5a4329196318780d1ffa9f651e3845b46e923783bef1f3979f15c05c4a0f8f9", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063163, "uuid": "7d2de346-f4a5-44d2-97e8-3416fb92d93d", "value": "T1F418331DD2515F30E2EE1BFE2FAE4882C5CD22F841B6360F9DD46520BD982B47B9CA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063163, "uuid": "beb93190-b6bb-45bf-9982-056a51424527", "value": "1572864:wTPf1KaEl1TJFC3r1UmM+swKEokvpa9416746uqKAAyDqOp7vWw9pRSZ7kw:wTPBc1TJw3r1Bp168hyDJvWgSNkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063163, "uuid": "97a8b1a6-bb8d-485f-ad85-d33ac242b76f", "value": 85770094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063163, "uuid": "5d08a0af-0a96-4ebf-a1bd-e8a22e65d625", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063163, "uuid": "f1c395f2-5f8b-4c07-ac60-fdf78deab5e1", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75c33f5-1bc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773068538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068538, "uuid": "6f53926e-aa6b-467f-8d48-856d888c4e1a", "comment": "Malware payload", "value": "80c7f932b1ee7eb6e93e03ba41bca135", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068538, "uuid": "3c02b9de-bd7d-49a4-a7d1-04e3fea7526d", "comment": "Malware payload", "value": "9905c76ccf4ebdd12e1df63047a3206026073781d885165e82d298656b5f4937", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068538, "uuid": "fa60a105-7257-432a-8b09-31c5f5ffac54", "comment": "Malware payload", "value": "a6c61d5e016937bc7f2bff1352b481b814ab9bf3", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068538, "uuid": "d34d2187-7e79-4738-bce3-7166028122d2", "comment": "Malware payload", "value": "f845bb947253875fb38753d3e420367ca3fcfecaecfae6bc851faa98c92a056c22d1f23366c508a6fc5402579e28c60e", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068538, "uuid": "bf0049e9-2891-4622-a084-92a5cdcdea45", "value": "T16D13DF8C2EDEB928568764733D2BF05AE17E1CC0F448909CD59534EDF8BA708E8B9C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068538, "uuid": "6bae408e-0e11-4f1c-9210-eb746f5b1a89", "value": "768:+0Z8zdbJDVSNlcM4Em2mfD7buM5ZLM1MSzUCdzyXqgU79jNJdtPaZ1VpFMLSiqbG:+0CzlvMlMXuR/06IZ1g+6m+10nW/hncW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068538, "uuid": "e77a63aa-fbc1-4a2d-9892-90e133a39337", "value": 43474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068538, "uuid": "144beca0-77ee-4e79-a4a3-dd5ea26481b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068538, "uuid": "05df9e28-d058-4084-9d83-4a5d81ddbd49", "value": "REF. NO ANZK00926E-ET2602270B.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be77652-1b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773035152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035152, "uuid": "12240521-5c86-43bc-9b8b-20be61c3445c", "comment": "Malware payload (SmartLoader)", "value": "7b86cfff18d3481b193f541f169c93b9", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035152, "uuid": "a9e49b92-1914-4d05-83f3-2289134b4e2e", "comment": "Malware payload (SmartLoader)", "value": "9aeadffb5b70f36e292b066e1f9928a490c0f9ee8a20178deac2c5da4f1390b9", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035152, "uuid": "8d0480e6-a69f-4c22-b076-3cd49e85eb4a", "comment": "Malware payload (SmartLoader)", "value": "6670032b0eff2b43865186d7ddef5926e202117f", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773035152, "uuid": "3f7dedf1-3eb4-4d05-9dc1-b5f1281ed1ca", "comment": "Malware payload (SmartLoader)", "value": "30fa641ab49e161ecff4d452a10902fb92a509e5f25deacaee5c4fc37faf05ecb171c745e6702ff693e9856e083ea928", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035152, "uuid": "89670e6d-d8a2-4f76-9dd6-a9b0cfa928aa", "value": "T121C423B7179AB4897503E3E4814C7D9489AF20D957C3436ECA1E2693F5BE247FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035152, "uuid": "4380b8ff-4fc3-4933-9b54-179a66ab338b", "value": "12288:teElNtIBB2gX3U5IA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezw:teSIBBfHam6Jj6ESfUxZ91kmY/9HeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773035152, "uuid": "26d3753d-4323-43eb-8b98-23a36a380ab5", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773035152, "uuid": "f3094227-6386-49ec-b09d-7681ed8c31dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773035152, "uuid": "56a9cb2e-1825-4818-9d4a-86001c1e5a86", "value": "Cheats_Atlyss_v2.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c589f6-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053769, "uuid": "7136bf4a-9ae0-4f31-8911-56a78bc556ed", "comment": "Malware payload", "value": "54d07f4043ac400fa829b362feaa84dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053769, "uuid": "64c2c088-9421-4db0-9d37-48134091ff34", "comment": "Malware payload", "value": "9d4984510fdd8b2c3b578c7f06ff75559cfc818c5af1ff9e967637078943a523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053769, "uuid": "1d44e8e4-9b19-4dab-86f6-d753d9fc0f00", "comment": "Malware payload", "value": "380808e7cb60d344d38df7652c8813488e2dd8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053769, "uuid": "3c7b865d-eb32-4505-9c79-8533785061b4", "comment": "Malware payload", "value": "9bf93fad287acccbb9e182323f8c91d2bbf1b06da3501a3c9c9e505fa9870ba518cef9a22d7af5a8788c41c5b028852a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053769, "uuid": "155f950b-a329-452b-b10a-4af527973b14", "value": "T178665B03ECA555E9C0A9D2358A679352BB717C881F3123D32B60F7282F76BD0AE79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053769, "uuid": "d6ab6329-8f5d-4e62-b026-21a3070bafa3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053769, "uuid": "d3165ce1-e52d-490d-868c-3936711a6421", "value": "49152:6A1LahNxqM6Hzn4mu4djJxz8TdAG94FIX1mNgEBFR7vbmcKVoKpkXS/XNVfKiK9U:6Yc4DiAZFIXQNTVZCndyue7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053769, "uuid": "23acbb86-9830-424f-a4f7-68c97361d2dc", "value": 6632960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053769, "uuid": "f6778950-f9f3-4c78-aef7-b9b5930211c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053769, "uuid": "5a35b8a4-7a1b-4f21-b42a-609d798357a7", "value": "9d4984510fdd8b2c3b578c7f06ff75559cfc818c5af1ff9e967637078943a523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96c06da-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098606, "uuid": "7fed1224-4337-4dcb-a0d4-eaa942f1ccd3", "comment": "Malware payload (Mirai)", "value": "90e8bf4a5274f394aed0e654db196658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098606, "uuid": "c18d3c5f-2f7e-45a3-ba57-66cf4decb367", "comment": "Malware payload (Mirai)", "value": "9e51be3c51fd1e984328a92dd76dc1a434b229d19e1791068293127e589e6220", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098606, "uuid": "027c2fdb-081b-4e33-a1cc-b5d1a93c6596", "comment": "Malware payload (Mirai)", "value": "479c9e82d888e953aa2226bc6aa0a1b4f0dcaa2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098606, "uuid": "7db5fe4d-c9c0-4484-8a14-070aa84980a7", "comment": "Malware payload (Mirai)", "value": "e890cf5f3008aee5b94163c87148a4f7513c82ff4a305ffab5b9de24c19cdef6cb6803744dc99bb996c8638bdf99d326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098606, "uuid": "6f50a644-21a3-4632-9420-6cbb3bbad944", "value": "T1E9D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098606, "uuid": "99085b5e-79bc-46d6-b739-d88dd4b944af", "value": "3072:oWGIf1/UwfhJdU80rntbYUaDGMsMA9TKyt:oWxN/UUDGtbYUaiMsMApKyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098606, "uuid": "3b460637-5285-4663-b073-5996d6d91d02", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098606, "uuid": "bc477abb-5de3-4d6b-8967-fe302cf40255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098606, "uuid": "52e4c105-15e4-4816-ada0-ea45b4748940", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c15c7bc-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043420, "uuid": "0fe3563c-da79-4e57-845f-e66fc69b6e06", "comment": "Malware payload (CountLoader)", "value": "112cbde2534989f64734699ef61a9c31", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043420, "uuid": "17d039ce-2ba3-4475-b186-b2db8a847b4b", "comment": "Malware payload (CountLoader)", "value": "a00975ac089397ba5665254fef1bdb5e4fead543004da380230799fbea93ff75", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043420, "uuid": "21eb98b9-a6ed-48e5-93b6-5d7847d9ca1b", "comment": "Malware payload (CountLoader)", "value": "5098e0131106bb4bcebd4d3fdc2e38dfa03a4adf", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043420, "uuid": "6bed1800-36d1-4520-a50c-63c201e3a79c", "comment": "Malware payload (CountLoader)", "value": "1c517f49d55f71c0ac57887144c9c780e5df39258a5465fedd983121f5fae01d4af29b6f807816d40289da2bc7629371", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043420, "uuid": "966d6a24-1027-43a0-b9f5-f5742ed05968", "value": "T1A2C3EB4E19FB9C4E026BF22AD2674502DEE25B1A8545CA61753FCBB52F4CB5002EC6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043420, "uuid": "60478c10-f3f4-462e-bf33-654e28852a38", "value": "1536:/tPuPngjO2dYgjEI0TPicQiBcoDuGd4IHSPP5cqpXGoeU:O4HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043420, "uuid": "8c5ccb4b-ae1b-4386-a335-2d802c124a8a", "value": 121505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043420, "uuid": "6f75b9cf-5648-4e40-92ce-dd3c496c29cc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043420, "uuid": "87e6559c-f8f0-4fcf-a2f5-117475d6a7e1", "value": "Delta_Dataset_Holiday_2082.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef13121-1bca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773069168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069168, "uuid": "cc2d2f0a-1646-4f25-8d42-5975366a1a33", "comment": "Malware payload", "value": "834854f74060926baf5d2c46d14030a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069168, "uuid": "911612c6-4651-49a7-810b-eeea785955ce", "comment": "Malware payload", "value": "a0134fc7c275aa80e90f2fec7bb474bb5c83ab195070ba98f15756f8de0b666f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069168, "uuid": "7db7ad56-fe91-49e5-b635-939b86bce803", "comment": "Malware payload", "value": "e28ffe319accfc6c1505ca77d2e711ee262941b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069168, "uuid": "09848b13-676f-405a-a65c-eea8a0fbf181", "comment": "Malware payload", "value": "88e3386c014f68edd5d318f2eddc7bf3b5b5918aace684961a2d2791c20f1b96eb1437630e06c78e979c72e10a57f71a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069168, "uuid": "7f8f8df8-db69-4d5b-bc25-13b5956259c0", "value": "T1FF357109BBA9E328B40C5462DF5DFF9239A331093ED86D79D55A7CD60E4E20AC0F3295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069168, "uuid": "617cb5fe-cec3-4ed7-9db2-34fc9ce622cf", "value": "192:uIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIs:KL9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773069168, "uuid": "ee2749ef-1305-48b6-b584-78a840a50b62", "value": 1160434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773069168, "uuid": "ea2448ce-1088-42c3-ba2e-5ca7156829b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069168, "uuid": "19eae603-d122-4197-ae4d-4ce0610f8272", "value": "EY Invoice_P1K2317563.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b5290e-1b82-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773038289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038289, "uuid": "b77e381a-c996-4aa1-9367-149225317ff1", "comment": "Malware payload (GCleaner)", "value": "eda59adc673c53d91bac401e14d690a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038289, "uuid": "d13c29a0-1f5c-4fb9-92be-3d82fbe28c47", "comment": "Malware payload (GCleaner)", "value": "a1004a4aefac2b7b38236925192a22c9419113c942f4e90ec3735d86e91aab12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038289, "uuid": "de0e35eb-eed0-48f3-ae4a-53f4353810c9", "comment": "Malware payload (GCleaner)", "value": "2ed67cbc05c52cbe366b635fbc6e0d109cc4814f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038289, "uuid": "74966717-cee8-4773-9217-22a8179ba756", "comment": "Malware payload (GCleaner)", "value": "304f1efa165c4fd0094953d1f66ae91468a69bb32e892b12c040bbd36dfa33a8faaa7f21eb1bf70ad1ba58e09e576def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038289, "uuid": "3086419d-6058-46b8-a868-317f7c6e7ea1", "value": "T1F5557D33B2C39937D073967CDE5AA2595465FD101E3C844A7BE48EDC0F3AA81392D2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038289, "uuid": "f746b53a-8009-40df-9269-26c1abc90835", "value": "c1d0e759566e996ac6967155960c748d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038289, "uuid": "629bee99-cc10-465e-84e1-b1a8e2d14e53", "value": "24576:ds9ryNwyrX67my/p+5HJHL6GBlB/5SUxDA1aOe2ZEHzKRR/bRJ:dcrEHJeIgUeAOe2SHsRDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038289, "uuid": "79f33282-385e-4c9d-a4a5-7b823ec3567d", "value": 1407488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038289, "uuid": "e7f0ba59-96bd-4e3f-9a60-efc3be9796ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038289, "uuid": "9c00efe2-da8a-4baf-a3d3-03c4d3536bbc", "value": "eda59adc673c53d91bac401e14d690a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2d37ff-1bac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773056309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056309, "uuid": "e9ad2447-70ac-46fc-97d3-2df0f2be888b", "comment": "Malware payload", "value": "4a96456158dcc5156ed35c144ff830b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056309, "uuid": "68adbaf0-23fa-4560-beb9-108fd621c396", "comment": "Malware payload", "value": "a16ad1cdc82f58b4596e4e2d3ccc22a6564dbe62cd834a0f76343eb7b172ebcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056309, "uuid": "8759dc53-5db6-45f5-831d-691f8105c4f1", "comment": "Malware payload", "value": "acc0f51e2f69ba3b462f8d21b9626097e39469fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056309, "uuid": "abfdf2b1-6809-45fa-9c1e-d81a88126194", "comment": "Malware payload", "value": "80eda5b5b39926ed9407770d65aaff9b30270d32e478b74275456c7a75d76311274f4da315dd06d93aab819ace5cc3e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056309, "uuid": "a7d470dd-11b0-42b9-a0b5-31eb0094dc5e", "value": "T1A4924B7912496D78FBD1DE3D9F3C6F0CADE981C42128E3ACBA4F39315A206ACD605349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056309, "uuid": "5bbf3b62-21e4-404e-a2a1-4932a3859104", "value": "384:0ysYgbWowcL9dbwUINvzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:0fZ3Dbwh9zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773056309, "uuid": "799a436f-6861-43c4-920a-b3235be409d7", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773056309, "uuid": "77509c05-3463-40b1-a24a-49bdbe1d54ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056309, "uuid": "f8e40ef9-ab2f-4edc-a884-4cf2a16d35dd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43af9ddb-1ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054492, "uuid": "98b4b53e-ad07-4b37-86cb-99187ab138f3", "comment": "Malware payload", "value": "d49822b01375c9a1fd94eafd550b645d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054492, "uuid": "f4994a6e-1ef9-4b36-b980-a450096289e7", "comment": "Malware payload", "value": "a3b859cd3da1b77f2db940aebfca0041e83fcc88af2dcf805e5ac752b29f928c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054492, "uuid": "bffa1b5a-7feb-414b-a2b0-f140acee3d3f", "comment": "Malware payload", "value": "193e43e10a5c0037477b003f8e8478333a6d29b4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054492, "uuid": "e84e6b64-6c28-4ab3-9bcc-6262319bea34", "comment": "Malware payload", "value": "9e2691bd59fa7e52502e2256ea8d50103c1f26582cac312ca41cf6775e8cad99fff4f0d36a37ad402631cac73328c4f9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054492, "uuid": "a32b0235-cea7-4824-ae68-e2670500846b", "value": "T15D3833C54E0084E238A6B516BDC171F5FDEBFB13A0B79AC5483EA5BD0379AB241F0568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054492, "uuid": "a688d91f-f54b-460b-b4c3-45a58db32afd", "value": "3145728:wcS6nj6iTT7ao2QFxtN84X7hxHarH5tq26EIRQITD:lHaGFHjrhxHarZtxIR5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054492, "uuid": "262f4a8d-5efa-4a08-bd3e-016be5735ad8", "value": 104336557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054492, "uuid": "beab8ad0-079d-4a2d-857a-fc61c0a72a23", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054492, "uuid": "53821df7-9156-4b1b-86a0-c0ae6d01be1d", "value": "launcher_4.4.1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccf1adc-1b94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046213, "uuid": "e880bf79-85c2-4f4e-8a5b-d32f553c6e3c", "comment": "Malware payload", "value": "f705244a2824f4142300b3feeeb68e87", "object_relation": "md5", "Tag": [ { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046213, "uuid": "9678ec65-f573-4176-bdaa-3e7f5d103292", "comment": "Malware payload", "value": "a4c7b861f9e2e20e5e3bbe867997ef7d97e087ab9e1721fcd0c58375c1d004d3", "object_relation": "sha256", "Tag": [ { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046213, "uuid": "af2ed6ec-c889-48f6-a8c7-41a397434b3b", "comment": "Malware payload", "value": "19cbc5525ffc73cf8070b0f1fc0239538eeecdc4", "object_relation": "sha1", "Tag": [ { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046213, "uuid": "013ac0f2-e3eb-4238-8739-0ba0d9731a11", "comment": "Malware payload", "value": "abbd74558e40826cead16139840b34dc338d34e85680f28a318c3db9cb6c54797f7f39a51ca7d76f53ceb73f753fb58e", "object_relation": "sha3-384", "Tag": [ { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046213, "uuid": "5b2a5ab1-e55b-41a1-bb4c-70ab92c73898", "value": "T1C4115939DA20FCC0427E71A0513A1E48109C2E51EB71576CF9A20D963951AC1EF1F8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046213, "uuid": "2b9e7a2b-7586-4b49-9edf-fa36cfc4ea35", "value": "24:Qp3eyrzy/DachXarnaRichQ3nao6pbbVNyLca17hLFG9SPSycun:mvrzTchXQn2ich2nV6xRkgmhp5PSycun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046213, "uuid": "61780034-3988-442a-9d41-de9fa84793be", "value": 873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046213, "uuid": "068e1b47-dbf7-4587-b4dc-db2908175f82", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046213, "uuid": "97d1e484-f658-45ae-93bf-c0df34bc4c11", "value": "main.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afc0f07-1b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773043418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043418, "uuid": "1eb72e36-edf8-4e0f-8da6-9e3d7cf82179", "comment": "Malware payload (CountLoader)", "value": "25eed035f4343a7a2d3d9012f59fd4a1", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043418, "uuid": "1fb1d8d8-08c7-4e35-8773-48adf3e3e011", "comment": "Malware payload (CountLoader)", "value": "a54bc8b924efa6160814d0d2cca4b33204709e1b9d64f57362ca30c9c1e17c9b", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043418, "uuid": "6ddc9e20-20a7-4b43-82f9-ceca7619241b", "comment": "Malware payload (CountLoader)", "value": "5b13254da9cc74b2535c2985fd310bce58fb622b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043418, "uuid": "ce134dcb-7011-4a49-97c5-96c8b2186e6b", "comment": "Malware payload (CountLoader)", "value": "59ec2c9364f5952893b41c78af9db3be1f96e97388a1579452752022c6cfa92acce05497dca205114c3438c1a25905e6", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043418, "uuid": "36ba2d3d-3c1c-4832-ab6a-3dbbd8d84077", "value": "T12EC3DD0DEE6F5268121E3C19A5AF0507EB69A7420258E4C1FB3DBF941F6C93310F6AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043418, "uuid": "11fc3987-357d-4abd-8b42-d743cd3c97fe", "value": "1536:emHk4CfH3QFRR6WOqQDyKi1e74u++Yh09vc1/Kbj2Sphl3YvzQlIl21qM5NulahH:cqPXn1WtmhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043418, "uuid": "6086bf17-c55a-454d-9f85-bd8528bf52f6", "value": 125196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043418, "uuid": "45831b42-5874-45a3-886c-f00dbbc60a43", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043418, "uuid": "54f06334-54e9-4e2e-ad8f-fd4c49643303", "value": "Delta_Journal_Moscow_6150.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f409647-1bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1773065813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065813, "uuid": "82fd7842-7627-408c-9c2c-f146da74303e", "comment": "Malware payload (Smoke Loader)", "value": "e7a4be287d7ea92cdae61c93dccfc24f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065813, "uuid": "a819e74a-2e95-4bc8-a79b-b467c1667390", "comment": "Malware payload (Smoke Loader)", "value": "a8952a36f1f43676af720d38a8883bec6d610522b0c1410eeda740fba17d89a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065813, "uuid": "8beae31a-c26d-4da2-87d2-547f663d19b6", "comment": "Malware payload (Smoke Loader)", "value": "37030ce06ba7a143939a066827331c700f7044cb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065813, "uuid": "30858118-6895-45fc-8607-185ec8bda257", "comment": "Malware payload (Smoke Loader)", "value": "f1b8901710a9caaeea6a7c772ff449a57fbcc6386c7101b7132b5bd6989a1f7a45695c298f2745c4e42e7249717d45ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065813, "uuid": "c11a4620-a3af-4e4e-b17c-83719461037d", "value": "T1EB243A2BC25330FCE553C07892A66232B772BA3D47358EE70293D3359D61AC05FBA965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065813, "uuid": "b58cc5a9-e77f-4d0c-9aac-ec8a3a0f2998", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065813, "uuid": "f7705de8-3bfe-4f11-83b3-79ff47df8c2b", "value": "3072:Ry+NC+3FGCgIuXHbTZvQJoUaCSC0CwMQv7PfyeLZlwABcJw9r:dDPgIuXHnZQyUSC/5ubfhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773065813, "uuid": "5990670d-1529-4acc-bc25-8ef6ed467e86", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773065813, "uuid": "4507b0d4-898a-4050-a488-4c0b1893ab89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065813, "uuid": "a56b329d-1f11-479b-85c2-1c58053a1e82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a5d762-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773060589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060589, "uuid": "6b3ad86f-55db-4806-b5d5-626c37f98285", "comment": "Malware payload (RemcosRAT)", "value": "73b33ac9167356231cdf4b04261f6fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060589, "uuid": "2f93b755-f3cd-4a12-92e7-796522c51a24", "comment": "Malware payload (RemcosRAT)", "value": "a8b3a9ea280d776d79f038ff5c2b3b095d8e0c1b25df954bce598e0733d8149a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060589, "uuid": "93dea8b1-7c0a-4cd2-ae10-212adb923260", "comment": "Malware payload (RemcosRAT)", "value": "49ec99e4128852b421803f799d305b4dcf500408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060589, "uuid": "d257f683-06af-486b-ba7e-9d10f6a47e38", "comment": "Malware payload (RemcosRAT)", "value": "747b6b66e6908a3ef3cced0bfe3795cc847debfeb16af71cdd6b3322f277f5137533bf2a53c38640ef0e2dc06a650ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060589, "uuid": "38ce276f-6f85-47fc-b416-b67e193b7a69", "value": "T133642305731AC037E6B20231483B6776CEA6DDEA68DE07270370B95EBC75B90DB6DA44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060589, "uuid": "c5e38203-5e1a-4eaf-97fb-1269d1ee6a83", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060589, "uuid": "04e43f33-c42c-4f54-9cfc-adfbf75db20d", "value": "6144:53yztAAoo+seRCZBM4Glr86+dmg5aQSyR4NVJvPNoMP:53rAoWzZBoNLwUQSyR4NVJNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060589, "uuid": "ee05c843-766a-4df6-b8bd-90b4e6c84f78", "value": 319568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060589, "uuid": "726d99f8-4644-4834-8d59-099d82125799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060589, "uuid": "a243ebbd-bf5c-48c4-a804-9da0c6684ba2", "value": "Sales Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61d092e-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773054228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054228, "uuid": "b27f1448-734e-465f-a359-f7629d6a9f01", "comment": "Malware payload (ChromElevator)", "value": "5cfa76b436bc9fb49912434eebe17fb5", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054228, "uuid": "1ebaa130-ccd3-4063-9a11-8071abe0cc90", "comment": "Malware payload (ChromElevator)", "value": "aa65b6b94700e741f9af4ff2a6780caa5b87ea61a36a3b2e419747016e0738f4", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054228, "uuid": "b9b5d8f6-55a6-46d6-ad29-1f1c8f6b687b", "comment": "Malware payload (ChromElevator)", "value": "343ded8b6bfb8d43de45fbe0aea411b479b080e9", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054228, "uuid": "25e68690-65aa-46b0-a50a-f1798520abe4", "comment": "Malware payload (ChromElevator)", "value": "f560f8351a3077b1e88b0a68df2ca9b586be6259099d279e3212e221a8fdf06019567b0123601e9b956cc39665ef2e09", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054228, "uuid": "e781614d-c0d3-4f59-962b-aa3f7a93f8cb", "value": "T117D5E11BE36801FCD063C2B4CA529A13EBB2B40A1631E69F57D18E962F277B15E3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054228, "uuid": "75eb44a3-49e9-43dd-857c-55f093e79bca", "value": "f6f072c01efb0b27c5ca2368d42164ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054228, "uuid": "048a1b0c-13af-4935-82d6-f9090b68f537", "value": "49152:35SrZv6Gs+cLqgYhfmowKyyW0+w+cWdtUb1N5t9IlDksROi3:3USqZHCcStyNEDRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054228, "uuid": "eae98c35-ed44-493d-ba99-610040281fd2", "value": 2885632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054228, "uuid": "aee21137-59fd-4a8b-8540-db0a1b4ab3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054228, "uuid": "0c2a3312-0009-4aef-92dc-3996ac958703", "value": "aa65b6b94700e741f9af4ff2a6780caa5b87ea61a36a3b2e419747016e0738f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0248d7f8-1b63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773024747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024747, "uuid": "9bc8bdd1-ffbb-483d-8dd3-cee6362b419b", "comment": "Malware payload (Mirai)", "value": "55bee9f1addc6f616ad99334039b8774", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024747, "uuid": "6d26caa5-de53-4349-9b4b-d2fc229b9812", "comment": "Malware payload (Mirai)", "value": "aa8a317a1e8a43f1454b9e3707ed4b65fc56fe829bf68b9acfdc1b525be4f3cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024747, "uuid": "21bdfc11-d2b9-4e57-a9b7-ad716cde0902", "comment": "Malware payload (Mirai)", "value": "09e29dd55bcadf8d4c099d52d0a9b070918db3be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024747, "uuid": "c40a9b72-c682-4f39-829a-ae290bc8939a", "comment": "Malware payload (Mirai)", "value": "d166de1a754bcb9c03a7d1af79bf866b3c9695a6d2f223796c4c0b29695ce45292500509dd640d497bfec3a629ba09da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024747, "uuid": "b44ce884-7411-4512-89ac-9765a78c3c82", "value": "T14B257D5AF2B370BCD027C030439FDB62A93AF47901216E7B65C4DA352D66DA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024747, "uuid": "d0b94ebe-0799-445e-86a7-526e39f7b9c4", "value": "12288:x1azt7mWoIjYvdaUpFnWs6Nq0naXMSmyNbFsyLEM5k:x1azFmWoIudaUpFnWnNfn18FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773024747, "uuid": "503d4cb8-51ed-4b18-867b-e247e74860aa", "value": 1041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773024747, "uuid": "0199ad6c-5a47-4b84-bb20-a2a1ac592d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024747, "uuid": "6f7ecf23-3368-405e-b1f2-0761691e1d77", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912db8ba-1b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773043026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043026, "uuid": "9b58ce17-a826-43db-81db-c1f92880facd", "comment": "Malware payload (AgentTesla)", "value": "ae9c3dd8b86c6e0ad20c4e7245ad459d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043026, "uuid": "7b0579e5-5309-429c-be87-8ec6d2854000", "comment": "Malware payload (AgentTesla)", "value": "abd49f30647dafff23f1a217e74bd6851f1a84a957c40f064ce1b9fc91d5c0d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043026, "uuid": "25f5c0f0-74d1-4531-83a2-a67a987ebf8a", "comment": "Malware payload (AgentTesla)", "value": "9d3ecfd0052b7e875d0bae50bdb70351680f741e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773043026, "uuid": "a166267f-12de-4924-acca-d95527e6792f", "comment": "Malware payload (AgentTesla)", "value": "d6b756a9f22f49347d80110a012ffb31daf3ce7e46dfd2062f176bcbfc00e8f186b6412a90ed66a56d60ae7db110e693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043026, "uuid": "30e4c3ed-27b7-41ae-90e8-1839c8616aba", "value": "T194165B80ED4896842A27DE327F9471D282C2556B7E879582F02FDDB1FFE7186AE10D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043026, "uuid": "e9b6c8bb-a5b0-4d13-a7a3-e7a6102f69db", "value": "98304:9wE26hpyfuoB0qceMfeh7c9mKqduEGWlid5ccyro0CrJfzqQWgYSYXZ7q6CLSyzp:126hpyjXvMmhQ4duvWk5/Oo0+fzKNxXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773043026, "uuid": "d2413932-46a9-49b6-8d1a-0937c8e36e2c", "value": 4279762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773043026, "uuid": "8b8bc610-70e5-4ee5-8823-4d2339451981", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773043026, "uuid": "28065c0c-a08a-4f22-b775-d7c1b8b8bbda", "value": "New Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9f02d3-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload (SkuldStealer)", "timestamp": 1773070749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070749, "uuid": "230abc6c-9245-4fc8-a385-7c3c22fe282e", "comment": "Malware payload (SkuldStealer)", "value": "075539708420ae96dc230f5d1d40b9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070749, "uuid": "389251f8-5a74-45da-9e9d-c0cf6dbc8e19", "comment": "Malware payload (SkuldStealer)", "value": "acc3ce1b1100337a012c4c1b54ed68e869b1b91ba40bfff6bc5c81d4c3db0ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070749, "uuid": "a07fa472-897d-495d-b91e-873301a9f60c", "comment": "Malware payload (SkuldStealer)", "value": "79bf082cbf1884bef670306132f6ed8ebf110604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070749, "uuid": "0ef5be51-fc99-460a-b4b9-3e765de1ebb7", "comment": "Malware payload (SkuldStealer)", "value": "7d292c0a65abfd548326de8cfab9d585592597da88a9cba6b6f5585096d6708e710cdae40c8ec40e8d96e08f68d8498b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070749, "uuid": "3ab7ce8b-efff-4ebe-9cc6-5fb786cbec81", "value": "T1D4C64A47E8A501E5C0EED176C6669263BA713C889F3163D76B50F7242F73BD0AAB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070749, "uuid": "291f0b4a-eece-4993-ac5f-b8172967e4c5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070749, "uuid": "d9718e9c-a5ad-4d96-b316-ca528abb8669", "value": "98304:jyXK4DBHs72YgkIRX4rvPKJEfz5jPTRZW6EyK:jj4Fs72luvPp9jDWnyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070749, "uuid": "5e08e4c2-c9a3-4893-a73e-73378e67fd46", "value": 11481088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070749, "uuid": "14346456-cf9c-4b47-aece-f6838e8a25de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070749, "uuid": "92a975e7-6d21-4f25-a38e-891a15413c61", "value": "xacc3ce1b1100337a012c4c1b54ed68e869b1b91ba40bfff6bc5c81d4c3db0ebf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a58066-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070302, "uuid": "26bae7fd-90f2-4a06-86ad-d02071bb54ed", "comment": "Malware payload", "value": "a0385ab6c73920c28890eccb240a9258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070302, "uuid": "29a5784f-2a75-4eb8-90ce-79e384776397", "comment": "Malware payload", "value": "acea6ef68ca7ed4d3b0e97711aed830eb005665c187a62d62d3646d891400f06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070302, "uuid": "b6ac0ad1-fede-4462-9031-d71d7bc95bef", "comment": "Malware payload", "value": "f8354a481ef8d4e0562c1ac71cca04220c2ef484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070302, "uuid": "2c10856c-7112-4ae7-aff7-f11c183700b0", "comment": "Malware payload", "value": "153c3de57f232a332407777cfce97f1ee51d4783fadfe80cc3bc6e38c4e465f7a6e4b33446851953b82ebfe01eca7eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070302, "uuid": "f7f6765f-2c0c-40ee-bf78-e10d7d2c3b4f", "value": "T10726F7E57B058A78985F7B6CF1727461EE3C125214C8A71DB12B17A07F928079BA0FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070302, "uuid": "0ef5bbe9-6c41-4c20-b376-d7507f973e37", "value": "98304:XbpD+l0ho4B7XX2eCj4F5PaG1dViYFkEnRd6Oiya+2jtsL2sbdYWzSDw36me4HYM:XbpD/CG7Lym9auVtZLaLtsLpqw36mecx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070302, "uuid": "80d71167-60ea-4322-bbdc-341bfb06dc5a", "value": 4545220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070302, "uuid": "49ad8388-7d7e-4dc9-9f34-92e3da385a6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070302, "uuid": "2cd410aa-d7eb-4ea1-ac92-47d5a13f9c62", "value": "900976554233456.DOC.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87053047-1bbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773063195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063195, "uuid": "d144868d-a497-4d2e-afb0-ff6b860c2dcd", "comment": "Malware payload", "value": "3b9b7c4bcacb7654bf23f8c8293e3ee1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063195, "uuid": "60aabf8d-e159-4273-8952-dc084c4582fb", "comment": "Malware payload", "value": "ad214f6508c879888ad23042ff6a1d6e03f70b5cb6fb97e4ab12016f5de50c71", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063195, "uuid": "d655d672-691c-49bc-9746-d6b9dc5d36a4", "comment": "Malware payload", "value": "9155b674036f7cbd53dbcc73da36c81d6094449f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063195, "uuid": "89e1c11f-0d40-435d-9c0b-fda1bba32419", "comment": "Malware payload", "value": "94382906eb6334119cb21ac14ffc6d571c11a89c0bb9fa610698cd9dc66c4ce4a5abb597b26f2cc8f49d6471de280f4c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063195, "uuid": "e944e28e-650d-4663-a199-ad9c41003c77", "value": "T13802867CC5E5BCC087AB21C079DAF7C6108E8B236E7B1A9CE5C848811B54759FB7D688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063195, "uuid": "586e821b-ae6c-44bc-b982-8c5e78cfe664", "value": "192:53NuvrFJDAcFTz/xadZnXSUMXT7sEuu5T:53NCrrpvxSSJTYjCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063195, "uuid": "e7862b82-2cf3-452a-8e2f-09bd043f8dea", "value": 8921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063195, "uuid": "df0da504-883f-4bbd-9ab1-810ab5435110", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063195, "uuid": "ef9e6f33-f09e-4ec5-9d67-2fd1771ef5f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c61cfd2-1c08-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773095712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095712, "uuid": "8f6d134d-2e5d-445f-b9d1-9943ac927a30", "comment": "Malware payload (AsyncRAT)", "value": "09564c84c99335ac4fe9c579a6151e1c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095712, "uuid": "453c924b-9b63-430e-b36d-80eedc93ac89", "comment": "Malware payload (AsyncRAT)", "value": "ad4f3ba88a91f81b10b926bba1f08ccf13bc528afab09f08e30f814a15a633fb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095712, "uuid": "ef599b48-5d6f-46be-b9d3-60b8daed2daa", "comment": "Malware payload (AsyncRAT)", "value": "c99d9921a0ab151e8398f549559a76199f6c627d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773095712, "uuid": "33b2a21a-2924-4950-8acb-f73d8d7765b8", "comment": "Malware payload (AsyncRAT)", "value": "efe6b794378a32ec87da5f751e5bc9c6c23509771a0ba025c35c53e799be2d9d8d8ff8dc0c33c43199e1c8c333e72541", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095712, "uuid": "5a81b51e-5520-47d9-b619-20e04464fcee", "value": "T1D5233C003BE8822BF2BE4F786DF26115467AF1672603D95E1CC441DB5723FC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095712, "uuid": "e57beac1-0397-4d97-b7fb-6ef9dabf7436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095712, "uuid": "bcfe09ba-63fd-4789-8ebe-1fc1e8cc8901", "value": "768:au/dRTUo0HQbWUnmjSmo2qM6isHaDFIKPIVnjbUgX3iKvLK9oRdIOBDZux:au/dRTUPE2Zss+zVjb7XSKvLKHAdux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773095712, "uuid": "9eb212b2-abc0-4c9b-bf43-ea7dd717b423", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773095712, "uuid": "9fe93e22-ec81-4798-a3af-589b6155b607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773095712, "uuid": "66c53fbb-3b6c-4b24-9713-f1fbf8211916", "value": "09564c84c99335ac4fe9c579a6151e1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf8d6b1-1bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773087742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087742, "uuid": "b45109c2-1fb4-432a-b658-c86e7f9263ab", "comment": "Malware payload (Phorpiex)", "value": "4d2d3b04cf612c15cf5815be0fbeac51", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087742, "uuid": "e6c3488c-9df4-4fe8-9ffb-87668b7570f7", "comment": "Malware payload (Phorpiex)", "value": "ad9cd916566c52d3045fea0120900a9f2f460a4bfbc01d0bac236f3cc9344739", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087742, "uuid": "185650d8-8172-4e46-a708-cea0b0238ad2", "comment": "Malware payload (Phorpiex)", "value": "532bcca73750df10fc476e07a22c74f42d616f7f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087742, "uuid": "88ccca31-b5f6-4763-ba99-db00a7c09ea7", "comment": "Malware payload (Phorpiex)", "value": "2878579ab9f2629afb164d031f8b16d1c6746fbb63e42e3c95e523d3d9cd2dd56e8ba68349b5c4639681765d80c67e3c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087742, "uuid": "ce680370-58ab-4a65-be58-19ba3ce05df3", "value": "T119834A00F6C0813AF4F740FBD3FB566A582CEFB4130684E76391A5AF6B259C5A93146B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087742, "uuid": "891d7f44-78a3-4fb0-bcfe-c0068ea82ec2", "value": "c958c201152dd5b63a8cf3a862f1f1d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087742, "uuid": "99684277-b307-40c3-84aa-935b969f0a1f", "value": "1536:7lv12JFmavM2ouZtks3B2h9NaZRaCLMcxHpG4Jq4:x97OguzDB2TsZICLMcdpG4Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087742, "uuid": "32b6b06d-3ee0-4e63-94e0-d96c9de97d06", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087742, "uuid": "8b4bf9f0-3037-4448-be98-cac615116e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087742, "uuid": "b88c2df7-febc-4166-8662-45573f6049b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec2e7bb-1bf6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088200, "uuid": "932169af-9d07-4404-805a-d3bca67b16d3", "comment": "Malware payload", "value": "32faad51ada6b0a9aeb39d022c72bf84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088200, "uuid": "6f28a8d8-c340-48f7-ace2-2c4b92750a4a", "comment": "Malware payload", "value": "af394cc460fed1a3a90e23c18aa0553bb2a8d33a46e7931a9a2a695fbc7418f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088200, "uuid": "769d3312-2095-42b9-90d2-b2d678815f56", "comment": "Malware payload", "value": "59b419aa193415fccf7997c2aed1471b71831283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088200, "uuid": "4fd44fd6-6c20-44d3-9074-353daf8c5cd7", "comment": "Malware payload", "value": "ba84a63784ca9a00aa529c489ae8503b0409c1ad9c65ef1eef9c1aa40d68d61255f48ff2bd6811f7225888848dad9a5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088200, "uuid": "31e69686-7eba-4327-9383-ceb69e1b2740", "value": "T173A31B45FC919F2686D522BBFB4E42CD372B1768D2EE7203C9255F20379A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088200, "uuid": "9ffd8856-565f-469a-aa6c-dd52875f932e", "value": "1536:5uIve6iiqCboK0eYlbn3i26vfJA0jhuwADadyTiEVCofNO5/l7s819Eld7Lwywrf:5JeBiqSN2QfJnwwAkyrVJO9s82i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088200, "uuid": "a022888f-794f-4f07-b4ef-2555f21c8dc6", "value": 102752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088200, "uuid": "254ae3c6-38f3-4430-9c8f-a8d8bee93ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088200, "uuid": "92aada38-3734-4de9-bf3d-4f23463d7d4d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d57b15b-1bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064065, "uuid": "88a4936b-6a44-44aa-96da-2eea1ee67b6a", "comment": "Malware payload", "value": "58ff150c44c65b378bf94a20c1e89c88", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064065, "uuid": "37411f84-c38b-49bf-9a8d-a49e1bf787f6", "comment": "Malware payload", "value": "b02026e6c68771a47e1e77386f1366e145f384872ac57f1a83f2ff515ba3414e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064065, "uuid": "57afefb7-8464-4d5b-bbaf-6b4558e4220d", "comment": "Malware payload", "value": "920b29ce3d3c59d89c08f57324279a2fc752b692", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064065, "uuid": "dbe661ec-948d-4f18-8ff9-baebdd19685b", "comment": "Malware payload", "value": "875eb11c4a585e791f957fb1e991aae7e54a2cafc8ed44eaf060d75a11e89c8d773e6bfd6c8561010058510f6d0ae658", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064065, "uuid": "cc9c8f70-1ec7-43fe-abf3-cef74ad8820d", "value": "T18B2676A45DA16711E6D283CAB05AB9C0FD2E3C2378D9CEC8F77FD49458E5C20EE05A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064065, "uuid": "36d8458c-0034-4382-be92-beb01d64a32f", "value": "24576:Kn4UAmn4UA7CzV7Iplm0luW0GteJ3ITcrK8WysC7wSKbd:yzV7Iplm0l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064065, "uuid": "343328e7-f8a7-4a4b-bf9c-5333baf84cb6", "value": 4624538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064065, "uuid": "ad06a427-3553-4b06-bb1d-75d75cbbda55", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064065, "uuid": "1e552e45-760c-4203-a7af-5d1849a27df5", "value": "acke.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f14ff8-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773060528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060528, "uuid": "6f999052-25d5-4a6a-b4cb-1b65664cbd5f", "comment": "Malware payload", "value": "779d4cbb4780bdd9a0d4f5c22a24970b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060528, "uuid": "f94c2a76-5b07-4630-aef6-46bc0db9bc3c", "comment": "Malware payload", "value": "b0758e108f0089817c0a73d2a1f4d5c4f79b0c0822bbe2e28b0e29c4f30ef456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060528, "uuid": "44d467f0-19c0-4438-9f93-8b8d70d4d1bc", "comment": "Malware payload", "value": "320d97e380fb02cd0c43c4bbcbfa7cb733ff1407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060528, "uuid": "a567edd2-d10a-401a-9a66-3478e32aaebb", "comment": "Malware payload", "value": "85b9b170b7fc5820ab29154cc93e1fdc7c67a51be9f2da443be1b7594ea04a1fcb960130a4f7a0902ab04637a1443164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060528, "uuid": "48c8334e-c437-4638-91c6-2246e7749d21", "value": "T1CAF4E0252D866A68E6BE2FB8C073189837F0D81695D6D71B7FFD10B449B3B85CD23812", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060528, "uuid": "3b4e6d8f-72e8-4ad1-9953-f3eb9ced64ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060528, "uuid": "10bc8ad2-87f1-4f9d-84a8-3583db80acf9", "value": "12288:vMwJzYiVN0LNj0XL8fUHBNC+x29kgeLigARt6lQ2XeCnzumGN:UwhZVeLp0XosHfC+89kZURIy+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060528, "uuid": "5885288f-504d-4724-9a66-f8520bbfb193", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060528, "uuid": "482df393-32ad-46d0-a2d5-d9b09babe37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060528, "uuid": "e8efcc47-3d71-46e6-a892-6d495dcac00d", "value": "OC40592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dc3e3f-1bf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773087509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087509, "uuid": "671a384e-cd1a-4be0-9e28-a726cb7d5584", "comment": "Malware payload", "value": "88fbeca36c90ae558b028af234844ada", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087509, "uuid": "e991e2ac-0712-4cc7-baba-f2569675c076", "comment": "Malware payload", "value": "b0a42dd89dbbf24378c9566816f7a3bc1b705f2b0ae1a1a0924388ddd0bf1bb6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087509, "uuid": "780064e7-0c66-4c39-b8fc-8c5a117aad18", "comment": "Malware payload", "value": "e9785fcfb61520c4a676649ce1c2d55599b218a0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773087509, "uuid": "d305e7fd-f274-4edb-a649-7386ef593437", "comment": "Malware payload", "value": "82080808052e44227d19e9e627430b27f64ccdbacf62f0eae478fae76ae82d3a669c74f6485d064698bd994d7b756126", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087509, "uuid": "86c2feac-299f-42e6-b92e-cc92fae4e2b9", "value": "T15FA20805AA56534AF8B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087509, "uuid": "b3f15404-8451-41f5-b0fd-c285d082fbcb", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087509, "uuid": "7b842a66-98fc-437b-be05-8141f243f020", "value": "384:Yu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:YNuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773087509, "uuid": "4ec9e5be-e5f2-44df-980a-602e27b56d27", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773087509, "uuid": "c545845c-1ab6-4a95-97e6-695839c8ca7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773087509, "uuid": "7935dcb7-f4a1-4556-9095-26608f86e41c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31b66d8-1b8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773041902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041902, "uuid": "5229b229-8da6-4d2a-baa4-3a657a5ee012", "comment": "Malware payload", "value": "81a343fefbd1095af9fe69a24c38bde0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041902, "uuid": "e8c5773b-0f22-413b-8c88-e1ba0915b022", "comment": "Malware payload", "value": "b2220620b43351a3fa0ab7a46eff16f23ed3ec8d414b9d61fb53b1f1cdf9b43f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041902, "uuid": "1e3d2ea3-8faf-4a82-bd3c-5d21c04ec924", "comment": "Malware payload", "value": "51983702c0709db7c835c39a252eea2b55b54c34", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041902, "uuid": "0a8e8e45-6fe3-413a-bfaa-606888f875be", "comment": "Malware payload", "value": "0bd8f746e5550716f88c1e9833ef9ad86335c0cd31d87b0d4e983084e72ea34e276c851adc93524a71e35e0e9bad9308", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041902, "uuid": "98fe5c76-638f-4f9d-abf6-7a1a548cc1a6", "value": "T1E493732C68DF405087DB3C68AD1F6C82EB6164077A0FC892716CDA746F9EDB1A2DD4D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041902, "uuid": "0d4afb92-9b29-479e-b40c-01582fb12d50", "value": "1536:ipKKKjGSLGSrGSMGSby4y0yMyb2B262j2kSzStSMdSomYqtF59gu3xOfyt4kiuzq:Cvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041902, "uuid": "b38fe249-159b-4aad-a3ed-f586d39c19a7", "value": 91657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041902, "uuid": "c8025ce4-0a4b-4530-a2c7-38f666129020", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041902, "uuid": "ee44a967-e148-4a92-bc2d-43a80e777cd6", "value": "CorpTraf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1507e5de-1bb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773061716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061716, "uuid": "92d8a2f7-a1e4-4785-b96d-7ea91b32326c", "comment": "Malware payload (Vidar)", "value": "cb55f1107bc68005e31b6957c8d1527d", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061716, "uuid": "4b618734-d24c-4497-b53d-1df05a2aab30", "comment": "Malware payload (Vidar)", "value": "b314fee7254192d4349b10ae360660cf5037328d816a1651e85442b06a172905", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061716, "uuid": "8bfaa1e5-9434-4d26-b9de-706d06ab7c03", "comment": "Malware payload (Vidar)", "value": "5e71657458dabfbaf153b8ea30e4e90b1e98fe4c", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061716, "uuid": "c759c115-c7ff-4723-8c04-9261ff1db2a4", "comment": "Malware payload (Vidar)", "value": "d0905365dcbe16c7263aab89c05f45256cfda686fb11550174e309ef35b1bd5eeba9c0cd7a7245319d78e577399df3b7", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061716, "uuid": "cfaaa471-847f-43a9-bb91-22b09ff514e7", "value": "T18546331785200966D7F86734836F72471686F616208A3F931F2A93D1A5073EE2DACEDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061716, "uuid": "75c39a8d-54d6-4fea-a01d-c2ccbf71c597", "value": "98304:PPOh0qtEhzncdiev8Dqwzsttf6J2EZ0zvvUXVgRVKMwLDyNVDvFh/xoXZH5imy8D:s0qGhzBePKsr6JfZ0zEXoV6LGV//4l5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773061716, "uuid": "9a8e1cf7-bd2e-4384-a889-65137bc232eb", "value": 5872314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773061716, "uuid": "c96bbffe-5d7c-4b59-84fd-c52febdef3ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061716, "uuid": "7443db4d-e35c-4745-a7ef-c5d86918d9eb", "value": "B\u043eotsta\u0440pe\u0433UI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f224d57-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039184, "uuid": "38e25cc8-e406-4b50-ab4f-1c72e58dfc49", "comment": "Malware payload", "value": "5a060e56687d0659e883d71e5d90add5", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039184, "uuid": "fc9ddf18-df0c-49f6-a210-ac912c99c600", "comment": "Malware payload", "value": "b44d295cf414cdac34366c6a0e67b523ef9a29d6745d67adcc0407f93ac64ec0", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039184, "uuid": "e87bfcc7-c525-4909-adc8-96ea8892ee96", "comment": "Malware payload", "value": "d25328d46b0182b169e8ab8af80b716e97a9f4e1", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039184, "uuid": "1631b6ad-944e-43b9-8fa2-79c537f71a8c", "comment": "Malware payload", "value": "f41a2dfbe0db0601071c27962dea9debb5a9b0c65f041f986516df3836e42a1aa5838e3758fdd14005c7d9a5b2b31cc9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039184, "uuid": "2d094ea0-2ae6-42c0-8b1b-e0057ca5ff33", "value": "T18164F1779AE57E7CC2BC25F3446330B4B2D92C0A493572206A0B4BDE8D5522E991E1FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039184, "uuid": "f37c7462-346f-4e38-875e-f249ddaa9434", "value": "6144:rHxktl5lNXlEMsBkUK1pownvPo1zwxtyq3ojyUBcXMmBzqYSNC0qGDQ:9ktl/NXlQBkUK1Dvgdw+dBwMmRRICyDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039184, "uuid": "6de43dab-f511-478e-ad29-51730a25f0a1", "value": 315039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039184, "uuid": "80fe8ac2-cc7a-4094-95f9-8fbf85a2321d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039184, "uuid": "ec993ed5-ae5d-4598-a725-5c79bb93f989", "value": "transferReceipt.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c45e68-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054088, "uuid": "229e285e-0d24-4b77-bf61-e3ed111a96b8", "comment": "Malware payload", "value": "87a6ee2c73ce30655a84efcdaf711f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054088, "uuid": "a4bf7db5-81cd-4743-8f1f-e3a0e7c0788d", "comment": "Malware payload", "value": "b6709c504a055db9aed748566767abe6abec109f73073813f2133351872ddc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054088, "uuid": "bccb8397-cdaf-4865-85b4-502723f077ce", "comment": "Malware payload", "value": "816dad7a1d85318c66ae5d95fd991c0bb1edfd42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054088, "uuid": "6b5c8e5a-e77c-4fec-aa8f-4f03dd1c1b42", "comment": "Malware payload", "value": "56ef5e58f635768dbbc185e89df79e2bc56d55eb111ab468359e35eb9109ac31fa7738542a628af5038c39cf6ba8c425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054088, "uuid": "a1e646e3-133f-4b34-99d3-89a4be0de943", "value": "T106E35B45B3E500E9E1B39238C9B61616E677FC061B71DAEF03A043661F336D09E3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054088, "uuid": "d921afc0-68a8-4809-b876-851620921e3b", "value": "24d44c019508e0e950930582319f3fbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054088, "uuid": "1b837682-d81b-4fcb-b57a-20f0a6463d14", "value": "3072:gEuBBzs8oL+EAtM1gKTM2E/RK6qeQ9h7lnL+plzPQ1:ksM2EUhvlnkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054088, "uuid": "e58c45de-2cb4-450c-a551-63b8afe6dda4", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054088, "uuid": "37bea177-41a3-4435-8e93-4b28861315ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054088, "uuid": "b78801b6-acbe-4fb1-b103-6d44863ba38b", "value": "b6709c504a055db9aed748566767abe6abec109f73073813f2133351872ddc2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf420e02-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070618, "uuid": "992acb78-fa08-4dc9-b5b6-e07aad0adf61", "comment": "Malware payload", "value": "4cbc51de48eda6457458acb5f07a9cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070618, "uuid": "cb3c3ed5-e575-42c2-86e7-9874098d432d", "comment": "Malware payload", "value": "b6922e38b110c7ed9d8f32241482a126ca7b8085ab7ea09e16d34d78a047f6bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070618, "uuid": "2b9cc715-1c53-4226-b4e0-89bb207d5919", "comment": "Malware payload", "value": "173e30ce927a8f8c8e4171c22a63b8e44cf276bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070618, "uuid": "28e0f4ca-fcb5-4101-a364-b785ff44ab7d", "comment": "Malware payload", "value": "eef1c24702acafe2ed700868cf4e5000608194ad2f84a33fe54d2c393dcd56ee376cc0e458bbf1ae97457fbab7c05840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070618, "uuid": "864c5124-5cec-4ecb-9ee5-22c08a979fb6", "value": "T1F8968D43EC9159E9C1EAA63089B38253BA71BC445B3223D72B50F3396F777D4AA79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070618, "uuid": "d92a7d3e-81a4-436d-a24c-1a4a8f78fa71", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070618, "uuid": "7612a282-4e93-4d46-bb36-ec1a958d32b4", "value": "98304:i2on82Cf2LWJ9LofVKExqn2MXl5EoSKq7d7H0zb3enAM8QaU:i2a8J2L3dA28l53SXd7UnenAM8Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070618, "uuid": "b2b939fe-da34-4b09-b9d5-55d7c915ef83", "value": 8931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070618, "uuid": "7124c866-599b-4261-98b1-1163e4288214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070618, "uuid": "36aa924d-986b-4bea-b55c-37b4a0895a21", "value": "b6922e38b110c7ed9d8f32241482a126ca7b8085ab7ea09e16d34d78a047f6bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1347066-1b60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773023806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023806, "uuid": "228377d5-9eec-4a08-8ef8-c69e31382d75", "comment": "Malware payload", "value": "79a4e5621dd41a2b211134ed7d06cc65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023806, "uuid": "91d6e32b-52f8-40e7-93fb-6a265cc0db4d", "comment": "Malware payload", "value": "b6e3636e2363f59b476148e371f072ce08fd94c489b684c309ff7329401c5c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023806, "uuid": "4d4cb3b5-b001-4c43-88d4-a24fcb9c9606", "comment": "Malware payload", "value": "92282a18077f6b685cab3e5fed078160c01f0328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773023806, "uuid": "820864cd-06b7-48d4-ace9-ea4d714d450b", "comment": "Malware payload", "value": "a4b1055ba3ff85963b6d0846a2f19eb91de947f573b9a01e4a7bd96a9569898475a09031924298b8ddeb9c7569cac167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023806, "uuid": "81d9eacd-0357-43fc-8a0b-005c3d920813", "value": "T134D31281DB1C505DC3A48976AD8663E0B71BED0DC3ABD31E2592907E6C0EB05FFA5784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023806, "uuid": "c70f262d-fea5-4165-a4cd-168492f808af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023806, "uuid": "6c92bd17-7b2c-4809-a5c2-81b78114eefd", "value": "3072:9SGcO9IBHrVpXy2V135o4QuZwMp53blz6sdblTPV9tztLG:mO9CVpXye13iGdJ6szLNpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773023806, "uuid": "37e0fe20-0ae1-4e1e-9ab3-c81780e3a1bf", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773023806, "uuid": "eff9d7e9-b827-463f-a718-fac7a010ba7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773023806, "uuid": "ae9c1bb6-de4e-4956-a251-a0b70d44260b", "value": "SecuriteInfo.com.Trojan.Siggen32.27210.21996.25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05024065-1b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773021746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021746, "uuid": "5ae11230-72c9-441e-a778-efdb2a965eec", "comment": "Malware payload (Mirai)", "value": "471c2ce766eb496515dc2357f1939e4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021746, "uuid": "5f0de5b1-1221-47a2-b3a6-edd87605417f", "comment": "Malware payload (Mirai)", "value": "b6ee6eb7d33a8c2e4963c32e078d3a86e7d3a96a3eb78b699996136f3a4c297a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021746, "uuid": "dd1476bc-ba20-41d3-b50d-2e6b2e2cd419", "comment": "Malware payload (Mirai)", "value": "92b859e1b455e4d6154d20a24b42a14706158e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021746, "uuid": "e62898d5-31e0-404b-9f10-16e2c3ace92d", "comment": "Malware payload (Mirai)", "value": "58df2edf686a944a621ce0834bc5eccfb7548755955bd2d4787bddd6562333a6e5ee9d49aca37112844863f71f22fca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021746, "uuid": "8c6b9f74-8661-4ecb-a7dd-e5806e8143fd", "value": "T1A344E7076B517EB7C4DBDE7306F6C60024CEF45327A0672A72B4DA6CB91A94F0993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021746, "uuid": "daee3bf2-e146-4a13-8650-3f072b216da4", "value": "6144:bnI3XtV9CaLTCTc/RpKEbmvL50ZNxPtHyGtyTlHI1:rINLCO/LKEbmvL50ZNxlHyGtyTlHI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021746, "uuid": "20212a07-2396-4e1c-8364-a1456402526f", "value": 257279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021746, "uuid": "5613a75e-2c54-40a9-a687-c3a8d4519676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021746, "uuid": "21d86314-713c-46cc-8516-ac8c1209de7a", "value": "m-p.s-l.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea0384e-1bca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773069194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069194, "uuid": "7f9b1f5d-2553-4f30-a190-551e99cb87a6", "comment": "Malware payload", "value": "e3ec1b5c884bd36525abed21b92dd5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069194, "uuid": "a2f75a37-4457-411b-baba-7f8b6a2e39fb", "comment": "Malware payload", "value": "b8464ed3baf9bcf768824e0c4baf2a08af3138118d4f2a9f399e2a85c4cd2149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069194, "uuid": "11f01f23-b495-4082-8023-7abbc02f6aa3", "comment": "Malware payload", "value": "3c1fb176e2691c335ed32f315511bc64f4e7c969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069194, "uuid": "b7ca02f7-f95a-44d5-9911-f25dda2bb6fe", "comment": "Malware payload", "value": "b564f50203d1cadc7e507ac78f9598061bfe759e4bccf43f4cf4db3134463a14416e1ba1d44d6d53f58f021f4a1ca1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069194, "uuid": "f099f2a5-e922-4723-93a5-3bab3f322219", "value": "T1EDC4AE457BE1CA1BC26107789EF7E23D733D9DC16E03871322107A697B76BD81E812A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069194, "uuid": "2f549c5d-bb48-47bd-afb5-952d5fd3008f", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069194, "uuid": "14949f9d-c2b9-4ee9-85c7-8109ee3264a2", "value": "12288:5baofv/V7y02gxJHNhMLclVavYsT152ztANh:h5ZRVILclyT1rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773069194, "uuid": "64527f6f-475c-451b-8f3f-5ba904cbe8ed", "value": 567064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773069194, "uuid": "89be0c5f-6d4d-466c-a3e1-bfd78c5770bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069194, "uuid": "1cd0f24d-556c-4072-88b9-dbb0f3f8acbc", "value": "Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87220fbe-1bac-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773056324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056324, "uuid": "623bc714-7f43-44b0-8d7a-282cdc56b9d1", "comment": "Malware payload (AgentTesla)", "value": "ec384fb57efdba014511cfed7e01e5d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056324, "uuid": "273d4e8c-9dce-49c7-97e9-a0d98c809a95", "comment": "Malware payload (AgentTesla)", "value": "b853b61b0ac822b0544f86220bf521bb640c2de25d6de7fe1a92bceecebc3c09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056324, "uuid": "2b550a1c-1443-45e2-958f-c406f4ccf150", "comment": "Malware payload (AgentTesla)", "value": "115b039736143902b63dd734d9035ac27855034e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056324, "uuid": "daca7322-b646-493e-a4a9-8f6140636b94", "comment": "Malware payload (AgentTesla)", "value": "5916bcc79851f7dcfd8aa36a176aeceb761604bc54bb90d1800c9ba1f0817be52669058cf0496696332b7fde2fc2ade6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056324, "uuid": "5a3331bb-367b-4f33-9aa8-596b41b277ea", "value": "T18F160950E5C496543823AD72B764F09159C666D77E83B502E02F37B1FAE73C2B92222F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056324, "uuid": "65b855f9-e3bd-4a3f-bbef-b6f81a25a221", "value": "98304:a0e2N5JBSZrBLZa96ulsPKOHKNLPKoK0Qu2rC9reKSXm1xDBbbBwyi5M26FxFSc9:a2N9u0fePhHroQHWWwxDBJwymMXFxUc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773056324, "uuid": "1b0a248f-b90a-413b-acf7-350dc675cc14", "value": 4181657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773056324, "uuid": "e4302633-6a42-4097-a1a7-df4fe6a88e4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056324, "uuid": "f93302a0-0113-47d9-af3c-c357530e1f04", "value": "SOA & Invoice.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f47755-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070735, "uuid": "84533215-a8c4-44eb-b565-7217a6b5cfe7", "comment": "Malware payload", "value": "b0090c20a58c30b624f2a580ec2e86c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070735, "uuid": "c81e25d6-c899-4e4b-9461-20fcf0fe41a7", "comment": "Malware payload", "value": "b8575cb79b7230496b78d0d5b3e3ef57dcd438465ef1a1a2f904191836a55430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070735, "uuid": "dd4444e8-2ace-4a4f-ae55-2e74d5a5b77d", "comment": "Malware payload", "value": "07959ababa0be9bbcd51a2240a0e8beca461c218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070735, "uuid": "52f25d5c-f3b6-4e58-bd67-4db3cf31db43", "comment": "Malware payload", "value": "42365de191dc012092eb6f0463c523fd2fa7f30d254300768f53d01f6c6d84a0c7e6c6cfbd696ff5e004fedabdef1647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070735, "uuid": "e70b3c75-5d65-490e-beb2-50d6df2a551f", "value": "T13B56BEB9BC002CE6D56E5237CAA6A8D923713C125F9767CB1460B7D61E737E0ED32A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070735, "uuid": "c546b24b-18d2-4e05-97a7-31c5c62952ed", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070735, "uuid": "362bd19f-f036-4030-811e-ea713d6aa3d4", "value": "24576:mfR+Xnpc7ZToFrEeSH2ZmPrtrKpshWZe5g4pJBZEvN8GCOfSXpXZDCStpDGZU4tB:GRAp4ZUF4eCMmPMWh8US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070735, "uuid": "5f9b96fb-1fe2-4cf8-a07a-35dc2c5af98e", "value": 6169600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070735, "uuid": "53b58733-0142-4d0a-a8e6-608648714b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070735, "uuid": "6b300a4e-361f-471f-a66e-f2a0be1802c8", "value": "setupup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec9d632-1be4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773080522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773080522, "uuid": "a5f3cff2-9697-4d3e-8544-7ea62c8844b4", "comment": "Malware payload", "value": "a2d2f77e4ced27da6998ea1824c7426c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773080522, "uuid": "f5e37c55-b648-4c4d-8d02-67ced84a1154", "comment": "Malware payload", "value": "b8b7f2fbb9e7b63bc5eb78e72637a226e43a56346f524d8dd34c93f0e58ffa2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773080522, "uuid": "4c543d59-be7b-43f7-9e08-9ba6c8ff26b0", "comment": "Malware payload", "value": "fa5dfe9c2bbd55aab6a31caa8007272b93b1e688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773080522, "uuid": "aaee12a9-d0fc-4424-a5c1-ee677ecaa68e", "comment": "Malware payload", "value": "8e2f583f0abd35feedffe3ee5c25f0cfb948e602dd5f9771753fdcf0c65fbaf5225fda079efcff2b21926b2ad4e1e95e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773080522, "uuid": "ebac57c9-9173-41a0-bdfb-650d15c22a18", "value": "T1F2657D9E27E54357E8E3983DCAF008BDE8739313237DA825AC5EDA4183515C7A8D8BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773080522, "uuid": "45bde544-083d-4a47-a051-8949f5947123", "value": "24576:Dk7ZabzrFn+J1pQHE8CqDTQgsHKZR0D2J1S6rzW5CER2EjYIzX9MzOTIfzGy/dmq:D6chnlaWU66Zl0mW3aQ3QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773080522, "uuid": "9e90b922-4c13-49e6-a730-71180cb2aa67", "value": 1540955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773080522, "uuid": "a01cdcf9-6091-421b-94d1-5039a6af8294", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773080522, "uuid": "e2e775f9-2182-478d-bfea-018ede0070f8", "value": "mvxhfo.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e47394a-1b4f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773016339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773016339, "uuid": "ecb26593-cf81-4ca7-b5e3-566e9758fde5", "comment": "Malware payload (LummaStealer)", "value": "da2775f1345e0b2b4429d704f9e16eb7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773016339, "uuid": "1289e93d-b190-4024-80d5-9bc357f74c2a", "comment": "Malware payload (LummaStealer)", "value": "b94921bb31f3dafcd7b786b83da8916746d1e31c6ec7c7e66ff07291cb46d080", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773016339, "uuid": "971f94d1-792d-4d73-abd5-4f1e8fb12554", "comment": "Malware payload (LummaStealer)", "value": "7090c36a9d18371afbf43021463143af5f64ade6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773016339, "uuid": "9c484ee5-7d3d-4575-b9fa-84c7e51cbc69", "comment": "Malware payload (LummaStealer)", "value": "3f79ce8c34b3ff2299235de4c5cb37a4e0827d430665299643da7b807f7d21493c610e8d1056d4710ffb525994c78ab3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773016339, "uuid": "32c4355a-7357-4ecd-84f0-892cf98db4d3", "value": "T1C6651800FDC764B6E502173659BB63AF6735AC090F329BE7EE447A7AF9772910822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773016339, "uuid": "f0f88b8f-4772-412b-a33f-a4953ff89d72", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773016339, "uuid": "d66464fd-4b2a-4e32-b5d9-ce179544ece2", "value": "24576:ivGfGaFCrUEg/LqSnw1SD//cbavdJ1fPGCwv4TBfPwe0p4bPmV:iuOa64/ohoBf4e0p4bPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773016339, "uuid": "e4384858-00f6-4682-9907-f80f3ebf7447", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773016339, "uuid": "1f0862bd-0af1-4c51-8be6-6654099824f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773016339, "uuid": "ba3e8648-fbbf-4a0c-b555-5012b482ed80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df63c64-1bf8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088977, "uuid": "53ea98b3-4db2-46ec-8857-e542faebf35d", "comment": "Malware payload", "value": "d2c4bc85d991b9217ff16af33ae318cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088977, "uuid": "a0e20678-85f5-40a2-b9c9-076efc0f1787", "comment": "Malware payload", "value": "b959663a61d0725bcd0213e3a66a44505f7c51d1595e4070c93778ef22c9db36", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088977, "uuid": "987ea85a-77fb-4e87-b8cc-2fada758f20b", "comment": "Malware payload", "value": "a4bb6b98544a8fe56502081190d5ae039bab4194", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088977, "uuid": "2e71e62f-4e87-4c35-a7c2-04573c349e85", "comment": "Malware payload", "value": "3d1e75ab63e15688e8535f09a1a04b79431363f65b9231233b9580bcf0c01ffb5b565795ca67a94421ebdc3da881b68a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088977, "uuid": "7ed73cee-9d9f-4f06-b067-3e03c4968ba4", "value": "T1EBC3C08D1AA600A6030E7D61078B1CB79F76A5934394C7D6FEFCCD919F48A6B40FB684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088977, "uuid": "1a05a505-1c8d-47e8-acc8-f8f84bab46cc", "value": "768:JoLdWyjrM2+JCD8H28uATm2gTmGOAfnpl8J9az7b2XhS4KXTxEcU1soCUVMNK84u:uWX21QHBuV3u9ayXhS4u9m+S2H1nDfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088977, "uuid": "4ffd0e07-4493-46c5-8fa0-228ade322922", "value": 125104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088977, "uuid": "8d082b5c-02d2-4791-85bb-2a075ae8ff59", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088977, "uuid": "ee1483cd-c358-4166-8c44-858068452378", "value": "Omega_Data_NewYork_2087.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d2dd37-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053853, "uuid": "c0a5d6a9-d416-4dc3-8678-2bfc779aa8f3", "comment": "Malware payload", "value": "5d5be59f2b7d8a6b886ca96e9164373f", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053853, "uuid": "59195355-ce03-464f-8ae9-00c11b5df623", "comment": "Malware payload", "value": "b981ad60c7a354928a9dd349399885adb8bacb01e308be3c280790cf58076b96", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053853, "uuid": "d281b00d-fa07-4216-837f-1aa7c4cdc974", "comment": "Malware payload", "value": "dc44b6fad75dc06877ffdba8dc9cf66ab014c3a7", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053853, "uuid": "2cc811fd-7ddd-4252-8377-c837f1cbf0e9", "comment": "Malware payload", "value": "555e339f736c40727b1c85747fe86ca7cb727ea64fc1aa198a04d6f1b1fda12bb7d7f8fbf96775ccfa28500e787cc685", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053853, "uuid": "0139e370-f422-49ec-bbaf-b87a10a1e437", "value": "T181D388D3AB8917EC96944CF96209B523A5F3C57B3C1D22B9F9D10693B43EE10B922770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053853, "uuid": "239ae0f4-f521-4ee2-a596-b7a9d60f79d3", "value": "1536:iAkSLt5Kzj/2IFfrWCdYakGGDDDdjt0XDcYVA5rk5JiKSzAonOlQd+oEHHdZAT6e:Ep7XzC7D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053853, "uuid": "2a60476a-7530-442c-a701-e70ade42f58b", "value": 138556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053853, "uuid": "cff11ace-2781-47fa-95d0-d0e8a8a819c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053853, "uuid": "a32cad72-5beb-46a5-bec0-63a5d4b73e95", "value": "b981ad60c7a354928a9dd349399885adb8bacb01e308be3c280790cf58076b96.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62634c77-1bb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773060557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060557, "uuid": "e73f9f1e-1bdf-44b0-8185-5258448a58d5", "comment": "Malware payload", "value": "5ec4407c5e821c02e670f02babdd9d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060557, "uuid": "3ba847d9-5826-4e66-925b-9f6a077c6dc1", "comment": "Malware payload", "value": "b98d25a7281d30e0644642845647ed3c0aa7ca38890418bc948007a8522e9a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060557, "uuid": "7bc4e251-2536-424e-a389-90e1875540ef", "comment": "Malware payload", "value": "a9e4f6f5617b992dbdf347b573dcf40b21c4ccb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773060557, "uuid": "7c312af7-c96b-461a-b45a-d7785705dce1", "comment": "Malware payload", "value": "b1d719361cea47ca8a3d274b5eab197c5bedbbb8346d07c1e02257394ba861bc03bc2c30631ea18ab863bcd0dae360f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060557, "uuid": "be438b5e-688a-4795-91b4-957432510c08", "value": "T1CC940626EA60B475E89349702E79A156392D2D7E2A40ED0BF788CF4A377199370F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060557, "uuid": "72fcdc20-a150-4cbc-b763-b62076f38405", "value": "68fd1d8574af90eba5b08653be68fcb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060557, "uuid": "fdb81e79-757d-48ef-82fe-131665cd81af", "value": "12288:pmPp/YYOt0skVn5BrGgd+qVFO7BWN6K0UqZDmEAXIf:Awt9qVM7m6LZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773060557, "uuid": "5d08acfa-b336-4fe6-b9bb-b90342cc4282", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773060557, "uuid": "780fd958-fdab-4bf0-b5b8-f9b399a02d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773060557, "uuid": "928acadf-3eb6-48d5-9538-6fde9f30a27c", "value": "Lista de precios de cotizacion_658 KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8fe85a-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098608, "uuid": "572fc3a2-5123-43bf-8699-1e26f80a695d", "comment": "Malware payload (Mirai)", "value": "27cca1f481be8832738871652174d0cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098608, "uuid": "4e921817-66ab-4416-aa62-40e932a1891a", "comment": "Malware payload (Mirai)", "value": "b9b01d536edfce1cfc59a1960c64a4e0fb73d3a77676b5779547d27c41e379a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098608, "uuid": "6049c912-765e-4ee1-83b3-caffd69b500a", "comment": "Malware payload (Mirai)", "value": "4176ac00618e6414164460fa5b43903f1f7b63fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098608, "uuid": "8fd99885-3e17-4afa-ad53-fb679b33aaaa", "comment": "Malware payload (Mirai)", "value": "47ce40039a7ac3d6f2dcbf586fb1a684cdf8d2306a9e4d653540d4b37df46d27df020e745af7db091cf2c471c982074b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098608, "uuid": "10da854a-4410-4324-bff9-cdd3c8189516", "value": "T11593E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098608, "uuid": "2bbe0822-94fd-4f16-8658-fc5b7caaf9ec", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8jn:8+tsCurVDN+ouw8Lyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098608, "uuid": "0163d2d9-d8a4-4b25-b776-152a27ca206f", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098608, "uuid": "95401596-f0a7-4818-b28c-5ecd3279a602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098608, "uuid": "8cfab96d-60a7-459b-9a5e-698d3a25bbad", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f852c6-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773077850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077850, "uuid": "0c6cf9ec-ca20-44ba-a939-7f511b79959d", "comment": "Malware payload", "value": "9610724034d30868d85a475344cd91f1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077850, "uuid": "903cf60f-d266-4046-8521-25f1a72bcbd5", "comment": "Malware payload", "value": "bae2a869133ff0c276a368543bb44730a7a8e443f643e4b095453df323b9c3e2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077850, "uuid": "6ca66821-69cb-48b0-9858-c31861a4e80d", "comment": "Malware payload", "value": "25a9cd87103a8b32463d388b185d28612a6bd45a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077850, "uuid": "4614e7a0-4762-42cf-b41a-bbe240ef9e50", "comment": "Malware payload", "value": "f3881dddd7baf2b28e9b9ab179026ab3d3618d7897ff8f35f33b22541b4710bfda1e421516999c9a301aa87f59ada89e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077850, "uuid": "4df7bb44-43a1-443b-a211-fa7606707c73", "value": "T15D318B173D1CFA65C88F4F5816718352FEF2605FB600E9AAE076C3662620BD187EF446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077850, "uuid": "fd420a1f-604e-48e8-8bb6-b8a165718413", "value": "48:W2sqkecWqN6LFjWW7f+bBIyF5KlWlrIIy65Cb4uvV:fkeE2+byB4BaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077850, "uuid": "a8103229-2a27-4f94-b2c3-9356b70de233", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077850, "uuid": "54ddb7ed-1baf-482a-ab53-b1b380230b79", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077850, "uuid": "7a89f655-08f3-4312-b19d-a8068ad07c60", "value": "Adobe Reader7586749530293.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbe3f13-1bc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773065082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065082, "uuid": "d4ec204f-c842-45cb-b42d-2b4c44166f92", "comment": "Malware payload", "value": "d41aaf897fd2e98259219ba64545eb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065082, "uuid": "06278faf-4eb9-4f07-b84f-a3f30fb1fe0d", "comment": "Malware payload", "value": "bb97f2c6e31ed15e9d16a2ab72f46c86bd645d6ef91f2e365ad42abc964247c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065082, "uuid": "0ac9a4b4-a91d-4417-a7ff-45be5521f44d", "comment": "Malware payload", "value": "97d3355ca44dd12307f22dca9a88204ab1d95540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773065082, "uuid": "11bf66c8-c75c-408b-bb88-cb2a30ff5cb6", "comment": "Malware payload", "value": "60f867c93d73a754b83632080107f35a592ca60fd1e11bf83c607023244d6bb970e202acb63bc9e4eed98b4bf7429199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065082, "uuid": "1bdd0730-637f-4ece-83dd-ff62dca86d85", "value": "T126763381B39928EAF867813AC452D608D372BC5517B0C77717E48A5B1F5B3E02E3EB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065082, "uuid": "79b2b2d5-fa19-4089-9219-a1b9e35e2e70", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065082, "uuid": "2e2b2498-9363-45ed-8219-2a47e0c558af", "value": "196608:nDv8SspdQmRrdA6ly8Qnf2ODjMnGydScSEPrP0XX:7lspdQOl6F3MnG3tOrP0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773065082, "uuid": "656e9a34-4abd-4ba2-ba46-98e3d099fbe1", "value": 7611352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773065082, "uuid": "175d60ef-e88e-4ed2-b8ad-8b96d5668120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773065082, "uuid": "cf98556b-00a3-4475-a1c1-b6cbf3e17b95", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e48e7be-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046430, "uuid": "56170dc5-3da5-4148-b045-4a9dd1677454", "comment": "Malware payload", "value": "37f8a307108bdb6363f00b36fa79e460", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046430, "uuid": "21f405fc-e3ca-4272-852e-f700154719d9", "comment": "Malware payload", "value": "be31bca34923aa095aa8d1508e779cd819c7bce8d3285c8df1ab85fb7a2ca1ae", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046430, "uuid": "c23bdc6d-a281-4ee9-92b1-2ffa57244574", "comment": "Malware payload", "value": "0374a02b485f3330c80cf18b2ca349f9f15d65f1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046430, "uuid": "b19fc4e7-ccfa-46c2-95f1-2333368dbd2b", "comment": "Malware payload", "value": "18dbec31cae79ef67607e83806c3ed3985552df10f26ae24dc2b8b99bfe743ab16b1bdcac6ef8bca72e84e95530fbc38", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046430, "uuid": "702a42e0-156e-4371-968d-002b603ec30c", "value": "T198637110B870555E3EA9C56F35DF67A0EB4BB6424A106719305C548F0B6FF2F3EAA20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046430, "uuid": "574fcd5f-3b7a-49fa-8afa-d7df1b4a02a0", "value": "1536:bilkRsopF4ONbopF4ONbopF4ONbopF4ONbopF4ONv:bi+/pFqpFqpFqpFqpF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046430, "uuid": "4940c570-bd83-4be7-a9a0-f9f2599b0180", "value": 67832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046430, "uuid": "8e558216-7206-4af4-a056-ca4c91a01546", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046430, "uuid": "333b6623-2f91-468a-83bf-03010d07bfa8", "value": "New Order-PO20260303.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168a2a05-1bbd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773063436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063436, "uuid": "b791c7af-f89f-409f-93f6-2797ea87871f", "comment": "Malware payload (RemcosRAT)", "value": "20ffe6920f33fa94ab8fc3a9bd92d7fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063436, "uuid": "22b2c5e7-ae38-4641-81c6-53fddcd4a0d0", "comment": "Malware payload (RemcosRAT)", "value": "be8ab2be29b415b63a9af46d22fb908622fd066e74fdec943289508a1dc89db6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063436, "uuid": "8c33936d-d28e-426e-90ab-b9b1361fb0d2", "comment": "Malware payload (RemcosRAT)", "value": "fb5482f845003fc91c021e02b9eae8a205240ec1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063436, "uuid": "fe5c2820-05fb-42b2-87f9-0a6d8fab8b3a", "comment": "Malware payload (RemcosRAT)", "value": "4c2d08734dde09ba3fac65241823299d3257a3479733430b3bf4f9ea477be55c12bac703a4f5eb38896f9d35c50a5c1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063436, "uuid": "6ac9cb44-26d0-4930-a719-801869156dc0", "value": "T17EE2BA5771B5B26BCF14CA6C692C21C342AB4CC5489B9CD98B44B788FC959A7C30B87F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063436, "uuid": "89585020-7187-4a6a-bf4c-df0aa349f09a", "value": "96:HslepRov3uB8AvQ2nX0Q50xApK7rKPdkA0N+uWQkqgCVTbt/EupcZXTutNpLtGtk:MSSzv7xAUr1WiWGLEYEBXQkdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063436, "uuid": "1e288328-57d5-4533-b9f4-9e531e814bee", "value": 33940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063436, "uuid": "8209375f-6123-4ca4-b387-f4f8574c8df4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063436, "uuid": "6b838e90-0b90-4823-82de-1f9866b6ba5e", "value": "cc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a37910f-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773070797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070797, "uuid": "c19cf11b-0f7b-4d80-88b9-7631a660e8a5", "comment": "Malware payload (Vidar)", "value": "0e0a2fb3565dd68d3ef108cebd616b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070797, "uuid": "1a078b4a-6ad8-43ee-806f-2c908129cc3e", "comment": "Malware payload (Vidar)", "value": "bea12652a19499dab04901a82d312925d01c0b1b5092917c3d63bcc1e200bcfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070797, "uuid": "15247cbb-dd1c-44fd-b126-71f0a63703b1", "comment": "Malware payload (Vidar)", "value": "f560390cd1643e90182913d98935e8e9ffaa28cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070797, "uuid": "15cafef4-45c2-4ce7-85e4-5f09981b1ce0", "comment": "Malware payload (Vidar)", "value": "5d0ec5133ae06013e0183666149223d748b8dd662ac9a9edf3a6470ad449dcde1175b855541238193a5e371f3af1328d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070797, "uuid": "2b754324-a98e-4e1a-9ee4-c32b9a872053", "value": "T124D55C0768E4C6B6C65ED239A85265A1B7747C008B3133DB1EB0AEB56E36BC01F37719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070797, "uuid": "7070a8fe-7018-41fa-8258-d6e98cc38f77", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070797, "uuid": "f87081dd-7bdd-4563-81ed-ea955f6f17f4", "value": "24576:/kOhc1uS4wWDdhGKb2KoGc16RrJGF0QhsGzIQabm846fbCim2i2S3qhelet29m90:/kp1j4hdhGK/BRTw/zIQaH46y37a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070797, "uuid": "7ca4a511-e378-49c4-9889-a8edc55eb61c", "value": 3010560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070797, "uuid": "55fbb6fb-0eaa-4523-bb32-9edcdd54033e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070797, "uuid": "17e52794-8e79-49d9-b0da-98da9d9f421d", "value": "0e0a2fb3565dd68d3ef108cebd616b58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac59aca-1b54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773018561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773018561, "uuid": "b57b3d69-e568-4bd7-b1ac-a8625fe8c2a3", "comment": "Malware payload (Mirai)", "value": "d035f7eea74b0af6d04fd458c1b7715c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773018561, "uuid": "b28de0d2-85a4-4f71-82f4-e6dad3b79f7c", "comment": "Malware payload (Mirai)", "value": "bf814c9f566f3f01e7bfbbd2c92e4b8cf94ff06d0eec2784009f6482301f9ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773018561, "uuid": "0a8583bd-855f-454a-a2ca-256cd7c60ea5", "comment": "Malware payload (Mirai)", "value": "3d3024fd8fea3ae5634cc66c651820b357bf58a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773018561, "uuid": "38314e58-d9f7-4729-bf52-415ff82abc86", "comment": "Malware payload (Mirai)", "value": "ecde3dae06e303c2eb4ae796aa86dd83af2122bc6c1c3053648c581df9700fdc98c4cb8a1e5864a399cfa9a77837b7d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773018561, "uuid": "d2783eee-f803-4e83-8afb-2cefac9657e6", "value": "T1D1140981B9017F73C1C2ABB6B7DFC2553B736A1497DB3301AA59BEB02F0668D1E29501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773018561, "uuid": "403bc935-7dcb-47f0-83e4-d3ecbaf86d0d", "value": "6144:3VtxOY42kxr8V7MGHpvb0NyYCKZcZSmTmPw0l+:3VmY42M4qKvb0NyTKaZSmTmPw0l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773018561, "uuid": "6250624b-c937-489d-87b6-d7fe52448da8", "value": 207375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773018561, "uuid": "3485e863-638d-432d-8a80-1c289f0f78a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773018561, "uuid": "380cf4bd-e221-4380-9ec9-421f108ddd69", "value": "a-r.m-4.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afe9fe3-1bca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773069134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069134, "uuid": "ec73cfa8-5c60-4759-9c3c-dae464d97337", "comment": "Malware payload (ConnectWise)", "value": "3f0da7f2c5c682dcfec0d14185e692a5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069134, "uuid": "fa5cb2b2-3192-4e80-a62c-7660df6d076d", "comment": "Malware payload (ConnectWise)", "value": "bfa9a04c5d5bed462d38b90bf22d52455d058ec992eecd5e15a29d48502cc2ab", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069134, "uuid": "bdf54153-dac5-49ce-a1f7-7b747ebdb1a4", "comment": "Malware payload (ConnectWise)", "value": "44f790adb1d2847cef6a0f1d5710edb229e03679", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069134, "uuid": "c428095c-43b7-4af1-9447-ada5b74a41b5", "comment": "Malware payload (ConnectWise)", "value": "cb380cb9e7f75686521d57c6de37703c9648c5a77147b827aa3db40f0aa0f3ee4045d4c6ee8fd6e3edec958e58e5fa4d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069134, "uuid": "1c062193-deee-4cfe-878d-868fd4b3bd7e", "value": "T169E6230573FCA109F1B32A3AED3956F19C7B7C228D62D15E1658364D1AB0EC19AB2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069134, "uuid": "5753b941-e3a2-4a39-aeaf-667a76bbf5ba", "value": "393216:mmkEdQ03Nld/mkEdfmkEdnmkEdjmkEdHmkEd5mkEd:aE2cxdE/EXEPEjE9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773069134, "uuid": "b50b68c4-1715-4027-92c0-85ec9767caf1", "value": 15249408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773069134, "uuid": "12fffb80-32ed-4f7a-9f4c-2d63e6dc708d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069134, "uuid": "f9a49121-df52-45a1-92f2-cebf4f31f587", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f294039b-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098595, "uuid": "9c1e3596-d437-4ed4-b5fe-548f5d1f209e", "comment": "Malware payload (Mirai)", "value": "454af20a564d1c68d6f053af07f14d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098595, "uuid": "c5cc9bef-ef85-4fb6-81ea-3609cd78ed83", "comment": "Malware payload (Mirai)", "value": "bfbd7b415f754643bfd0c30e7f9d179ef00bcceda3590b3f55aeebc48514f94c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098595, "uuid": "314f873e-a1f0-4e38-a3a0-cce93652973f", "comment": "Malware payload (Mirai)", "value": "396a562735fbca8861ea715492be5ac71a51cc81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098595, "uuid": "f5f58384-5b67-4baa-9d47-cf929e0f3e58", "comment": "Malware payload (Mirai)", "value": "7223b6817d8fe3a3fb083b4d98c5f8332ba19c886f89b7e011b6d84d0310d8862d9ad8f6bcaa0d06fd6c76626d437ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098595, "uuid": "9ae74294-84e3-4705-900d-8a330ffdd89f", "value": "T1AFC3AE73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098595, "uuid": "9532bb4e-2908-427c-9ec6-afc57fa431c6", "value": "3072:hfpZykqkt436I+9eIHkmNOkSMPXeC4GnH/:hRZ0F3Bc/NOkvZhnH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098595, "uuid": "9e89bf91-2782-4b96-bf9a-8540d3cf235e", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098595, "uuid": "102fd4d2-4455-4cc0-9922-1b1909294854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098595, "uuid": "087be3c1-9553-46be-b71e-6b93a4bb7e3b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3d8340-1b94-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773045863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045863, "uuid": "be9f5824-4efd-41f6-807d-0dbc034fbcde", "comment": "Malware payload (a310Logger)", "value": "3a8d9129565e4c0c02f9818e9a9d5b44", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045863, "uuid": "4e331831-2be1-4e54-b0e4-685efd4c5738", "comment": "Malware payload (a310Logger)", "value": "bff490d7366c1fa13b1837e5415597f914b1a029a4e439e65357be923adbcd7c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045863, "uuid": "1d4cd61f-60fd-459b-ade9-e66dd00b37ad", "comment": "Malware payload (a310Logger)", "value": "eef899ded47d83abdd204c21540df3973ba0fc93", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045863, "uuid": "bd3971e9-1faa-4b41-8433-5f5e9173a751", "comment": "Malware payload (a310Logger)", "value": "cdcdcdbc8a89cf12a6993cfcdcbc03ca7d78564246edb048cfce998ad73bf9dd8d187314ada72829d3190056c7fbc4ee", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045863, "uuid": "35a04e6e-6fcd-4847-9149-257f66012be9", "value": "T12455CF0273C1C062FFAB92734F5AF6115BBC79260123A62F13981DB9B9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045863, "uuid": "cfda2c87-8172-4c06-81ad-749cdb6e1261", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045863, "uuid": "32db99f3-b9a1-449e-ba5d-f2f39acfa765", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdazgzXznYypme/OYtv445EB6GMmDGNl:vPVt/LZeJbInQRazADYyP/OwHC6GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773045863, "uuid": "893bff18-47e3-4939-8201-b41a25761246", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773045863, "uuid": "742cfa01-949f-44e1-b9e0-5a89cde5b899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045863, "uuid": "d8632454-6ca8-4056-9d51-81bbbc1ff38c", "value": "New PO#7889296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8b3b80-1bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773059953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773059953, "uuid": "4137602d-a934-46d7-89dc-43ab835deca9", "comment": "Malware payload (XWorm)", "value": "24ce3745c3d3d676bb1a98c64ed12fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773059953, "uuid": "d70f5ad4-8738-47c6-88e2-be0feff8def3", "comment": "Malware payload (XWorm)", "value": "c07ac71d6daf7d2fb45a66e96713770cf755c3e8b8f96a260d50ee5afa8aac1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773059953, "uuid": "39ea0149-664c-4f31-b1da-30c36a1fdea0", "comment": "Malware payload (XWorm)", "value": "7399862714881d434eb43205f4bf48886e633474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773059953, "uuid": "cf287a63-63f7-414e-9308-e73e974ae759", "comment": "Malware payload (XWorm)", "value": "41d74e1c04c0de36ddae1abc924fb07f48f48870636eb50c364688590ee2c0b2d5f916cdb5d0e3aa1f0e88c7b31456ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773059953, "uuid": "730dbde3-7643-4bef-a7a8-33abf204333c", "value": "T107F50744FE8467941E13DE233F2471D142D26A5F7E86C782E41BDEB2BEA3085E922D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773059953, "uuid": "44832589-d32d-4313-9001-efa828ed013c", "value": "98304:7t/hmcZj+xonR9nEerAfvHgFwQ5Ptx5Z9xv4KB3ZXLaMKo6RvbM/JT3lMNNvBYex:OSK+GGqvAFV5NZzv4KBtaLnjM/nSNvBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773059953, "uuid": "4339a660-1fc9-4ae2-a1bd-848afe69e817", "value": 3444178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773059953, "uuid": "5a0eb702-4f67-4d1a-8879-98c98b02f9a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773059953, "uuid": "3225c4cb-8417-4286-b208-acc8bbf311a2", "value": "CBMINV 14453.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79546a0-1bcc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773070202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070202, "uuid": "7dfabc9f-5e53-4667-aee4-85ec1bfbfcef", "comment": "Malware payload (PhantomStealer)", "value": "ecd166ed0df0d25d60c61e1f55f5b5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070202, "uuid": "af8eec75-a43a-462a-93bf-569f676e734d", "comment": "Malware payload (PhantomStealer)", "value": "c08f0093379918437a0f1c18f9236b6f7c3da6d6e63316fec04255891b4e1609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070202, "uuid": "a3ef0a8d-8597-459a-a30b-987fe44e1406", "comment": "Malware payload (PhantomStealer)", "value": "aa8e78f85b9b47e707de560808d92591687375fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070202, "uuid": "aa353ecc-fc20-4fbf-9e19-b605c7236333", "comment": "Malware payload (PhantomStealer)", "value": "3b9721a49ed19737aea62afd81d6832be9c1d2da755a61b1474c891bd1916af8afaeb670915379b86743161f74f3c907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070202, "uuid": "12e78063-8e3d-4947-840b-5c1ae6dc64a1", "value": "T12E26CF4046D07B6049B00B6C21FD0A5F66AA9E54AD92B3CDE53BBDCDDBBD3C86163078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070202, "uuid": "a7518931-51eb-45df-ad09-6c359cfb809a", "value": "24576:Zw3cduQR5FvpS2erFbb7R4EQQnuG1YY9sLYnei/kUEU8J/RgtTQTbVS3Bkfqb+mh:S8QIXr0WfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070202, "uuid": "cf92ac82-e2f9-4f73-a23e-6c9778674e6e", "value": 4604727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070202, "uuid": "a27da93f-cd45-4464-b9ce-85bb02913f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070202, "uuid": "5beed168-607d-4cf1-a5ef-dd96232b618b", "value": "PDA Query - 180397-03-010-26 Port Agency Appointment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc1e6ca-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039125, "uuid": "ee1873c6-5def-4eaa-984f-885bc0702f68", "comment": "Malware payload", "value": "4531912fc48abf3d29390fbe2d964c7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039125, "uuid": "3eba7106-b8c6-41b9-a34a-9dcfb34fccc6", "comment": "Malware payload", "value": "c0af34161bd30a3eefe50cc4a9b18279cc0b09f88942de9ce8728dc832fb877f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039125, "uuid": "2e61cbc7-869c-49a2-acac-e2680fe4e85a", "comment": "Malware payload", "value": "6d2adc354f8639e7f6bfc1e314c331db22ea497f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039125, "uuid": "0aaed8b3-3aee-45e1-9c6c-7e8b60f6cd98", "comment": "Malware payload", "value": "0636189e56826832997e007d2670f3c2390f06a4672a6d3d2cbd1ab3c46494d4785b67bcf46981a274e5e78aac805599", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039125, "uuid": "6ee52088-085b-4268-a0e6-74416a21e66f", "value": "T1012412DAE6A4800BE10610B27D12B3AEF776BD79413FACA5B531D290E3F3162D363544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039125, "uuid": "0b7493fa-62cc-4401-bb9b-0aba8e4642b5", "value": "3072:KpC6jmDnmSPWfl3Fbsljc9pafjDuND+45yzhc2wKwdx+kska6Wb/XteY3m8IDWts:KSXWfPslYqLDuNDzN2a4v6CzHsWts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039125, "uuid": "383be14a-3de6-4f50-a68b-e681f2c3bc73", "value": 226488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039125, "uuid": "d79e98b0-93a9-43b2-9aaf-60fe6d6770f1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039125, "uuid": "bf0756b5-ee59-4c07-acab-8f546deb02ac", "value": "NewXBOQXListX2026-03XEastXProject.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c855070d-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037106, "uuid": "23072372-7e7b-406e-94ec-a40afc79140b", "comment": "Malware payload (Mirai)", "value": "267c8c10720d163f5bd75214ab23de2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037106, "uuid": "3ae810a4-783f-48f9-b7cb-9308f6baff5e", "comment": "Malware payload (Mirai)", "value": "c26e56ba27dccd03bcaa88d79c99ab4b745b1d818e8276ab88f2febbdbdd6515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037106, "uuid": "8d2f19e0-4eb3-498d-abc8-1946c98389d9", "comment": "Malware payload (Mirai)", "value": "cfa0b1721a6eb1b8b8b588e4bafc45aed5865c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037106, "uuid": "f863131c-120c-4732-8990-4e7d00c95580", "comment": "Malware payload (Mirai)", "value": "fd932e4ab026c07c43f026c448072a71273313241c0710621b75a3bef200808111bd71a0563b6fbf7d011ff374fe82de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037106, "uuid": "85b23a37-a36b-4627-8020-c6557c2d0687", "value": "T1C8532A02B7090F03D1532AF026BF2FF19B59FDE126B5A584752DBEC592719F12182EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037106, "uuid": "34e0fd63-fdfd-4094-82a7-f9fa4df63347", "value": "768:V5dITn+vaoMbLNfJ0GFXKcLQlyCpS5b2fwXI9YNp4PIvyRmVIew:V5dIz+CoMbBfeGMc8ACpSaY/4PDRcrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037106, "uuid": "cd3530e3-b1c1-46ba-bd7e-0f048506621c", "value": 65808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037106, "uuid": "d03074e0-8936-4496-85eb-a2c5f581337a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037106, "uuid": "3d1a2b8f-a5fd-4e5e-a903-14dc878ee675", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1ef5c8-1bdf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773078315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773078315, "uuid": "b195891c-6182-4034-981d-0c26819cbfe3", "comment": "Malware payload (ConnectWise)", "value": "fc6c9fdb89c322961bbbf0a4f0cea5ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773078315, "uuid": "ecce7e4c-1311-4185-85cc-bc44d2f47ee7", "comment": "Malware payload (ConnectWise)", "value": "c2a0820c49e988c291f0d7b24105da595546674e3a164b424546df13919ed33a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773078315, "uuid": "326907bf-e282-4098-becf-de5164ce9760", "comment": "Malware payload (ConnectWise)", "value": "be4cbcfc8c40e69c3ecb30fd6b810a72a023f28c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773078315, "uuid": "843369a6-bd4d-442a-a4d2-02cec911f56a", "comment": "Malware payload (ConnectWise)", "value": "1133696fa702e132abedfae3f5185bda6bef5e71231a675e40ebbe833e6902e54f60d62f368eefa55a216758d8c26bb5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773078315, "uuid": "6a8a4ee0-0d78-4023-a4cd-99e6dacbf84c", "value": "T108D623116BF89278F0F22A35E876A0B1A5377D525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773078315, "uuid": "d344cbc1-bf2c-4bbb-9fbd-dabdb749c589", "value": "196608:WHxcp9ym3nltDUJVIHxcp9ym3EHxcp9ym3VHxcp9ym3IHxcp9ym3gHxcp9ym3hHs:kGplp7GpiGpHGpWGpOGpTGpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773078315, "uuid": "fa33f660-ad14-49d7-b57b-637928702eaf", "value": 13455360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773078315, "uuid": "9e12f54b-a3a7-4309-aaa6-525d1b0a2ed7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773078315, "uuid": "9d550b02-c9b0-49e4-b8ab-f8088b54bb32", "value": "hw5yt.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfaf204-1bf6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088195, "uuid": "097ea3b3-36dc-45c7-ae6a-f7963aae5f1f", "comment": "Malware payload", "value": "cf956f42de2a5bd0353fa4c0c877a96b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088195, "uuid": "67674b6d-c054-489e-9f9b-b5e73ff434ff", "comment": "Malware payload", "value": "c2add996045fe2273d094b8ad641264df81e10ccf1bf66608c307ee8bdc411c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088195, "uuid": "0b85a84e-5f23-4e1e-9f7e-66640e262782", "comment": "Malware payload", "value": "180f5af8ae6755b50b65ef7f86c560ea8480e87d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088195, "uuid": "ba315375-4c72-474c-9dcb-3cdd437e96dc", "comment": "Malware payload", "value": "18b7dc2e012a05fa51f435490999a653f54c2e386c015c158f41f2d1aaa3dcfee6afc8d3860703b2aa865a8bbfa280c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088195, "uuid": "8daa5eb5-1067-4728-811d-60d0db5835d7", "value": "T120925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088195, "uuid": "e1384e4a-d873-4394-9c13-a05db682ce3f", "value": "384:UFcuQpWx+BL0SWL0g9zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:UF8i+BL0SI0GzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088195, "uuid": "a53a3b00-e40e-4ae6-8720-675adb7162b3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088195, "uuid": "4fcf384e-bd40-4366-80c1-63ea31365b93", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088195, "uuid": "32e30a10-e3c0-47dd-ad85-ecd527669aa1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1393f963-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773046251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046251, "uuid": "9f20cd79-5d51-4abb-9d0f-4d6151c712f6", "comment": "Malware payload (GuLoader)", "value": "63d447c1cf2bac0ea4c313c39d8c133e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046251, "uuid": "e079b664-b348-4af5-a2ee-d7b74e585af0", "comment": "Malware payload (GuLoader)", "value": "c301f73e763173ccfec4bef1df2f9ea35e5d483cded5bc6d87813bb0df53d1c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046251, "uuid": "c8ac31ed-717c-4957-92d6-0c1e76317cd4", "comment": "Malware payload (GuLoader)", "value": "846b7bb80ecbc6ab4b4ccd74604fc4058148bf84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046251, "uuid": "6df7a852-4f1f-4252-963a-0c49affeb237", "comment": "Malware payload (GuLoader)", "value": "bb7261b33a3be0a3675892f51f81d667f1ae87cd8dd036fe798f6000723f0d7706f7b294655f5cc31fe85774eba37b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046251, "uuid": "4716c33c-24f5-4eef-abce-35266bb198dc", "value": "T1BBE401156AE7C433C9940B700426D6BE6B2A6D4428D143077FD0BE9FF9772924E3EE86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046251, "uuid": "fc86143e-1599-4285-886f-5605465f192a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046251, "uuid": "f4d01a3f-57eb-47b8-90a2-7841b04dfaf1", "value": "12288:xL2FyV3yC/KoErt+93mpIIcL1wWUx1usXMfv1zEzZQ+Erd:xLoyV3yQACwM11Ux14fv1zEF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046251, "uuid": "3118dd07-da2d-437f-ae8d-2d6a37a50727", "value": 680568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046251, "uuid": "baab9e63-28b3-4f24-9c29-37351003bc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046251, "uuid": "24d158a2-f104-4902-b6e4-a37b22d6eba3", "value": "Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe0fe02-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1773077860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077860, "uuid": "0cd68b27-96bf-47fc-8977-866e241bb29c", "comment": "Malware payload (GoToResolve)", "value": "10f6b9f8edae7b834238ea6d082b7060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077860, "uuid": "ad9c5f40-a128-4de1-8a78-af20f59dcb8e", "comment": "Malware payload (GoToResolve)", "value": "c37f242047aef3d35f06639206de1f2ce356e5e9d1c8cddb34e16551dae9da0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077860, "uuid": "4e18b021-740e-48df-84b8-5d87171874b7", "comment": "Malware payload (GoToResolve)", "value": "22f34d0d125be0f0e1d908f8d6c21482c4c92c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077860, "uuid": "6f515719-5ca2-4576-a052-3999155f6a36", "comment": "Malware payload (GoToResolve)", "value": "c67a09c71e8b1d2964cb845b4975ef07c947a91cbff565dcdef0da0ac8f51276eb9e3a21ceefad515f5640393487c9b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077860, "uuid": "249d7bff-5f0e-4e5e-9040-942277499613", "value": "T1733733317156C171D48711F1AD28AFFAC2ACAD35877948CB73D85F2A9B709C26B32A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077860, "uuid": "5b309093-e717-41fc-b034-b147979a671b", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077860, "uuid": "506e9a7f-7ad7-45aa-bfb1-40caa042634c", "value": "393216:YAwoMOd/9DYp3Q7xwvcqMcfuIp6HIaW947I3Xon91m/FHVP+zTLy3qOZXMdtW6h9:4oN/98pg7x62In947T8ZkHe3q6F6hljr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077860, "uuid": "17bb9ebc-7730-4e2e-ae79-1816f64b80f0", "value": 24473624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077860, "uuid": "e995066c-58a7-4dfd-9267-693a0c84dfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077860, "uuid": "56706740-80dd-4245-a92d-c73e0b020c0b", "value": "Documentt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb6946-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054264, "uuid": "f50af20b-222d-412a-9158-31fc182f4766", "comment": "Malware payload", "value": "9aa16d95fd7cc7af45f550db20790adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054264, "uuid": "4785509f-641f-41f3-9aef-c0b3f7d77fb0", "comment": "Malware payload", "value": "c40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054264, "uuid": "a65a4cdf-e5d1-4dc5-b806-1c73cd2dca5d", "comment": "Malware payload", "value": "39d74f6c38f3da632c186bf5d8a91fbf34ba00d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054264, "uuid": "d5876cbb-3170-4fe7-962d-b1be6d1574e7", "comment": "Malware payload", "value": "4a49575f461c45e546e3ce877664a8dc4b515ed346be30fb6f622af506843768e64f939f428d56d8c6255c1ae2cafa17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054264, "uuid": "ab3e3145-1c32-4539-9a9d-96dc3a28d919", "value": "T1D5E35B45B3E500E9E1B39238C9B61616E677FC061B71DAEF03A043661F336D09E3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054264, "uuid": "3d439362-0dc3-4511-8651-40e720082a14", "value": "24d44c019508e0e950930582319f3fbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054264, "uuid": "8c30513d-9e84-4ace-90a5-a72f520d9dfe", "value": "3072:gEuBBzs8oL+EAtM1gKTM2E/RK6qeQ9h7lnL+plvPQ1:ksM2EUhvlnkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054264, "uuid": "d24c3dc0-e442-43e7-a317-877cab122609", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054264, "uuid": "6606bbbb-6df7-4399-8fb8-36cf7f159a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054264, "uuid": "f4651ec8-517d-4571-8570-bcd07f318788", "value": "c40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34020bf-1b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773039755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039755, "uuid": "22b10588-ef77-44bf-925f-5620f598a03b", "comment": "Malware payload", "value": "22eb13c1f2dfc9b96bd867944e8d13c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039755, "uuid": "1c21eac4-8a37-46b2-8ad3-5d354470bcc1", "comment": "Malware payload", "value": "c42ccb5ae313cad6f80d1f0aaece1e308e617b6a2d14418ad826f7277eac11b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039755, "uuid": "7af4bcdf-6d62-47a0-89e0-22d6bcc8feeb", "comment": "Malware payload", "value": "c8a3dc8670a9b7317fb77a54c7d94f14f5a74017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039755, "uuid": "7775e3f9-7edc-4002-999b-914be87dd817", "comment": "Malware payload", "value": "309a79154d456f1358d9ab9b424e216379f194e8a069600d7032c1c2172669c77040ac3fea6ff7c8d1da71e09c2a41cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039755, "uuid": "fd0736c5-75c4-435f-b34f-0e923d5f1c00", "value": "T1B173CFB89BAE41CDC083F9789C9E82C346655E0B11110B76AB317D94BF2F5AB3709B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039755, "uuid": "677cda16-3bb7-4579-a53c-c24c4d892275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039755, "uuid": "2e0f8f42-889e-45a7-86e2-a4df382a8dc4", "value": "1536:Ocb7tS8jLQIEerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9cw:Nb7tSaLQIcoQntK+C7VieM3SFZNt9cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039755, "uuid": "91ecb295-580c-4642-8630-52213482b887", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039755, "uuid": "1f6a9d90-12d5-4064-bd10-610c40679ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039755, "uuid": "b63cedf3-e7aa-45f6-89d8-87c13593d7df", "value": "10042792 - AKPA K\u0130MYA F\u0130YAT TEKL\u0130F HK. SIPARIS 4500683916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f689bc-1ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773053830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053830, "uuid": "e9689209-11ef-419a-bb5c-a3f7bb12b12c", "comment": "Malware payload", "value": "3e48df01bdb16fa108921260538299fb", "object_relation": "md5", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053830, "uuid": "b0028a6c-9f51-4cff-b1a2-c2977cd70652", "comment": "Malware payload", "value": "c510b8a58797b05003954162245a7ea5229e24b58c327238fe139086ce5c3649", "object_relation": "sha256", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053830, "uuid": "2124b2d7-3b4c-41ec-8a28-01f2860ec91c", "comment": "Malware payload", "value": "21d01e013d4cc94853382ec9f75617b081381c16", "object_relation": "sha1", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773053830, "uuid": "d816b712-314f-4587-a4dd-a4df18cf349c", "comment": "Malware payload", "value": "a6b1c5cf9469967e0e8d7f397d763b4549d8580b94cfe045d60b2b20b27349ef69e6b75015a91b0bfe5eae6063d1cb5f", "object_relation": "sha3-384", "Tag": [ { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053830, "uuid": "ba4b123c-aec1-4f28-8314-64c79624fd4d", "value": "T198A38BD3AB8927DC96948CFD6209B523A5E3C97B3C1D2279F9D14693B43DE10B922730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053830, "uuid": "45beab35-cbd8-4be6-9a6d-bbafcd975ecf", "value": "1536:YNZ9BCga6D/rICdsaKFcVYvlRsSUFnocF3SYWx4Hr6LKnly:qiNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773053830, "uuid": "4fc1b1e6-8af7-48c8-8672-f8a02d2e553d", "value": 105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773053830, "uuid": "f7c26871-6bab-4b23-82a0-363cfa163f92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773053830, "uuid": "bcb589cb-4476-4916-a1b4-62caf536f95a", "value": "c510b8a58797b05003954162245a7ea5229e24b58c327238fe139086ce5c3649.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4551db-1b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773042858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042858, "uuid": "c9e51e58-cbf4-4a4c-beab-b3a1cd3d6966", "comment": "Malware payload (Formbook)", "value": "7378f5af23a743768da6ef8b5f8c0507", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042858, "uuid": "b772a5ff-fa70-49ba-90ad-1fdc3e7283cf", "comment": "Malware payload (Formbook)", "value": "c58d6894e0e50885d3ec4f98cf7d5d3d84183868e022584464b7acd2943be11d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042858, "uuid": "2c50f9aa-c8f8-42cf-8313-3ebc2c0266c1", "comment": "Malware payload (Formbook)", "value": "cf060b17c9dda7338cbed6fc5262445f73454f78", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042858, "uuid": "5c1e86f2-0d83-4b3c-ab9d-c8e9883690b7", "comment": "Malware payload (Formbook)", "value": "bb51a1992d54ca73e6656049cf1b9cb2eac9da76f12fe5fa9c43b36b15cdae7bd047bc693028f56c4eda70accd8a9eb6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042858, "uuid": "70d3f4a7-d233-4ccc-a58a-4576b8aec41c", "value": "T159269701A2D5812777211BDE5A19DD31DC4E18133AC8EA86B15FD70B3B9CAC367B87E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042858, "uuid": "ad598023-7fe0-4e24-b3d7-7a1dd92e9492", "value": "98304:GgxSClx52DuzG9OIZTwbU1Kj9e0MpjILeJGFPdRniU:jlPjG9OIZwv9e06Otdlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042858, "uuid": "64213760-4d45-48bd-9aec-b751ecfdf806", "value": 4855123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042858, "uuid": "de4f5278-4d34-476e-a0a0-d3f8d5537b72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042858, "uuid": "16a0ce7d-cca4-4bb1-aac5-bb0bf1a883c2", "value": "Sent transaction overview per transaction currency_3601_8667589424750807.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0321fb25-1b63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773024749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024749, "uuid": "76f26091-19c4-4be9-87b0-9c0247797bc1", "comment": "Malware payload (Mirai)", "value": "bf0dc0211cf76624d597fbb38031b4f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024749, "uuid": "38c5d706-548d-4120-9193-ff5aca426ace", "comment": "Malware payload (Mirai)", "value": "c5ed827bb7d397996f03ba55a7e4263527a0287c9f0c1aac106162b4d6e46514", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024749, "uuid": "d17fbdff-c13d-4b04-85be-6b43959e1080", "comment": "Malware payload (Mirai)", "value": "99310f3683c7a72cd407600363271b8f20ea08e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773024749, "uuid": "0ade8b40-28c2-429f-b2c6-2483ffaeb429", "comment": "Malware payload (Mirai)", "value": "e3c289cdf902c84ff3d74884d544f0934da7d988cc59cbc5c221b24ea5f5638e452cb5db5182d32e3cb7cb2f03005ff4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024749, "uuid": "353f6e73-5ca4-4525-ba17-249997467798", "value": "T11ED42855F8809F61C6C539B6F74D42A873074B79D3EB72069A254B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024749, "uuid": "e20deec3-347d-4156-81bd-e8bf90f87159", "value": "12288:WfQTzV2hXqU0W5HyGwS1i4Z1roGHLeX404XFbAUp8pZuNjA:wQTzUlEWczSI4Z1rrHaXWpTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773024749, "uuid": "a54ea2a0-f537-457b-9412-93692ee4bc5a", "value": 608960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773024749, "uuid": "8b9addcc-9ac7-4f4a-ae93-8718868b0667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773024749, "uuid": "2378650c-c24c-4899-9c93-445ceea2db19", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1dab5b-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054079, "uuid": "4d6e5688-d968-4f96-826e-79bbdf1647eb", "comment": "Malware payload", "value": "ebde544172cdf36d2ba2dda0a941cfad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054079, "uuid": "a1b9655b-e974-4495-b870-27cd0af40128", "comment": "Malware payload", "value": "c643e735647ac2cdbb7899ddadba763c09e042a050f5b028e0dbdec748e47b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054079, "uuid": "99245dab-9d68-4503-bdac-1e062a9f7614", "comment": "Malware payload", "value": "5ec0f4cb40b2a3ea249c3604edf3c7de6be20d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054079, "uuid": "e25b0a25-779f-45c5-9c4c-b793fc247471", "comment": "Malware payload", "value": "1cd3b2cb6660580cbd2adb26c7efc9257f3a8606b196a8d896b532f17ae561979deb3a1b315e2f766dd2a20895bfc74a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054079, "uuid": "3df2d22f-9aa6-446d-a945-cd20faeb8cde", "value": "T1D1E35C4573E900E9E1B39238C9B61616E677FC465B30DAEF03A043661F336D09E3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054079, "uuid": "7313d503-25fb-4b64-8ebe-1872c689cb9c", "value": "24d44c019508e0e950930582319f3fbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054079, "uuid": "bdc3963a-c138-4d3f-b27a-5c78344a63cf", "value": "3072:gEuBBzs8oL+EAtM1gKTM2E/RK6qeQ9h7lnL+pl8PQ1:ksM2EUhvlnk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054079, "uuid": "c3a18ba7-8745-4a07-86cf-ba27003ed2cc", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054079, "uuid": "71a4adfd-5a91-4a4e-a224-164731d3ce3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054079, "uuid": "4441c3b3-341b-41f3-a315-dd0e7d662f9f", "value": "c643e735647ac2cdbb7899ddadba763c09e042a050f5b028e0dbdec748e47b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb4d6fd-1bc7-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomStealer)", "timestamp": 1773067745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067745, "uuid": "46dc73cf-ab8b-45bb-9334-10b7925af638", "comment": "Malware payload (VenomStealer)", "value": "39cefb363decbb322f091e2af5de4e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067745, "uuid": "326484f0-931b-40f2-9f30-fabed8efec7d", "comment": "Malware payload (VenomStealer)", "value": "c6f97662843381691d14542c0f031a43ea91d91613acaefcd82d5bd14752b228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067745, "uuid": "ada32081-4a66-4c5d-9421-b3a35c9de49c", "comment": "Malware payload (VenomStealer)", "value": "e1e3331ce4835ba6102f8e679c38d82ca7089d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067745, "uuid": "58c1ede9-bc55-4782-932f-a92ff6fc9cc1", "comment": "Malware payload (VenomStealer)", "value": "68e77ce3d590f1d7fe8dc9054ca09e294025b00a9db71f585c01e030cb18a03ac22bad2c4abb0a2e089301acd46df0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067745, "uuid": "8f395341-c967-4063-8d13-5ff2caa5d314", "value": "T10C0733ABFAA0593DEC99517F0566C002D971FC664794C2BF22E06169BF332E07B38B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067745, "uuid": "e2902fde-53f9-4ad4-985e-1145ae469784", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067745, "uuid": "ab011dbc-cea4-4153-adf4-2c77aedece8d", "value": "393216:pxSaM0tmurEUWjGwFPyM3TfFMjfnVBvt4FXLt3zLYEe1:px8dbHPgfnVKLtYEe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773067745, "uuid": "63a3d0f5-6dc8-4178-b325-944345181488", "value": 17098258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773067745, "uuid": "ae910a3f-6427-4629-8c0e-28aee7bba195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067745, "uuid": "04a7dda4-7ba2-44c7-931f-571129bf6183", "value": "39cefb363decbb322f091e2af5de4e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c79a541-1b92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773044951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044951, "uuid": "05f865b9-9911-4c58-8ef3-38f0d5761465", "comment": "Malware payload", "value": "acc8034b9872ba6a9025aa16f2609fa8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044951, "uuid": "d40b2414-cfde-4eb0-a183-dbab9834754d", "comment": "Malware payload", "value": "c712fa2a946d36693a5bed3baeddf48585519ecdb28270bb0395ff18039b7404", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044951, "uuid": "18ff7395-45a1-495d-a370-b0d89c5d9185", "comment": "Malware payload", "value": "5f8d7a75511a6c491a7a3da92082f398804d6b9e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773044951, "uuid": "4205e0ac-d8d4-40eb-a058-55f8f0defa9e", "comment": "Malware payload", "value": "e947ad98dbc384d65cbb190f0c6b4be3ef40fd117f9b1ae6acd63998f3d99db03724048e1a8a042292d29845ae8a228d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044951, "uuid": "41f0cc5c-1e6e-4758-a2a7-daba026fe652", "value": "T11FC4231DA0587B51F64B6A78B323CDB09B29D03FD219C388A0840B399B5BE5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044951, "uuid": "db4635d1-b379-404e-9b38-a8b6edbcc056", "value": "12288:qMU+0xq75aS9iYIp6cP/G2Bku6zXLpHXP427bo:C+J71vI/GzXlftHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773044951, "uuid": "60aed133-919c-400c-9400-b713e07cb2f5", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773044951, "uuid": "d17ecc0d-1449-4eeb-ad76-e7ec0680ae54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773044951, "uuid": "d2f76c3e-9c9b-4ea9-8bb9-2256500902db", "value": "And_Launcher_Dumper_Five_Custom_v2.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba685447-1bad-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773056839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056839, "uuid": "912cbabe-0f2f-4abb-8f58-983f9f0ecd52", "comment": "Malware payload (RemcosRAT)", "value": "5a0d2ade080d20632ddedc3e7e6d99cf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056839, "uuid": "c5ac4719-063f-426e-896a-073c1d670ecf", "comment": "Malware payload (RemcosRAT)", "value": "c7fd4c593fc6ccf31d39aee0d13cb287fbeb1c2a5917fb756e5fda0134da12fb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056839, "uuid": "d5da2323-2d17-4b4f-9dea-29adc818b9bc", "comment": "Malware payload (RemcosRAT)", "value": "7463651129f72cae9f33ec9ec0d043e31c72a2c5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773056839, "uuid": "0fcd0d9c-7b31-4106-be9c-495cdb4b4810", "comment": "Malware payload (RemcosRAT)", "value": "a9132246cfcf8bec4f5051e11a0f3b3721e5e7418e3644a619522a9d9221bcfd28d56a5117f2cad2a17ac4574c6daa0d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056839, "uuid": "dbc676da-8f93-48dd-976c-9f5fcc029da3", "value": "T10B051251EB4D549EC7126CBE6B9BD59980287C03CF4B670A39ED730D283227E46D1B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056839, "uuid": "0215fb4d-ccac-4bfd-a004-972e7b857000", "value": "24576:0qcuwl9BT9Gqcuwl9BT9PGIc1i6RW+b40vxC:0qcRtGqcRtPr+W4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773056839, "uuid": "afaf2612-e381-4e49-92c2-b6c736d217bc", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773056839, "uuid": "f2be978c-b6fa-463a-8095-b2c00aa5f1f1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773056839, "uuid": "07d39ca4-b34f-4c01-b61c-4f10d6a2b8ec", "value": "MACHINE SPECIFICATIONS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8907e509-1bff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "fe6b15d5-8c0b-43c6-be90-1b9d217fcc28", "comment": "Malware payload", "value": "7f1ff922b6f9f38e960dfe0446b0aa8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "cc428360-a071-4e94-b2e7-fba491176daa", "comment": "Malware payload", "value": "ca87d3d53290557dce61c193cdff308f3db400c011999470c371724cc171e9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "9d7a07e3-b8b0-450a-bd72-17b93443f4a3", "comment": "Malware payload", "value": "107d77df7d7d6bccbd0b25cb04a131925eca4502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "cd079e0e-437c-4701-9da0-3a8871f6bc53", "comment": "Malware payload", "value": "f91a97a2a04917dd47d170d5f67314428e27289f3a80c29003c86caa4a5521c4f59c3b8aa57f6ec7960409c491c1c430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "3a2d34f5-97ce-43cc-b793-89c0589deade", "value": "T1C81833233D106BC1CAB91D7B34DC7DB3839A9E857BB19087538F7D1485F9EE88582982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "acb5085d-f7cf-4fb5-8c18-baff9024e0e5", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "d5721264-0622-43b3-ad01-c812b4f0d367", "value": "1572864:T91Ihln/mP48j7LJP3sffKBOEiVzar873spoAO2y2+hzhr2f4zKLp:T9/PRfLSSqVTTFAY2TRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091975, "uuid": "0214fc6d-5aab-4ea3-9ec7-e0735c9e5766", "value": 88587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091975, "uuid": "5af7f997-e136-483e-a61d-2875858b5d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "439f6fa2-d52b-4361-8afe-c1dc35f0c81b", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fa31c6-1b84-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773039004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039004, "uuid": "dd69939f-fb86-4a0b-9548-f327f38eabf6", "comment": "Malware payload (Formbook)", "value": "6d7d089f89177a0809fa8999fb6cf86e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039004, "uuid": "5dde64f7-7cab-429e-b503-516b71403083", "comment": "Malware payload (Formbook)", "value": "caeaeb52d49625b3520daf30309058d90c85c68741124b60a1a6eb86e201ff4d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039004, "uuid": "40e8026c-e500-4f75-9f7d-cf0995b5da86", "comment": "Malware payload (Formbook)", "value": "b160bbf0524bab8719b4c56ef7640cd7fe78faa0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039004, "uuid": "13a23bd9-3940-4ae2-ad20-098a13655dfe", "comment": "Malware payload (Formbook)", "value": "2289d365f6a93c0b9cd4cea9723eeb1a1b8fbce5a032b5f200233073beeea470c54541ed55be1b883e844133d4a78369", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039004, "uuid": "17c82311-08d8-45cd-90d0-119323252c3e", "value": "T14A95AF96EF05B69497609F2EF8ECB10665540AC619134ACEF27FCD98FEEF58C6203085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039004, "uuid": "3c2776b2-3a60-4a96-823b-be877c5bbc1e", "value": "24576:VAFdOqvDOgRdYqQFsusjYdvz9S4kP9RgKzVVr1wsUydvilfOIVuUa:GFMeVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039004, "uuid": "b3b4434f-ba5d-43d8-9e9c-623727fc7d02", "value": 1998923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039004, "uuid": "c3c9a929-3341-42f4-a946-797af535f871", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039004, "uuid": "ec38b1f6-a9f3-4e9b-8778-3c53e23701d6", "value": "Technical Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01783a03-1bf8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773088741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088741, "uuid": "73a44e9a-ca07-446c-8d44-dc7a00609b28", "comment": "Malware payload", "value": "60a18d5c428a07c8b1eb35bd9267251d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088741, "uuid": "bedbfaba-cd94-40cd-a788-b34063af6a2b", "comment": "Malware payload", "value": "caeebaf9412aaa16586f9fd635dce25715497ea7a47b016e8e30d54634d9ddf4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088741, "uuid": "b99223f5-8d47-48ad-be6d-fc060c372e9b", "comment": "Malware payload", "value": "2bacd2bc644f2f27b92727db6119869e0faad6a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773088741, "uuid": "adcd3a82-b5cb-46b0-bbb6-4d6b84dbbed0", "comment": "Malware payload", "value": "171146660f3d5e32ad737e73222f8a0227c3e08b5afe4d905b0bde4c2dab48d253d56a3533203b847fda79c7fd93f2a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088741, "uuid": "50ecb8b6-9284-4c84-9ea8-1f6239990f81", "value": "T1DF925DB512896C79FBD1CE399F3C6F4DADE8C2C42124A3ACBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088741, "uuid": "13661915-d715-403b-9469-344a3dddf184", "value": "384:AhcuQpWx+BL0SWL0gpzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Ah8i+BL0SI0CzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773088741, "uuid": "7a02c403-48d0-415f-8b90-6b53d228b552", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773088741, "uuid": "3d4d806c-54f4-4b65-a08b-187d138797c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773088741, "uuid": "713602b0-9d68-47f8-88d7-955c34502c70", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba4ee97-1bd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773072115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072115, "uuid": "c398b4f4-a2fb-49e1-a801-d57bc7e378bb", "comment": "Malware payload", "value": "61dcde1ab53e377c8523b9c3de0e991a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072115, "uuid": "afa3d45d-b4c1-48e0-a605-3fe9252bf0e8", "comment": "Malware payload", "value": "cb37269dc15769ea6c3ff55d5eb868cd8914244afeec3a8d26563fb910bb9673", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072115, "uuid": "48e77586-6a85-4b19-8096-1560e798de35", "comment": "Malware payload", "value": "64531d7994e06df7b5d8c42053a84df54b8ccce7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773072115, "uuid": "9af67247-d236-4566-86b3-0e671e904b23", "comment": "Malware payload", "value": "509687f364c5eedd08eed1106161438bad2156c3707a1c9a00d7686a9c759840088d1135d74517001bc4f2c9595c9efb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072115, "uuid": "9fbaf925-844d-4741-aeb3-77e793211e06", "value": "T1F8C36B5773E130F9E27AC675C4650A0AD7B3B87513A1AFEF07A042552F232E19D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072115, "uuid": "309707db-164a-4471-b69d-e10315251ca4", "value": "ddb7e22698cd18ceb0a6d87b25da347e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072115, "uuid": "8996f45f-3810-44d8-99a5-d43da98b0210", "value": "3072:sLdgA6QI96rezQLPf5c0IDRMcEF6lATdby35222222224M:sxgX++QJIDNalTsOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773072115, "uuid": "63cf22f1-147f-4923-9c4a-5763c371e228", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773072115, "uuid": "0f135808-57cd-460a-8cc9-53d9e74203fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773072115, "uuid": "94071f2b-608e-4ba5-8a65-7c027986668e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87027b59-1bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773082952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082952, "uuid": "f251f1bc-68f8-403e-ae77-dcf113968e41", "comment": "Malware payload", "value": "4d0c7939ae6910617bbf2fa3b50b3d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082952, "uuid": "a9378a8b-ce3f-4e80-9ea6-00c559af6121", "comment": "Malware payload", "value": "cc8ae69961e9125fe349b6d8256cf2e7a917b31d28da8f0f8a7a916c04630e04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082952, "uuid": "e9b93cab-4b26-4a4d-a47f-a0bfe091a901", "comment": "Malware payload", "value": "bb7a885879f3b19567264bf4d660ea1c5ed0d475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082952, "uuid": "7d6e0d76-1d69-4b84-bf08-2c6401fdbcba", "comment": "Malware payload", "value": "76488bd8e579abfda159df1aa40aadead5d0b0935f0c13842ce93159a709f24608951c665f2c90bea7c9e835bc57141d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082952, "uuid": "f96a478e-c58f-4c10-99a7-67d9428fe2cb", "value": "T127B4BE612266DC62E39492B4415AF37D8E61FACA2D71C3375AF1ED5FF618F723828201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082952, "uuid": "706e88c4-a15f-42a8-808d-183a5ba5a3e2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082952, "uuid": "fd4f3df8-1685-4ca5-a134-d318567e1cc9", "value": "6144:ilgvTRHyTKm50kpXgMimxd0VWz/0OWlixPfeiGYBFwCUB/QYUlbxMcreSmKGFlNE:e2kgkPfeiGOuCUB/QYU7laWUwXDasUVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773082952, "uuid": "e58cf129-150c-45c4-9327-02af277eea6b", "value": 525408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773082952, "uuid": "e809d7c9-674f-4678-9f4b-680388d7a8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082952, "uuid": "8c464fde-d713-402a-9ce9-6559a58b96fa", "value": "Nonvertebral.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a132d00a-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773077842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077842, "uuid": "5b791b0a-40a9-4e22-aad9-565723ed20df", "comment": "Malware payload", "value": "cb5e3ce462eddca4c0cd5241e939c75e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077842, "uuid": "58aa7962-984c-4712-bd9a-c40eb67145f2", "comment": "Malware payload", "value": "cd3152f3d8ff824027549d4ef43a2cb9b42bb004e139a7911fdf79844be75e95", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077842, "uuid": "1e07bfbe-dc3a-4f9b-b745-ae2501ec21af", "comment": "Malware payload", "value": "cb5bfed718b74c8515f7949c1cbbf294b2f9f078", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077842, "uuid": "d81ff9b5-fa26-496c-b852-fe2ec9ba5e5f", "comment": "Malware payload", "value": "b6ca8e413cd53c2d17c64282c799cae029575ec385425003d5279c37694ddad3f2623771b2fb38ab0a2cc54f25d93887", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077842, "uuid": "f93fae9d-7012-4d91-a6bd-ebb25b1462af", "value": "T1BD916586778D0BA9FA9804D54258A50784F2D47D3A6521C9FFF23603F439AB6FC68374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077842, "uuid": "32195aba-5f31-4ae7-b35d-bf0778287e5b", "value": "96:nF+Fep8mQV7N09A7KHzWcOGH2iAbONTS+UH0dd5eVAx2:nco8mQV7NWXHz+m2i3PdX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077842, "uuid": "5d7b4688-51b2-4d5d-b6c0-1193df371ad0", "value": 4418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077842, "uuid": "33b3b58b-3ef7-4ab9-a93a-8abf755c3338", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077842, "uuid": "2e9a84d2-9f51-4259-936c-c199095a24df", "value": "Scan_Document_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca5c3ef-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098611, "uuid": "d086e72f-6adb-49d3-8616-9eaa3003a078", "comment": "Malware payload (Mirai)", "value": "dc8fddad7c0204ba433cf690e46851bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098611, "uuid": "a67e6b0b-cc83-41b6-bef0-f644a72151ac", "comment": "Malware payload (Mirai)", "value": "cdee6ba20b90e8724daa463febf838a1be75015ca8d6bf830c36adc93b85660e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098611, "uuid": "d77f1ea3-9d56-4a27-b4c8-e2407b044f88", "comment": "Malware payload (Mirai)", "value": "689163d46a5836aba6036dbdd9d885ff393a5299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098611, "uuid": "f834ab03-0ef3-4eb6-a953-88a726e146bd", "comment": "Malware payload (Mirai)", "value": "d5cc2531eb10c140ea439e0d80c6b70e4a927fadfe21ff15d814a8b7a14a280cecb96efa06acf174f370135795cfaaa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098611, "uuid": "947355cf-1392-4337-8d68-c649dc276c66", "value": "T1F3E35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098611, "uuid": "8a345f8e-5249-45fd-9d99-af45c6dbae88", "value": "3072:7oDlIyA+oy+ZGiT5/lZoEhH5lgLOoe97dlJ8jW4:1Dy+ZG3EFxoe918jW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098611, "uuid": "55a36d69-6cbe-4930-8ca3-96271d218a62", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098611, "uuid": "992397ab-af4b-47f6-a000-31f30f7415cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098611, "uuid": "5c1a540a-4914-4e11-af63-88bd271bf8e4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3020ef-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037110, "uuid": "c3630802-ed4a-4db6-99a8-11da7a22140a", "comment": "Malware payload (Mirai)", "value": "f85d6fd6cc4eabf9a4c89595d528cd01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037110, "uuid": "99ddd065-f9f9-425f-a8ad-1f5db8485bd1", "comment": "Malware payload (Mirai)", "value": "d04ed10757c37c42202eb79f7e2b5745ff8994ff7aec5009fb18aceb032b3235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037110, "uuid": "56ba9f2f-5f1c-4939-9fe0-de61615a621f", "comment": "Malware payload (Mirai)", "value": "97a2f443d80798da7e4f3014b8de543fcf001874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037110, "uuid": "45615c7b-d031-43de-b683-86a257b9de30", "comment": "Malware payload (Mirai)", "value": "e6baf84aa299a6e167e0d4e2e4b1e06c057b7bc634a14858f06714e3f22dba85692ea2babe6452b4318a0b5604a00e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037110, "uuid": "85673c08-a678-4437-b98f-1d08dc02d232", "value": "T13143F746FA43CF73E85311F112EB6F629D31FEFA2866D582E374BDA099110C1A506F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037110, "uuid": "e5ba7033-2d2c-4cc5-93fb-7bebb239d2a3", "value": "1536:zo5/BzniMnZNWc552Vg3OxjeSzWz85UI8:zWQc55UGAZWzkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037110, "uuid": "6d328e35-b44b-47a7-924d-33f49dd678e6", "value": 57456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037110, "uuid": "5095bdb1-a3d1-4ecb-88ba-aeefda60c015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037110, "uuid": "0a49b6a8-7992-467d-bddb-5592be3001ea", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3d43f3-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042748, "uuid": "19bb9689-d0e0-45fe-82d6-f8f4b40115e1", "comment": "Malware payload", "value": "dd21408cea1a9580db102eba6123138c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042748, "uuid": "a8d05391-34d2-424b-a119-bf347004fd26", "comment": "Malware payload", "value": "d065e2673c575e582abc1e5278562246564d64696c81447d6e579b956744a407", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042748, "uuid": "b30f9185-d2b8-4cee-a9ef-8097d3ca0af0", "comment": "Malware payload", "value": "c969f9bf5ad1fc3016db5395f8b4e501af428941", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042748, "uuid": "910f9828-e696-4e64-ad9d-ab4f38495212", "comment": "Malware payload", "value": "48c5bd54dbc6fa8a6f1af610bc903f997dc67b78cfb719ea1f109b3073491d4d56dff90c4f68b1ce4fde3d940dcddc3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042748, "uuid": "faa2b0ba-8bec-4dc0-9255-fe298dfa4ecb", "value": "T138925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042748, "uuid": "a4b08fe1-54ad-4cae-9fca-cba0a498c37c", "value": "384:YFcuQpWx+BL0SWL0gvzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:YF8i+BL0SI0gzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042748, "uuid": "a1160445-84c8-4e6f-9496-55224c0f5c9c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042748, "uuid": "61860c2f-73b0-40a3-a19b-1ed6efe12458", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042748, "uuid": "b877f097-b1dc-458e-9a08-ec72ffda7cb2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71b3db4-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098602, "uuid": "a3e5c3a1-b16b-4b82-945b-9b87a6997f0b", "comment": "Malware payload (Mirai)", "value": "f27a648653ed8b580eb292f3bf490c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098602, "uuid": "7158e761-a184-4a7c-a0f4-55186ef99362", "comment": "Malware payload (Mirai)", "value": "d076614c0baad5252aba8656b0d43752ad584f68f9728ef961c30cc1146849d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098602, "uuid": "6c28fc74-d6d4-4113-8956-7550458a1ab8", "comment": "Malware payload (Mirai)", "value": "eca72dca187a48e3747292c5728b21c2ba96f1b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098602, "uuid": "ab392b63-00c3-4452-b709-407bbf6d1874", "comment": "Malware payload (Mirai)", "value": "e7a0cc376843ceb14ac16b139480bbe85dc8e6249b069a4e19d04ddd100225dcbbc1345cd8b15901aed6693561ab49c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098602, "uuid": "6003a08b-f6f1-4daf-963b-edb620b06a51", "value": "T15204B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098602, "uuid": "c0c818c7-4bd9-4622-b634-de73f1181688", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD20:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098602, "uuid": "8d85351c-9c77-4787-8f4f-b2078eb2f74f", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098602, "uuid": "c1d36766-5353-4fd6-83de-1576724ed97d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098602, "uuid": "6c93feb5-f16f-43d7-bd10-e5e0b21b705f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baddfb7-1b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773042963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042963, "uuid": "a541e1f7-22a2-4635-98e4-1d2169e85960", "comment": "Malware payload (NetSupport)", "value": "79d57ffdb9a72a87e249377854a679eb", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "plixolabsaf-com", "colour": "#FB7C38", "exportable": true, "hide_tag": false }, { "name": "PlixoWorks-com", "colour": "#098748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042963, "uuid": "4285e75e-d24a-46a2-b906-3e6a03a6f628", "comment": "Malware payload (NetSupport)", "value": "d07cf999261a59290db66ad63a960f67aaf198a0bd40c07dd5694753835e53d9", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "plixolabsaf-com", "colour": "#FB7C38", "exportable": true, "hide_tag": false }, { "name": "PlixoWorks-com", "colour": "#098748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042963, "uuid": "1f7f2301-0d68-4b34-ada0-8c03e4aa0f7d", "comment": "Malware payload (NetSupport)", "value": "c0f3a95b774046610b32cdc62de750f570f19ea7", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "plixolabsaf-com", "colour": "#FB7C38", "exportable": true, "hide_tag": false }, { "name": "PlixoWorks-com", "colour": "#098748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042963, "uuid": "254b9ed0-528b-4786-9062-28810c1144b1", "comment": "Malware payload (NetSupport)", "value": "8b03611a241b60a92cc56549ed368f8ab15e885ce81cde003add625d91c4291323053781a112069ae86770acea4dba69", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "plixolabsaf-com", "colour": "#FB7C38", "exportable": true, "hide_tag": false }, { "name": "PlixoWorks-com", "colour": "#098748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042963, "uuid": "fd607f48-a56a-44d8-b94b-2d379e0a5ebe", "value": "T1A7A2D016769C7463FF75A6B5284187008FB3B80F53EB5491E7D0D9EAAC752B44AC3812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042963, "uuid": "cf6b6e0a-4723-4f91-b3d9-52ca5f491c2b", "value": "384:b2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfMsp:b2+x6TLKQXK1myQCSr2VS4jTXaRnP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042963, "uuid": "3a65ef9a-cee5-477b-be7c-4dd9f3054752", "value": 22146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042963, "uuid": "f355c224-5b4d-4dc9-b8a6-512e45286d0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042963, "uuid": "48918cc7-1422-4d5e-803b-44d193a979e2", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358032f5-1b88-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773040725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040725, "uuid": "f3ba2f72-a5a8-4a6f-b4df-a1014937b4f3", "comment": "Malware payload (RemcosRAT)", "value": "bf4ff13258935ea85937404eb9b04982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040725, "uuid": "ecececc0-4f3f-42b2-9756-ce06112b1399", "comment": "Malware payload (RemcosRAT)", "value": "d10775c8311aa5d4fa590612276ebacedac2839be9b89b58fcbd7ac6ab463e11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040725, "uuid": "cd22b415-d580-4ab3-94e0-246d325603e4", "comment": "Malware payload (RemcosRAT)", "value": "4304945cfe077f3715b8107cba79b38053f6360a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040725, "uuid": "8c59e1e7-02dd-4415-bf18-00f25c9e6e58", "comment": "Malware payload (RemcosRAT)", "value": "033ab047c9a183b3ab37c727cb56468987f3262e20467c99c3645b980a7a09a8ac2a7a4b3fc8daea3c42e4a4539164f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040725, "uuid": "eb58c33b-5017-44f1-a50c-79723046ac12", "value": "T1E446B6822740AC32F15EEB0CC07AEA606A5914171BE2EF7D3166665F31CD953C3DCAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040725, "uuid": "37aed439-644b-43d5-9c97-90bad64718d1", "value": "98304:8jLY/F9XIsAn5NEUq5Jn2ReBqDnpD925JqiNUQU/UCfRhB0aVO7GPl7ZNAuixcPK:IcFirXEUqjnE53w80Q/UCfRn7uGPzNAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040725, "uuid": "14404097-d914-473b-bb5a-c55ef44d441e", "value": 5702995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040725, "uuid": "7959b294-32d5-4b56-a9c7-03c1d6645d0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040725, "uuid": "69f0f309-ec46-410f-be72-113189602719", "value": "Intesa Sanpaolo_Copia del pagamento.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b6c9a3-1bc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773068476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068476, "uuid": "81b43b22-f900-4e25-a2df-3e77f463c069", "comment": "Malware payload", "value": "e896e93a8d3325f8ad482062f75c2f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068476, "uuid": "4f8b5a29-b761-4c4d-a164-7f32aabbd7db", "comment": "Malware payload", "value": "d1451bb8b1f21a44a89d559e2c301d1580a96edc64a643392f11348173423dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068476, "uuid": "9c49719d-7885-4e38-9ef9-49533f29566f", "comment": "Malware payload", "value": "95409e65d23e4d7b35aded99efbd15c5d83a1f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068476, "uuid": "cf12e9a3-7cee-4d20-8397-af8a15a328ff", "comment": "Malware payload", "value": "9eadd336d769c62edbc486f9d961ef0620611cc368b032b5b19a483da05f64d847546770d67c8d71599cab39249ae085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068476, "uuid": "8ac8c735-1890-4927-aaa3-e2c251644230", "value": "T11DC6AD05A2E41461D41BC6388615C333CE79BC93C679840F399CE7C62F7BD526BAFA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068476, "uuid": "02a32d14-6b87-4c96-ab53-08d808161e09", "value": "0f2ac495dc0d525e8da9b92302b182e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068476, "uuid": "100516cc-4e18-4245-9397-ee3e236190d3", "value": "196608:LAq5R1HZpbMAFdk6FRy2hjvGl8Ak9SvzoOP1+hD0D0l6xPX/LZhBvUoI3fep/:Lp5T56AFdkip68A9oOP1+J0D0l6x3LZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068476, "uuid": "209f8dd8-5305-4e56-86d4-aca7609a6c41", "value": 12438016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068476, "uuid": "76ba5a9e-984e-44ef-9cba-3e0d060a12e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068476, "uuid": "78a21d30-6cde-42cf-9bb9-0b30a48af049", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b135d1-1ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054390, "uuid": "77f5539f-3454-4279-b12b-6c747794f9b1", "comment": "Malware payload", "value": "8c291e8b260680e8c6d8adc683a44ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054390, "uuid": "854d3253-02c1-4ae4-9114-05b2dd818a69", "comment": "Malware payload", "value": "d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054390, "uuid": "a8f036aa-d0d9-4c29-802d-4273a41edb89", "comment": "Malware payload", "value": "591067fc3800615d4ca0c7ba13a208d88e82494f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054390, "uuid": "cd002a16-7c97-457f-b1d9-60896ed48f60", "comment": "Malware payload", "value": "fcf61416f099e818b94390fdf19bbf1a0c01d7bf0aed76665a1decc7f37c48c7b214a2dc5ca4aec8fa195df6c42c85c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054390, "uuid": "849ffab0-c9cf-448d-926b-b3b45380eaa1", "value": "T16B241A0B73B30DB8D627D13582E7D772A932F8110334BD1F1AA8DB326E61D544F6AA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054390, "uuid": "82183035-a8d9-43b9-8856-c4b9411f68f6", "value": "e56b7ad37b56c736d7cc2618d55bc219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054390, "uuid": "b4ad72e4-6def-4059-8d08-42303ba0ed39", "value": "3072:V4U/jY0DM9SiL9ui7jUEQCs3ddzt+RKeeCUSniVOU8waSDornoVU0mHOkHw1:B/EwiJRKeeCzsOU8whU0q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054390, "uuid": "83b13445-4243-4cc7-94c6-cb2a74d82160", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054390, "uuid": "21e9dab6-11a7-440c-af4b-87c869758223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054390, "uuid": "c83feb31-eedb-4a0b-92b8-11f218e3e4e7", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad93f0f2-1bde-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1773077863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077863, "uuid": "3c58c9d9-34eb-4120-9277-b35e047aad4f", "comment": "Malware payload (AteraAgent)", "value": "bd952b973f620e99fd00a167d0fa45f4", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077863, "uuid": "c5bd8294-9f85-4702-9a06-2799dbedc2c9", "comment": "Malware payload (AteraAgent)", "value": "d3148c4cd9c2f347177df88bd356f700fd0ceec90f2e08ef151221c05b86fc68", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077863, "uuid": "c87a4359-43ad-40cf-bbe8-bd8eebb869cd", "comment": "Malware payload (AteraAgent)", "value": "aad85e71105dcfec3abcb57432039cc43183075e", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773077863, "uuid": "c555132d-8e9e-41e2-a43f-d0f129902555", "comment": "Malware payload (AteraAgent)", "value": "b03792912d6872d3822c9e3f5b02973d546e573f76fa10bb3f460929b2390dbddca6e54b986134978e94b2d98c1bc4da", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077863, "uuid": "4fb034dc-3257-45ea-af40-8ca47a6d1114", "value": "T14B862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077863, "uuid": "7670bd62-483b-4c5b-92fd-12bb28380bc2", "value": "196608:uW/FSmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:ZSqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773077863, "uuid": "f8f81d2d-2e78-4f0e-988c-3ea4ca387a5a", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773077863, "uuid": "78c50ba3-f5ed-4253-9fa2-1791e9dfa0fd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773077863, "uuid": "e8f0474e-1575-4c6b-82be-07464c05a4af", "value": "hmliene.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa053f2-1bc6-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773067443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067443, "uuid": "76f8e4d1-8409-4e90-ac6a-43cc8474f40a", "comment": "Malware payload (a310Logger)", "value": "982cbf273ff09d8feeb6696c9123cb5f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067443, "uuid": "bb4fa577-955b-41e8-9df1-52d9728dd3bb", "comment": "Malware payload (a310Logger)", "value": "d38ef5cbcaca37040e9b629a5f9fc3179c171c80643808bd364f7312fdce236d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067443, "uuid": "12a970e9-5f86-4f9e-b286-b085c2fb248e", "comment": "Malware payload (a310Logger)", "value": "99875fe82e30b86d8cf8e0240dd7006aef9ae973", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773067443, "uuid": "28cbbe51-f2f3-42c3-ba31-57826d1f2c78", "comment": "Malware payload (a310Logger)", "value": "0fd84bff3e6943f3f5e14c72831f2a51318e72585fcefc5890c767633b2bef8da06e7c8673522c24417b763793bba4ae", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067443, "uuid": "abd00923-b432-4877-acd3-c43d64798988", "value": "T1F755CF027381C062FFAB92734B56F6115BBC79260123A62F13981D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067443, "uuid": "a5d1ef60-292c-4885-8035-9474f04d5363", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067443, "uuid": "2279f211-0eeb-4e8d-a61b-96417da426a1", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqpQu/vjs/XNKt/pBD:GPVt/LZeJbInQRaqSuHjsPNKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773067443, "uuid": "7ef85898-aafa-4860-bb3a-995a6bd01434", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773067443, "uuid": "0bf91556-afff-4f69-a136-1b6e8f15fa74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773067443, "uuid": "5a3c79c5-bb76-4d1d-98bf-a8ed424df4b5", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd5a22-1b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773048221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048221, "uuid": "e1aed9c6-2d68-4b1a-a8e4-d8971589ee72", "comment": "Malware payload", "value": "2f3308448a951086aa91ac051cb1e227", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048221, "uuid": "334b4185-f0f9-47d3-863e-dcd6ecf9eb4c", "comment": "Malware payload", "value": "d3b49e8fd9dd22c01b87b4b4bbc452eb147bf573478c60fb68d42ed0243a93b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048221, "uuid": "bea406f9-c16a-466e-b44b-952b1bebba4f", "comment": "Malware payload", "value": "04a1d0fc2fb562e683cac40194079ad93b58536e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048221, "uuid": "fdf9d59f-3d84-4658-9406-76138f570d83", "comment": "Malware payload", "value": "d7003faedb9a62842d49850b4d6ef9c0e37e1bd9e8d87e9949ac39c9f475b04f32ab443ee22560b5f9f6352c0af1d76f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048221, "uuid": "8dbd793d-4e4d-4174-a0f9-9a60dad03489", "value": "T128925BA916496C79BBC1DE7D9F3C7F0CADE4C1C02118A39CBE4F39618A206ADDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048221, "uuid": "1f65cc8a-6ee2-4448-98dc-b5c625c15354", "value": "384:DT0M3vgRjGlsaq7YUzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:D3mjfEUzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048221, "uuid": "6a6465b1-bf0f-46aa-a506-331216dbf4d2", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048221, "uuid": "7df56ee1-5908-4dda-910b-fb09f9a04d5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048221, "uuid": "35791d16-49b7-40fc-9293-726baae32dc5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06d9fd1-1bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773061600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061600, "uuid": "87ea4d25-f724-4e6a-a9af-58eb0eda524a", "comment": "Malware payload (Vidar)", "value": "68fc98c720fd3877b4b77d63d0181e2e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061600, "uuid": "b9a6554f-bf5b-4fa8-96a1-1ea27fae6648", "comment": "Malware payload (Vidar)", "value": "d3d809c318494982d61f3308ae80bcb7b5a3f11530ad4ed651363c01f2cd98a6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061600, "uuid": "dd9c0420-dd36-484c-ab7f-0139626be530", "comment": "Malware payload (Vidar)", "value": "88d8d59bd05b82fdb9f4206a2bd9ca09ba2c0e79", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773061600, "uuid": "2dc18cf5-1d71-4c0f-8874-2fa4624e1bf2", "comment": "Malware payload (Vidar)", "value": "4dbe14818b4acd420d7352841c76b597bbf97ef8feb15331b7d25f3583b0384c1e37d9840e23375b0feae89e09d2d599", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061600, "uuid": "23933159-991b-4aa4-8978-4c7599db977c", "value": "T1DEF002DBE42E5FAC8133B9F122F6E8ADD4D5C1811EE1DD377D80449E11487E1A784356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061600, "uuid": "bdf1e73b-809a-4bc5-87d2-af76f15ef027", "value": "12:TVxCwl2PF2yWTb0g/LfWdsJThH7MGKHijaA9rXnqOPnl3XS1+MWj:Lf2PAym0g/kyhJKCjaEqOPlnS0MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773061600, "uuid": "da2c15a6-7f3d-487f-8ee1-79fadae25d20", "value": 643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773061600, "uuid": "542db3e3-f557-40cb-b00a-5a48ee5413ce", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773061600, "uuid": "68f7c31e-b45f-49c4-b066-2959947df718", "value": "verify.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf78377-1b65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773025889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025889, "uuid": "aa0df7d9-f266-4d35-878b-b5d1da3842b1", "comment": "Malware payload (Mirai)", "value": "a285e15500121ed86dba0397772545a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025889, "uuid": "03a9da09-f263-4043-a459-f15979a4e5b3", "comment": "Malware payload (Mirai)", "value": "d4050bee56b3f79a92023e76b099ca6a361acf522476493fbeb73b056a99363c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025889, "uuid": "dfe54c55-dd1c-411c-bbe7-fefa8cf6420f", "comment": "Malware payload (Mirai)", "value": "336fc9e39a915b8ea162284723228b7dfec555da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025889, "uuid": "bba08205-a6c0-4ec8-9a53-58acd9a85d3b", "comment": "Malware payload (Mirai)", "value": "86d01efc6b731aa2f1cd79a6fd74c66d135f044b47e8d9bd340fdf3b0c1e9b6df80b5bf852a096c73b4227e4f24ee6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025889, "uuid": "69c2d76f-c2cd-4e8a-bec1-5c435f4fde88", "value": "T1E1A33AD7F801DE7BF809D37A44970506B330F7A50A8217B63313695BEC391A95927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025889, "uuid": "b16566f6-8915-40e9-8fb2-fb8302d55d0a", "value": "3072:zGD0j50lZdbYswvbG35LFBxOz5uoDRyKqWRhDJ:zGYjyHmbG3pFm5xDRyKVhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773025889, "uuid": "c2e13f81-b896-4182-b377-729e58bb853d", "value": 104160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773025889, "uuid": "9152053f-6910-40f7-9aef-73034b5528a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025889, "uuid": "9959fe3f-96d5-4b43-83d9-acfdc45d2d0d", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc11f5a-1be2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773079313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079313, "uuid": "6d016f44-dea5-49df-971e-88cfd81a5542", "comment": "Malware payload (SalatStealer)", "value": "abd1bb26e8ce9e12cb9418d0e676461d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079313, "uuid": "bb9fee26-b03b-4aca-aa25-d9eb21030699", "comment": "Malware payload (SalatStealer)", "value": "d43020bc9ddeb79e896073252c7573d849d45192fd3b9ed76101c3e3eed7a386", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079313, "uuid": "72be58a2-d4ec-42b9-9630-5122aa232e96", "comment": "Malware payload (SalatStealer)", "value": "d56ee62a0011ceff7b55472e97cf2f16154e9803", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773079313, "uuid": "666850b5-85a4-4acc-b49c-58c1448da1b0", "comment": "Malware payload (SalatStealer)", "value": "6fdb004c2a9cd6e6b54a1a877057c27ac4a0847e2da4642b14d9f3c5f0a6b8799b1a0fbd2c47ee98a84827aba7bf279c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079313, "uuid": "2b336726-6bea-494e-b73a-ce9d44b7f4b5", "value": "T187347D05B7A50CF9E977853DCD464A05EA72BC564BA0EACF03E00A979F236D09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079313, "uuid": "7d6e5b4a-d0a9-40a4-8fe1-7b13de9e1c8f", "value": "093fa674f7b84fb757bd781c28a77327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079313, "uuid": "d5351381-da67-4e26-a37f-f86b2dbf00d5", "value": "6144:PCHOMzFBuLcFxO197kZtCuQsl6r41lXa1:qHtruoFc1m/CuQ6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773079313, "uuid": "c4215797-be56-4569-94d9-c71f623fcb55", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773079313, "uuid": "73434fe3-0ac0-4b15-b658-c2f8c67635eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773079313, "uuid": "ac9ab478-d797-4a65-96b4-c875c74297ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eefc8d7-1b94-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773045841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045841, "uuid": "efe24d60-44fb-421e-8614-66163866e053", "comment": "Malware payload (GuLoader)", "value": "af0fdd2fb58295c27c654de920b24ee0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045841, "uuid": "27244626-d32c-48aa-899d-db0f8818d3dd", "comment": "Malware payload (GuLoader)", "value": "d435697027462bea8a8f4aa24d35389813c119d8ef8c0597b3c77d085931f231", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045841, "uuid": "4e211abc-fe27-4433-a051-99ca2f0d3dab", "comment": "Malware payload (GuLoader)", "value": "50208b5c44c169b64f4fbc5dd53f481073716f93", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045841, "uuid": "9c543192-aa33-4364-9d06-b0140afd888c", "comment": "Malware payload (GuLoader)", "value": "14a0f1871a0ea7737120009c5178cf8ac5df908455751d19f63dce0c4511c38f482128b5925686796765ee9d9bdec214", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045841, "uuid": "d918a09f-6738-46d9-afaf-a011c383f6ba", "value": "T1AF835B70C92205774F87BB98BCA94661C66DC318862705F1F6CE8B0D900DAECE77D69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045841, "uuid": "c92d1eef-1fe0-4554-bfe3-4338feb9a621", "value": "1536:HO5OLTJfyzMnhe1KerwqqWhRLy1Xfi6ndVii6YbWBZd:nJJnhe1KKW6pyxaAji1YbWPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773045841, "uuid": "179d6a92-a943-43b3-8df5-f3afa50f69e8", "value": 85149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773045841, "uuid": "96f10a96-96f1-4819-953f-872160a98645", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045841, "uuid": "99761472-a1e7-4873-a547-419660b397ee", "value": "TIM_fattura_030920267313\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bbbfb6-1b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042121, "uuid": "ca92eff9-e160-49ba-99c1-69c0372fb159", "comment": "Malware payload", "value": "6e418921a0e3948d155e8c418821fe52", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042121, "uuid": "854e71a4-a20f-4198-a8d6-a991e81f62c3", "comment": "Malware payload", "value": "d763d05ff9cfd1302282289ba407a81088e09051dfbe66dcedd6372442fac4e5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042121, "uuid": "a7844f33-b907-47a7-8097-a6a0da383250", "comment": "Malware payload", "value": "acc0a9738693bd2faa11d1519358621d123f9f4c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042121, "uuid": "ab70a46a-7db9-437f-b846-c8fef69cf5d7", "comment": "Malware payload", "value": "02a9f9c941ca7aaa936b5f979469efab3db5eb4bde85f471dab2c02c1e6c084735781001abe7dc3a18b6b1d0db6530c0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042121, "uuid": "195dbaf5-1a8d-4829-8bc6-6da35cea3b94", "value": "T180B3FC8B4E8F88EDC72FA8A8819F0C47EA9E5113161DC5907ADEBE453F21C7434E5AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042121, "uuid": "3cadad3a-eb72-4ab1-b688-8de2a181437e", "value": "1536:5Kfxe9Coqzw8HNu84+bE97ZFlK1CWa3GuBqQvtynUD+W27elw+e:F16se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042121, "uuid": "3c94e974-a621-4ae1-8834-9f6207b2f591", "value": 114293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042121, "uuid": "02c21272-f21a-421f-b7ba-b4af6338b42a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042121, "uuid": "c72b4b8c-e6c5-4665-9fb1-8d443975b112", "value": "Work_Backup_Clean_4396.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda0416c-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037114, "uuid": "1a5ff1d1-b463-4e2c-b9f4-c113b258211a", "comment": "Malware payload (Mirai)", "value": "dc2b05fd83d68c4172d6c6d95d8d6e31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037114, "uuid": "480b4202-d97d-4ed7-8aec-f492434dcb45", "comment": "Malware payload (Mirai)", "value": "d7b36226abee58382706d931fb885f4a28c463b7692133a6091f849d3412c154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037114, "uuid": "06dcd200-14d2-4be8-9140-10782e8679ee", "comment": "Malware payload (Mirai)", "value": "11cbba8a97f8b84dbbdf654e80c4b1cc888adc10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037114, "uuid": "341d144a-72af-45cf-a8a5-f10b7ace340b", "comment": "Malware payload (Mirai)", "value": "9e242ca963e933740e0bf5b30b042e94e0d672d3c4beecd00433a6fdac0893622e54aedfe85251e49424f5d162388a01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037114, "uuid": "d323afd5-102e-4a84-b175-fd24e7ce603b", "value": "T11E530A56FD52CF03C1C311B6BB9E4A453B166BE8E6EA3202A534BFA137874C70D26A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037114, "uuid": "12c8709a-d3fe-42cf-b1e6-4fe3d6ff735b", "value": "768:oZlUnRdD5AbrZ4StEv9z2PYaWLw/3KMDu1vrC6nUDv0CdGOJ6YWyn7CMllNmhdVF:JnoyuYaUoaR47dGOJBnbNsdVmDhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037114, "uuid": "5c89607f-c805-4394-ad16-7a4393db7da6", "value": 62208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037114, "uuid": "0deb75cf-c0c5-4d41-9f0d-20161211854d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037114, "uuid": "d6b22294-7a64-42a9-8334-d73f551fd6c5", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4f7b0a-1b64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773025299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025299, "uuid": "9140902f-fcd3-4df9-a840-8cc5bd5fb876", "comment": "Malware payload (Mirai)", "value": "0deae34a55781e3357080226fef362b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025299, "uuid": "4efd2133-253e-401d-8ad2-bf28cf4ecdcf", "comment": "Malware payload (Mirai)", "value": "d9835a939d62e128218ee067bee4cafd2dcaa6927dec77e52feb9053bb086a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025299, "uuid": "0cbbe9ae-f934-4e01-8be3-9f6980f81583", "comment": "Malware payload (Mirai)", "value": "e205e807984e0c2986e8cb165ab3ee177c98ad90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025299, "uuid": "d4e2c4b0-36dc-4568-84af-6e83453b3cd4", "comment": "Malware payload (Mirai)", "value": "07a900cb3d806dfb10cbe5a5fd3f06f3b0aa9e98eee9334d143de8a6c5f829ebd8d2913c718e11686330e6ad75844415", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025299, "uuid": "abb407ff-cbe8-43be-ae7b-b67f67c935e1", "value": "T148737CCBE643E5B1E9230131813FE7269275DA381054DB4FD7B49A37A836A04FA173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025299, "uuid": "e80cb65d-5f0a-4a5f-ab69-2277cb3db2b4", "value": "1536:3MdN083dAYitllnwplWUP7W0AJYbb8etLDKWed4:8E83OYinlwLWWXWEFJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773025299, "uuid": "4fb3eddf-714a-45f9-b579-310c638bec3d", "value": 80008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773025299, "uuid": "9707684d-d526-4aa4-872e-d12c497a15a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025299, "uuid": "b8a62270-b677-488b-9e50-3e49bba22f14", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9f246d-1b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773021871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021871, "uuid": "48a67343-d7ea-415e-a525-13750f583e3e", "comment": "Malware payload (Mirai)", "value": "d25466c9de6c3ef783d9de2defe3451e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021871, "uuid": "2cde5015-7c92-4891-9ec4-a247030ae39b", "comment": "Malware payload (Mirai)", "value": "da808c541f3d5a295f96863e1b605b23cdb7f69a2e2bc5d017a1c4616c1298cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021871, "uuid": "f900734e-782a-45c9-9c69-66fe05062dbe", "comment": "Malware payload (Mirai)", "value": "172853e0d6d28e739418e174e32e5aad9f02dc37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773021871, "uuid": "9048040f-cd3a-4f5c-8a2f-40cbe2ae8f1e", "comment": "Malware payload (Mirai)", "value": "45bfd0a3189b1db86021b4026696dc50625db4afb7e7e50f3e6f2d3d663a11be9682ad7b76d359c65a18b29db0e0a868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021871, "uuid": "6a11dc8d-12c7-4a18-94bd-b4d46ae31e7d", "value": "T1B6F319C1AA12FEB3C5C39FB502A7D71006B3E8251B1B8E46F7ADADF4495A4CCB10965C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021871, "uuid": "4a121425-586c-471c-a3dd-710250fe983f", "value": "3072:XWAguFY3M+3oy/ensBypxQbZvNKNnY4872nL8ZZ39tU:XWd3dgsBypxyvNKNnY4872nL8ZZ39tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773021871, "uuid": "757bb9c6-09a5-424f-8fcf-3b36f2957ccc", "value": 170158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773021871, "uuid": "bd5787a4-4c66-4754-90f6-34bfbc0c245c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773021871, "uuid": "d0530fa6-5475-4b5b-9bce-b8fdeb410286", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b30b71-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070743, "uuid": "b4544e48-8991-4629-b297-43d701946924", "comment": "Malware payload", "value": "e2358b9a6e8a9892e31a88493536b83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070743, "uuid": "8430ca10-578d-401e-996d-f0c78aa5bf31", "comment": "Malware payload", "value": "daa79e6e44ea4e120a02910daf7ec0c8f6f46c3bc8b94d9b81bd565de6ec34d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070743, "uuid": "c2f26757-c86f-4daa-8339-8ed90849b6b8", "comment": "Malware payload", "value": "3bcd05bad3f57747e1f144be860d4227601fc155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070743, "uuid": "09440c68-f5cc-4fe3-8ac0-a65629162d0c", "comment": "Malware payload", "value": "2c2e85cf8aeea2332e95f906fd7613dc4b12bb22ffafab262a09692e741e1417755c93f0b432074ec3214fe934826e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070743, "uuid": "9287330a-34d1-452e-96c3-addeb00c0b71", "value": "T1E6665B03ECA555E9C0A9D2358A679352BB717C881F3123D32B60F7282F76BD0AE79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070743, "uuid": "40ec2f9a-6b87-48c0-b822-a975052a2c97", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070743, "uuid": "71790185-79e9-4311-b03e-d67d54adc92e", "value": "49152:xA1LahNxqM6Hzn4mu4djJxz8TdAG94FIX1mNgEBFR7vbmvKVoKpkXS/XNVfKiK9U:xYc4DiAZFIXQNTVCCndyue7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070743, "uuid": "4bf0df24-c14d-4281-b354-802986e49cc9", "value": 6632960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070743, "uuid": "db8cf46c-8e8e-4724-82ef-d42f92bd93ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070743, "uuid": "809bfedf-1bfe-47ac-92e2-c44ca007caaa", "value": "xdaa79e6e44ea4e120a02910daf7ec0c8f6f46c3bc8b94d9b81bd565de6ec34d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c75f12c-1b86-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773039985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039985, "uuid": "9c9d3402-e01d-40df-bf2d-b20a3b177792", "comment": "Malware payload (Formbook)", "value": "2d07406751e3d5185a2a84c3cbd30d02", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039985, "uuid": "c321fa86-26e3-4e29-aac4-7a791f0c8a88", "comment": "Malware payload (Formbook)", "value": "dad74126f5f39c601f7bb6c96dde1ab1719bf1af1a680323d7464cbcfc23c9b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039985, "uuid": "7290efe3-8d98-438f-83ef-935d5fb58863", "comment": "Malware payload (Formbook)", "value": "b9e19f05c1e7140b0a1f23dde7e217bf74b06f2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773039985, "uuid": "da71502b-50f0-4f66-9aa4-0400e419fd65", "comment": "Malware payload (Formbook)", "value": "45619432b20ba9b1bbcbb4d8b751bdc75fa6f454837563198aab70bf7608c23cb3014a8d59a95893195c0591b477bd49", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039985, "uuid": "044a8797-f30a-437a-8b05-b80f993a2bb2", "value": "T14C2618ACF3C12BE3456B1C25AA5EE1D23EA906F36D936116F11B0D93B3C4394A9713B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039985, "uuid": "2b8f6692-16fe-45cb-96ab-e7c73129543b", "value": "98304:ofG0JsQV81rlaUVP0AThNWAmT/P2KoAodFmlyYM13e0jcTNh1vCVc6G0GiNbiMEE:ofZI6a0aNWAmTn2VTmly40Q12c6ZGcOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773039985, "uuid": "f4ac4e62-2f61-48ff-821a-ad2eb3afdaad", "value": 4598476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773039985, "uuid": "14728833-8ce1-4998-9cbb-62e300473362", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773039985, "uuid": "9cd9bbc5-0e67-43f4-9ffe-48801ffe9c2b", "value": "Bill of Quantities - (BOQ).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0bfc04-1bd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773075476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075476, "uuid": "a5c2c48c-9448-4082-8e6e-d8bde5c4f686", "comment": "Malware payload", "value": "fc07c6f0d1f9cad554cfd4e50cfdb8ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075476, "uuid": "7a5b4ed4-9926-4a58-b9a8-50ad731e2e8f", "comment": "Malware payload", "value": "db347d96c00677412f6fa3b06b96ace322d816129dd8e4ea79620932535b7729", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075476, "uuid": "e1dc0660-4355-4988-ba9d-55f4174a0132", "comment": "Malware payload", "value": "d1c79a35085ca1c6d20f27673e49c01af0e0e4f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773075476, "uuid": "6700aa0e-9feb-43f9-9bbe-700482f70123", "comment": "Malware payload", "value": "76d304691e99f5f14b878e1db01bd0eec96cedc9d1e3471fb433eb70703034cc1083a66ce705b64040105ae79a3a14d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075476, "uuid": "7fa0b0ad-58e5-47d9-9b2f-6ccd9ecd0dff", "value": "T18A1733D455F03CDCCC12D9F2E7AA2ADDD1A52C260C31546B7F893E08AD3CCA6CC5696A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075476, "uuid": "0446f57c-d36c-4f6c-86a5-0ad184f961d8", "value": "3d9d4fa0f734aa85e027438ca479fbf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075476, "uuid": "473b3a73-c36f-44e2-b69b-aae08501447f", "value": "393216:W8dYmGoOwgbyTOtHe7bvoAK88xp19WQK1iSlYkY35cy:PdfG8TOtHwoT88xp1rKlYkE5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773075476, "uuid": "7b567789-01fc-421f-8ee1-3a617766faf1", "value": 18813104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773075476, "uuid": "93ff6896-b57c-4f60-a82e-03d8330fed30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773075476, "uuid": "742fc678-38d7-46ed-89d0-3bc21239732c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17530bb-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098593, "uuid": "70aa83f4-95b1-4b3e-b455-1dab74fc1680", "comment": "Malware payload (Mirai)", "value": "a8898a2db0b344e6b8d1237a333c3db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098593, "uuid": "e5a1c090-a656-45ca-a37e-9bf54e3ef30d", "comment": "Malware payload (Mirai)", "value": "db3b4d971e6fa527273a4867fb53a62f523d4da3805c72b9e9f462ebc7c97da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098593, "uuid": "80236717-d3b8-4664-8084-d55bc0c7d6a3", "comment": "Malware payload (Mirai)", "value": "a4a12a71009acdacb58e80b4bb450b86364c6237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098593, "uuid": "c9a46626-6bd0-4d09-b422-c0593af1d014", "comment": "Malware payload (Mirai)", "value": "7616f1581773782f9f66901c9cc3fddb69df9b04a9989231f2bcaa0079639eb7a1127f0283ef74e866d7edf87f894516", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098593, "uuid": "6ff8255b-f0e4-4199-947a-f5da10a05649", "value": "T143D33A2275791E2BC4E0A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098593, "uuid": "2157a9a6-ceea-414c-8827-6f69c5460268", "value": "3072:nZUlV+Fawd99IVWFjKc7RgygOFe30Hi09lshKw0h:ZUH+FD99IVWFtoOgEmhP0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098593, "uuid": "11485869-2067-4c23-b4ed-692856c4e8c6", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098593, "uuid": "d1d72378-c294-41f2-a68c-d72b7837ef5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098593, "uuid": "9f578238-d96a-4a5c-980a-d0b67429af6e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f14e6bb-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773068739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068739, "uuid": "e626996b-0340-4f85-9ee0-d24ef1b9b98e", "comment": "Malware payload (VIPKeylogger)", "value": "e3ae56d8e73a7740a0907007edc31282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068739, "uuid": "afcd886b-b3b7-46d7-9cc6-f3d707ad6a38", "comment": "Malware payload (VIPKeylogger)", "value": "db67b691c4e7cdfcbfe16adc1d423dd716bc2ef052c7460940cc5124317ab491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068739, "uuid": "466cdd12-23bd-4155-b441-1f8026ac0e7e", "comment": "Malware payload (VIPKeylogger)", "value": "57612fd4adb9b840a977349de5e52b9dc668468d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068739, "uuid": "dfd1c21a-571f-4259-a998-3a029850d928", "comment": "Malware payload (VIPKeylogger)", "value": "c5586b8f92441e63b94dfacfab000d5f234b81e31f53e06062e7729fad5af314fdfd333de73378fd52981fe6a1debf9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068739, "uuid": "15e7a6bd-65a3-43eb-a4da-a1b947ad711d", "value": "T132452352DB34DC43F67200BB68A7CAA7ABA566B662884133B376B3E51DD10C1053FD9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068739, "uuid": "a1032253-0aec-48db-b2c3-c5b69818bb74", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068739, "uuid": "1be70062-dc77-47d6-87bb-3b04949875d0", "value": "24576:YPLWT3RjFs/soZCna9ZOIQsyz5N6/UzfuVn09nKVaA0fK5:Y69jFKsokXsyz5N2Uzan09nKVax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068739, "uuid": "27ec2977-0616-43ca-957b-bdd3e894eacd", "value": 1183568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068739, "uuid": "9fb8c304-b3fc-418a-9242-df5041c3b95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068739, "uuid": "a4a17869-ff31-4d19-ae42-6806870a4296", "value": "FA_9198_2026_M1_kod+EAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94abb7fa-1baa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773055487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773055487, "uuid": "06676e6f-def4-4f7a-b68b-e8262c045acf", "comment": "Malware payload", "value": "e5e8df5f6ebc1005142bf1eab1528e7e", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773055487, "uuid": "3402be52-496b-4e32-bb8a-85c141abd6e2", "comment": "Malware payload", "value": "dba76e914734179b57f4c4aad5c8cdbe16bec465640eb09b7512d61c89945457", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773055487, "uuid": "a218b46e-32bf-4339-a991-8c6d8fb5af95", "comment": "Malware payload", "value": "6964f4c00e5b104a54a5ec65c189965794647c95", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773055487, "uuid": "80ae0292-4367-4d2d-aa70-fc078c7664f1", "comment": "Malware payload", "value": "df703393066c44460ab3b3d614aac6e6031867c9868d5bea6598af90a15238b76178cd5eec8012d37a9281e780bc9e19", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773055487, "uuid": "75512afe-15e1-4d25-b80c-465b4559aad2", "value": "T192D02B7C8340C04EE5227539AC90B920640EBD524CC3FBCC2097E40B04A04F67440BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773055487, "uuid": "6311e2d8-9635-43eb-9db6-d3f90f16d25d", "value": "6:HRYFVmyMsKh+WWotOBBArSDxDXthGE54vVG/4xHy:HRYFVmz5OBBArSlXtwfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773055487, "uuid": "155e0f87-b235-47dd-93a3-ee576e5d8f95", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773055487, "uuid": "e6e397a2-7a69-4e76-befe-6cb30ea942ea", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773055487, "uuid": "48140f3a-8ceb-4519-b0c6-d1ccdaad9509", "value": "dba76e914734179b57f4c4aad5c8cdbe16bec465640eb09b7512d61c89945457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc77108a-1bcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070613, "uuid": "6dc5cbb0-b1c6-4671-9d09-2b2af1a6df1c", "comment": "Malware payload", "value": "3b8dbdd167a2fcde428cc3022c81382a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070613, "uuid": "b9c7c18d-fa31-448d-9d1d-99e0a9a8d771", "comment": "Malware payload", "value": "dcbc49deca5cd77e5798e0e09617bb566a56e2ca4a3722ee334cc6cac484fff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070613, "uuid": "53d957b8-3fc8-491a-8959-b93b20fa2a09", "comment": "Malware payload", "value": "0258bf7dbb0123247db29e8799991140bbdbd9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070613, "uuid": "d3183819-9149-4b67-aa13-b9bff571e124", "comment": "Malware payload", "value": "48f290898db036145873f0e21b6f54cd140e787912ebd20452e1680aa484cd13912b2b52929edf928784707d4cd895e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070613, "uuid": "87808ca8-8e67-4677-95a7-cef945ed0a3e", "value": "T107B64A07E89555E5C1EDD230896A9263BE717C499B3133D32B90F3683F72BE06AB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070613, "uuid": "16c3952f-b532-4ede-93ed-7677f199517d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070613, "uuid": "84b841b1-ff7c-4fa4-8fc6-9c04f7ea6fef", "value": "98304:cAuz5yaGVpihWJj90a6A9+anurZt1Kzw4KC2FPfVBikv15Ag59E:cAPVp+WJjmanurJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070613, "uuid": "afa8b134-1808-4581-982e-9aae3ef8b6b6", "value": 10970112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070613, "uuid": "3afee0c7-826b-4616-a4d6-9cf7ce1605f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070613, "uuid": "43aaf2dc-b095-41b3-b47c-8e59f1100ac1", "value": "updater64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c892eadf-1b66-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773026369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026369, "uuid": "98488b71-6e76-45ca-8757-7171f6d2c92b", "comment": "Malware payload (Mirai)", "value": "ad45bad0c4c7a2a050aeedb7df7d5932", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026369, "uuid": "4ece671d-a973-4101-a64a-15e827ea6d49", "comment": "Malware payload (Mirai)", "value": "dd71ff5925e16338d8721781040b5219122f515c565f75611dc79fbdf2d4c5e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026369, "uuid": "85054680-0a51-4826-ae67-8362dd36dca6", "comment": "Malware payload (Mirai)", "value": "295146662ef60017eb606faaef506a0f20e8e112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773026369, "uuid": "e9ab231b-ea9c-4172-a723-76c4e4943723", "comment": "Malware payload (Mirai)", "value": "68b9b02a31162cd4c2fc479f9fe1b22c595394f6e473fb06b5b12a738a4fae2619e875212e998bbef0e17f79a5b886fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026369, "uuid": "55ea6180-bcec-4e58-b82c-5be0e977a00e", "value": "T16FC3FA5E6E329F6DF16CC33147F79A20D35923C623E1D685E2ACC6055E6038D681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026369, "uuid": "a06689ae-4170-4760-b78e-c2fb46002b75", "value": "1536:8tEv/wPCY/FM1NbL27j4qjU2d6OPaRX9Y1I/BQqqeup11rpevBT6IictPaebW6JX:8g4PXO5q7SRX9WavBT/ishM5eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773026369, "uuid": "e8b26aa5-2336-431a-85d3-9692094c428e", "value": 119940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773026369, "uuid": "59f29d69-5403-4f92-a644-691beb959c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773026369, "uuid": "d3956661-dabf-42bd-96a1-f103adc78673", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759360b3-1b92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773045127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045127, "uuid": "627ecc9a-326c-4d11-b718-84b489dad56a", "comment": "Malware payload", "value": "820ab37ae3c587308dd42232f877b2a3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045127, "uuid": "f8801def-d2bc-435a-85aa-fd7abaa9ee2b", "comment": "Malware payload", "value": "dd893628d2aa25e542b26e521ced905a75736e4560631e08e1b77673a4691ed8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045127, "uuid": "222da39e-7c9c-46d3-a8e8-0957dc888d46", "comment": "Malware payload", "value": "a88b1aa515b8bddb53bf7a18bef748d235256780", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773045127, "uuid": "5653b541-24a6-4f2d-a132-f5f781c9791d", "comment": "Malware payload", "value": "12c10f8922a297492c0402ed5543e5ea45d822685537375425ee75912e1882249dc9d64883c12683e7514837f415958a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045127, "uuid": "a7cf7ed1-3c11-487c-9dc4-8f73d5748643", "value": "T1C4C400C45213D16F568EC9076E067ACC7468D16FC7CBA306F0D4AA4E65BAE2AC5D8FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045127, "uuid": "41ac7c33-eb1d-4d81-93f4-09bf4a5da43b", "value": "12288:Lira47xoCk1ME1lh7tQixHHlOpXmIKNcqKfSTo5zpgpzcp21w2a9rvzrfjsN8ILO:TBNb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773045127, "uuid": "a620e691-b28f-4080-a98b-899971f70490", "value": 549091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773045127, "uuid": "10579165-f59b-497b-b96e-8322b7c4d9ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773045127, "uuid": "5bb6d012-216f-4afd-9c40-2cd530fcee8a", "value": "dropped.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47835b80-1b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773048056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048056, "uuid": "fad6be6f-5d3c-477f-81be-6a622620f73b", "comment": "Malware payload", "value": "6d0ccc2aa5de2b7ac8031414673ad4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048056, "uuid": "bd22b3aa-ac89-4b2d-9319-3f14ab5e915f", "comment": "Malware payload", "value": "de4146aee4fd1bf6fc685015022b9931ca6eead9d42d440df166e15d521742ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048056, "uuid": "d381fb33-3923-43a2-abef-7326a9c7fd10", "comment": "Malware payload", "value": "39b903cb6b3ac30ccdc09e0ff58caab43768db6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048056, "uuid": "e2fd7939-4812-42e9-8360-647242ff7498", "comment": "Malware payload", "value": "3284da5ca7b058ebc450b739be384266806cf09787f67edd96fd70e6ef90c0199b2c086f4efe71f80268e58ea1e5a28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048056, "uuid": "fb07e3b9-5640-4338-9eaa-9d43f544870e", "value": "T1F055D0102E82160CE66D2B78C262C47C27F0DC276597D72B2EEC2DB77ABEB82DD05455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048056, "uuid": "ef29bc86-b2f3-411f-af3a-644d1fbc9ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048056, "uuid": "340d2217-3b51-4150-b4b3-92cde9fec9b2", "value": "12288:+umbhgtS2tNnR1NMabvxniAfP2X3572uEW3NbPBkGOELpUBjicWZwXVEWG:+RWD5VbvcIP23572uR9NLywcWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048056, "uuid": "7aa56980-5e83-47b3-8bcc-94a8902af7db", "value": 1321472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048056, "uuid": "eb3478c6-b488-4c32-a9b4-cbc89358f26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048056, "uuid": "2eeaee77-725e-455c-aae4-cfd333663334", "value": "Quotation-3378856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5f396e-1bc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773064872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064872, "uuid": "a747eb60-c0f4-4b3f-8b29-e66e0c7dcf4b", "comment": "Malware payload", "value": "0679856f2a85fb302ba615390688b5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064872, "uuid": "8d445a8d-a2de-4cc4-abc0-a8685c9758c4", "comment": "Malware payload", "value": "ded9c92f674cf95aeccfa9e50ad0d48dfeb1fc7ad6e5d01999bd14abacb51176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064872, "uuid": "0fbda17c-743f-4a5f-9395-4e69493cfeb9", "comment": "Malware payload", "value": "456121a0c286da94c0837ba126eda8c58560450c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773064872, "uuid": "6452edbe-317f-4fef-8812-50bb517947b9", "comment": "Malware payload", "value": "4bd57f8655782a478de9f6f4748244312afcde6b2293a3e72e3c6133efb724141f5ff35454c0d353ee0260be2927e980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064872, "uuid": "aa6bc0b1-7f1c-465c-a541-9c96e3e0cefe", "value": "T136B43B51FBD62CDDE66382388D974376273CFDA05622E71B252472243E13AE0EF99706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064872, "uuid": "55367626-27e9-44a0-b21e-d0d61f825c7d", "value": "4739a33797faa46010db7ef60eeed53f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064872, "uuid": "e3ba5929-66b6-41ab-bf15-2631986f066e", "value": "6144:cTP11GsDQAZETAJ2bL3ToqBpCqpfKU6wmPb2PbkHrQpFeDWE:YP1MSQAZgG2LoqjCqt76JgkHUFeDWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773064872, "uuid": "e7c64eed-321c-414d-a978-9b2b9bf59611", "value": 536204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773064872, "uuid": "00172120-950c-4755-b9ae-c06f069e6eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773064872, "uuid": "23f5560a-bf60-40cb-b8fd-0c3dd256e8fe", "value": "asd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8094a92d-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054165, "uuid": "d1d2b6e5-36a3-4515-970a-19fb8bd5f283", "comment": "Malware payload", "value": "e00aa3553ef34960a475b515d019c684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054165, "uuid": "dbfb63a4-1ae8-413b-bc46-04beb75c7318", "comment": "Malware payload", "value": "df671ea2990fff43f003a67df3f686e909f5ef24f4cde8df3d94cfdb57db1ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054165, "uuid": "a4a352ef-d785-430e-8a8f-7245eb802ded", "comment": "Malware payload", "value": "8c4ad1224d38e65d80a9f20349a482c304a48a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054165, "uuid": "23498c1b-5b99-4d9a-951e-8b72ba205766", "comment": "Malware payload", "value": "44244aa056ac862e05513be8b7fd781320ea0a105350796c667aa7e8cd8ee16c68b2362f4cc93bd227031ce9dfa7db72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054165, "uuid": "f018ad95-9337-48fe-ae8d-348b15237912", "value": "T17E74C00AB36355F9C21BC07883E7DB3A9A71F42212147F6E02A4DF331E56D542F7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054165, "uuid": "df6d4278-e108-4bdb-bdd4-8d9a10fea6fa", "value": "c4924b0ff2e59738d18fd25e42111b35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054165, "uuid": "30c8945d-9c38-4485-bcee-e01049cff702", "value": "6144:1DwaW2UAh5e6E2A7tE4oLV/jdgLYaq2Y4FntdX9q6QtJn0768hzdtbbtD6bll9:1Dwa5e67gtYhgMF2Y4Fnt3xQtKRzdZxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054165, "uuid": "c9b73959-eff3-41ab-8720-952670054bb5", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054165, "uuid": "495fd753-80e0-497a-87fd-0ad279fc14db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054165, "uuid": "65b1bac5-1acb-43e7-b084-bce5d5ef11b1", "value": "libcurl (4).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b182ed-1bee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773084564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773084564, "uuid": "8da061ea-7533-4ee5-a58f-923a9fca38bf", "comment": "Malware payload", "value": "1323af1122404ee1c8efd13e82f90399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773084564, "uuid": "979fd290-4144-47c8-964d-6264bbabcc3f", "comment": "Malware payload", "value": "e01e802957c415afc713c37ba33c03de4c38119fa38332f227e73f2e10efd45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773084564, "uuid": "cbabd5e7-9860-446e-b026-83453fe9518a", "comment": "Malware payload", "value": "f5f5fd488a18d31508abe1990077cad09e5f7f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773084564, "uuid": "f891efa1-ed90-4b41-a5ae-f6e9607dae59", "comment": "Malware payload", "value": "cb6227f16f3fdd4905421cb8020ff7f693bd8ed5c2c5c298e61d68aecf3d57ed284287067883e41de5d27269a5cbbfd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773084564, "uuid": "adf27f0e-f743-4658-b80d-3cd47efb8e6a", "value": "T107B6F5AF62E48368C17E8D3AC0D78B00D8F770B90B37B6E742A117299B655D45D3E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773084564, "uuid": "02edf2c5-3d77-4a82-b4bc-5b12588fee6e", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773084564, "uuid": "ed250b4e-0427-4746-bc57-76036240dcdc", "value": "49152:w1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpkfMdPHQpt0HHsfNaFsh:w3L31PoeoY3pqHHsfNaFZiC9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773084564, "uuid": "7574a98f-898c-4102-8bf3-1ab084a62da3", "value": 10857984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773084564, "uuid": "be4f28c2-3836-4c95-9f86-60b2ae9a8aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773084564, "uuid": "c5fdfb97-717f-44ab-8b41-a6876f7553ee", "value": "SecuriteInfo.com.Variant.Cerbu.271832.13457.27104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6971164-1b8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773041827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041827, "uuid": "fe680c00-0166-4eba-ad92-b2754bf54e94", "comment": "Malware payload", "value": "b0c25dc01263354cc640d8003e3ef2bb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041827, "uuid": "9f05e406-6950-4670-8682-3cd921b7a19f", "comment": "Malware payload", "value": "e0697a81049e130aabee914f3e2b9cc11125cada4ffd6502d1b47e3b44bc6da7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041827, "uuid": "160947d8-3e76-49d5-aed4-ba6dfa886f1c", "comment": "Malware payload", "value": "6af530e01dfe95086aeb9fb9662d3c8b88eb78e3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041827, "uuid": "451e0a53-bd98-42d9-85db-d18aab120693", "comment": "Malware payload", "value": "70a9eccfe3b338a9a36345457de01ce8069b536bfb2ff75b832235b0248b52b697161981c99b942978185cdf5cdc4fb2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041827, "uuid": "836d6f7c-e6ed-462b-9806-9597a3462c88", "value": "T199C38C180C9F4CA0C3D6BC5EA61714CBDB76940B190BED55337CEABC6F4A42A90EE5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041827, "uuid": "46ba41b1-8f5c-4cac-9439-f75258d75a78", "value": "768:YObNTnZnJhkjIcZxCQdad2MQdUGvzaET5tY7fIojQPiXqKhrf5eEMz3JEWMebdZi:9LnQo4bOET5tY7fIoM6NeNH4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041827, "uuid": "6db44c07-5d0e-4767-83df-9b4930e3c4ff", "value": 120668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041827, "uuid": "9b6ce93e-0cfe-448d-8890-a09d11e4dd2e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041827, "uuid": "8c8e676b-18da-4196-b029-2766cbf4dace", "value": "System_Gamma_Photos_239.webp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc254f8-1b7e-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1773036366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036366, "uuid": "ee8adc99-ea53-4412-b5d6-25780538aa44", "comment": "Malware payload (PythonStealer)", "value": "3899461d99200c48a7957b7d4fd32259", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036366, "uuid": "8b7e9fa0-a3e3-49a9-afe1-1364510ba290", "comment": "Malware payload (PythonStealer)", "value": "e0de127224a470cf45fcb79f0daf04aa70a1d170982bb871793e43fd45babbcc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036366, "uuid": "2381ef81-9cb3-420b-b673-b1f5d57b358c", "comment": "Malware payload (PythonStealer)", "value": "20e19aca48ff77878c719f5de5f2ad8c4ef68266", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773036366, "uuid": "93f21154-e3db-4bfb-8a8e-a4ca0d722126", "comment": "Malware payload (PythonStealer)", "value": "3a42b3af9a66d22cf337425686e977a501d9e022851af9405fdf088e4e306ba3f931da280449467ed6fef9916652d0da", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036366, "uuid": "e4f18369-b970-4762-8ace-993c2fbd8838", "value": "T14D076C42B261D0B7E956F0B48D13815BE371FC257B205397309EB22D2F33BA19E6969C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036366, "uuid": "90081f2f-a72b-42b4-bd47-19ff476dc384", "value": "d2d012cc3f89d05d72c6fe45cef75227", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036366, "uuid": "ec767ecb-8aa4-4919-b94c-c4fc64e7d4b8", "value": "98304:O1+Qd/sD0nDF35Zk3r/fFet+uihzBwIZLLqLPmsgg4KkPrD1FTq17UpJwIX4uzWn:71PrD1/edYltcoJedKJnkf8ivNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773036366, "uuid": "f79e9bd7-cb73-4ba1-8219-6d9cb65064df", "value": 17458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773036366, "uuid": "359028e3-1302-476e-a9ed-2a55c3efcfcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773036366, "uuid": "47d62ad0-dd10-44f1-be2b-f6a1d8550ca5", "value": "encrypted_\u8ba1\u5212\u4efb\u52a1_xor_20260309_024048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f2b3a9-1bf0-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773085715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085715, "uuid": "50374320-6575-423b-acc3-42df6e185ce9", "comment": "Malware payload (CoinMiner)", "value": "7af2a7eec6a54949c3684c000da21678", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085715, "uuid": "6f37d497-458b-4ef0-8075-bd7798edfde6", "comment": "Malware payload (CoinMiner)", "value": "e1f10695ba1b9f0dfa305c31eb5677f37324ae6f4c31ecbd075208bfbb80d24c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085715, "uuid": "b231d7f0-b9b8-4809-ab8e-4301eb8f5299", "comment": "Malware payload (CoinMiner)", "value": "332542c9c68ac3a6e6feac026e2b067422f68c80", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773085715, "uuid": "cb331a5f-8d46-4bd2-b55b-9e2318833fbc", "comment": "Malware payload (CoinMiner)", "value": "de96dfcaca9c229bd6f5559ada3277a1b881614f6de1e7ad5be59f2579c93da9e3bd8ded675ae5bab0dc3e2b4a495873", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085715, "uuid": "d7673422-66a4-48d6-bb15-f0766f7edd44", "value": "T1A8421907AD9A8121E7E00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085715, "uuid": "3a72d127-1b8d-498b-9fe6-70330612518d", "value": "3eaf5807ffab1e2f73dcc6c476f60324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085715, "uuid": "165b6967-b5a8-49d8-a4e4-3517e5585cd4", "value": "192:PgeTbgOhmKM84zleg7zL/RmPJxTZ3lk9nAthBsuNOk:IITwG4z0AhoZK9nABsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773085715, "uuid": "4be751d6-aca5-4bc1-a91b-0dfc01f03478", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773085715, "uuid": "c04ed138-6783-46f7-8a0d-158a23c0ad11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773085715, "uuid": "7ebda515-0e4b-44f7-be2d-a424842646e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5ded54-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037116, "uuid": "46f0a333-9b6d-47e0-85ff-bb3f7bc46e45", "comment": "Malware payload (Mirai)", "value": "80dada63e4328bb5ae46daaa3cdfaac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037116, "uuid": "e7c98a6b-2e10-42a7-844a-1b5b49937b0b", "comment": "Malware payload (Mirai)", "value": "e29e65b22c7ac0ea7f907e6bd4059946f17946cc4fbeb375054755e1e66c62a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037116, "uuid": "acfa3bee-406a-44f0-9644-2fb098a45396", "comment": "Malware payload (Mirai)", "value": "5dd2454da4674b9da31b260dda962882f9bf9717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037116, "uuid": "e68bf48d-95c0-4a1f-9651-f7cafb440fa1", "comment": "Malware payload (Mirai)", "value": "ea9e1a5714a3271ad8adb05668138d0ae649892991c61d7c8ebbe5791c9270de3e84d0b146cf1b152a98e8afdc5baa3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037116, "uuid": "a42cde31-5700-4cdf-8331-3d1e4d493b26", "value": "T12D732A47F952CF02C1C31176BB9E9A493B136BFCE3DE72129930AFA027834D70966916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037116, "uuid": "4fedddd8-3a90-4c77-a24e-3f8ef6fb65b4", "value": "1536:zwn6N6CONSYKMs3izO2mnc3mwZvPrap2yF5XYzoG:/N6COYJ2mnc2wdDaUyFpwoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037116, "uuid": "09f07b72-9cad-47ae-943e-3329aace6c0a", "value": 78404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037116, "uuid": "0852e8fb-09bf-449f-a24c-821991a27d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037116, "uuid": "492c21b6-6dd0-4b3d-bd3b-4641534178c0", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b03447-1b81-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1773037873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037873, "uuid": "b9aacca1-e3bd-4b66-a311-e4706c3945be", "comment": "Malware payload (PureHVNC)", "value": "0ee65b4c77438df8fe4f75cec1ce3e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037873, "uuid": "b4774a23-2ca0-4f8c-8506-d54f448bd29f", "comment": "Malware payload (PureHVNC)", "value": "e2b11cbdaac1a38075e9a53405ce8c62d81ecae18492a7f79fcab0485586f7b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037873, "uuid": "65bb9025-c752-4507-91d8-c226d1882703", "comment": "Malware payload (PureHVNC)", "value": "9fc45e90e57d92841496f2f1b72df9efe9f9e673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037873, "uuid": "6d889c26-d073-4bae-95b4-56439d3740de", "comment": "Malware payload (PureHVNC)", "value": "d0fe5ee04f49a30bd66e50e1db021ad0d49ebdcaf552de7b1cc08ed5468995c7f3df09bf70773bab8de7271066330a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037873, "uuid": "9cd2bee8-a72a-4982-a3b3-11f0976a2390", "value": "T17FD49E7736524E21C3A64333C1C78940D7B4A686B9A7F70E7196239724123EFDE4A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037873, "uuid": "d30f065f-200a-47de-ba5c-736a38991015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037873, "uuid": "4ab47d06-3a40-44d1-8380-a6fa73a58aae", "value": "12288:a4uaRgM32mJ35b0YpJc91O+YDWwqq40PnnJrFaIQpwgm2dew:1fPG15cWwqCRT6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037873, "uuid": "2e1f46c6-a8e1-4020-9334-7a7d28a34bc9", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037873, "uuid": "0f4a6c91-1a31-4e05-9ea2-5adc88b0c23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037873, "uuid": "00d1066c-25de-4b42-8fb1-cce51802dfa4", "value": "0ee65b4c77438df8fe4f75cec1ce3e82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244bcf14-1b5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773022228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022228, "uuid": "c43a6078-fba3-4fdc-8455-46cff6e371ae", "comment": "Malware payload (Mirai)", "value": "33b5e147808cfe488447a0d21f773c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022228, "uuid": "df59feed-4fe0-43b9-bf78-abe73f68d687", "comment": "Malware payload (Mirai)", "value": "e36505927dcdb61f95ed2b36c3d9620894f57065cd4546137bad6ecce975c3da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022228, "uuid": "71bb6abb-5274-4ece-913a-8d1a98caea54", "comment": "Malware payload (Mirai)", "value": "d79505e80f9c3fc5eb799430813aa0e26f5435c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773022228, "uuid": "daf3ad7c-4b41-4010-9b81-444fa99bec84", "comment": "Malware payload (Mirai)", "value": "ffd2a1d1e5d69e1914ae4529764f4795c1e5c80b299709eba05dc01d8498f7711a9cf583db9d8e84c5dd03e62d288d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022228, "uuid": "bc756df8-255b-47e1-b645-918cd172a250", "value": "T125243942A511BE73C0C25B79BA9FD24537736B64D3DB3302AA28AFB01F46ADD0E2D505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022228, "uuid": "c6b01223-a313-471b-9500-53560ae30634", "value": "6144:wa8zynX030aECy7G+omS6FW4jFi/I+tmW26AfZTKRuf6Uj:wa8zUXu0aTKG+U6JertmW26AfdKRuf6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773022228, "uuid": "0ad6bb0b-d56d-4ce2-969e-20e00e02ef36", "value": 221842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773022228, "uuid": "65d8f40a-827b-4d00-9daa-dc6b25aeb72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773022228, "uuid": "6afb2296-f958-4aaa-93b6-bdb3a970f76c", "value": "a-r.m-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735e391a-1bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773068746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068746, "uuid": "b277fa82-353d-4817-b416-d980fc1c8c62", "comment": "Malware payload (ACRStealer)", "value": "2d9e893f651b7739057434da6fab1580", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068746, "uuid": "9fa5d9b0-0ab0-4dc0-8b3c-9c7c72838d0c", "comment": "Malware payload (ACRStealer)", "value": "e49fbf6640e8c5e9d47731ac1ddc2b7e6711df3b22e851220ec2f6a5ce8d6ecb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068746, "uuid": "b502b454-42c4-427c-8f96-bf379184c8af", "comment": "Malware payload (ACRStealer)", "value": "71af91a314728e618dc55bc10e8964a0d0e2ef9b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773068746, "uuid": "917da5c1-ac21-4b7e-ad28-d64f39cbd23b", "comment": "Malware payload (ACRStealer)", "value": "ae22fdbcc6971cd1fb6c1de507e5d5e47a432d460d7d17aa2cda35552ac45ef0801185560691bfad8f34d076dc53e639", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068746, "uuid": "ffbe60e1-c880-4101-a1bf-d68ca8393f2d", "value": "T138668E52B2C86439E06A1A3A093BEA54983FFB712516CD5B27F44D4CCF356806A37F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068746, "uuid": "262e8824-b6f2-459b-b667-b768a32edb27", "value": "74eb199b68cce68d5e65b492bae421d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068746, "uuid": "3ce4e490-d8ff-48bd-9a91-fec25017a145", "value": "98304:QsQTR3taOufWz7aO/Swg0KzQQQQQQQQQQQs3s9:3QTWQOzQQQQQQQQQQQOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773068746, "uuid": "40b34e64-3712-4911-bce2-1ccfd3ecedfa", "value": 6787688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773068746, "uuid": "00e5e80c-0eb3-4aa0-9c8f-5ddff39dd389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773068746, "uuid": "66170b49-38f2-4341-acae-5e687612f75b", "value": "2d9e893f651b7739057434da6fab1580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab77a28-1b8a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773041754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041754, "uuid": "43b7283b-8b9c-481b-a039-dc5e44201e79", "comment": "Malware payload (GuLoader)", "value": "c9b92532ef4743581ca1cf9355d97883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041754, "uuid": "ebb69ec8-8787-412d-b7fb-14c8d243e1ce", "comment": "Malware payload (GuLoader)", "value": "e5f27e59e5190c8d4dffe73738692a2415d931584d10626f67e3a69e0feacaae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041754, "uuid": "9fe19ae1-d691-48e3-ae02-50767333fedc", "comment": "Malware payload (GuLoader)", "value": "5bb74b0b45eb9bfcab83501a57661b1eb4e3bcf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041754, "uuid": "b7cb23d9-c8c2-4add-83d0-3926ede4a9a3", "comment": "Malware payload (GuLoader)", "value": "177248f942b1512ac1f9cc04dc8a29ca8833bf74e0d4838330db0bf5d2a1b7ae81715c9a49b102c3d492564067c91a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041754, "uuid": "6cdaf7f6-d61c-4963-b2ac-a48154bedd8e", "value": "T1F3E4E022B620C321C6EA4172C496E7F98BE67D43741085BF33E1FE1B74F5663BA21A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041754, "uuid": "0b22bf13-7a5a-43db-bb65-79893cf606b5", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041754, "uuid": "25127933-f120-4967-8b91-8d6a09c225d2", "value": "12288:MfYBkQY8aAu/EbXAD+wEq/QQBMdmo1K3i:MfYigu8NpbK3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041754, "uuid": "5382be3e-ee08-4fd2-b534-3eb61bbba52f", "value": 657840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041754, "uuid": "37046a63-eaeb-46f4-bac4-d947686d6877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041754, "uuid": "81333593-605f-47fe-be15-851bed23208a", "value": "TRANSPORTE DE ART\u00cdCULOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0430e9b3-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773046225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046225, "uuid": "65201752-174f-48d5-bb0f-19b80a63484f", "comment": "Malware payload", "value": "b6afe0aa136df25d9b52595e5c452f3d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046225, "uuid": "26857205-0122-43b7-85df-55a1045915a3", "comment": "Malware payload", "value": "e64650a28efea72ff3e72909cc41a887618b6872c8af054e8fc8f2d39ff51711", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046225, "uuid": "7776e368-e6d4-4a1c-b113-20b8eb83117a", "comment": "Malware payload", "value": "d3071ca326552012aeb74091a9826a76abfb4204", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046225, "uuid": "5ee8568f-1723-453a-8d0d-4efa73596044", "comment": "Malware payload", "value": "f02286116a6854c7d0fdc0cb3ca169e84956b8defdad6a5eab81a7c49480c61aad5adb640fefeaf5b354f340cbe85dfd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046225, "uuid": "8d319d0a-a5b9-4d18-a571-df45aea9d55c", "value": "T1F8E1A57DD664B8C0832A338070F6D9E2105696139F771FE8FA6C85441BE5395FFB9248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046225, "uuid": "c2c5a4ee-8cf8-4468-8135-fc4b33fe1230", "value": "192:6QLmnGqMTUZdyagvDhEZlPsh4BEbAW2WgptOWRr8E5ktRiE5bhVtyeYWpXZaI:6smnzRephu7BKAxMo5ktUE5Ppd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046225, "uuid": "62f9f8bb-f57a-4509-b8ee-e5dada8c5853", "value": 7175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046225, "uuid": "50636f91-edf4-4580-b5db-787c2bce6d36", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046225, "uuid": "71e9d402-1ae4-43ff-9a78-c6a58da97fce", "value": "taiwan_trade_requesting_qotation_for_attached_samples_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89395e7f-1bff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "0c89335c-d023-4582-b428-80d01791a4e3", "comment": "Malware payload", "value": "8bd9f1e7a0b11a0a08c1205983412286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "1ab05aa5-c7c1-461a-94c5-119542120d7f", "comment": "Malware payload", "value": "e81c9825936156152f52ab17caae50cd5a457c58ea714880629f5dcd2637c9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "305947cf-133c-4f9b-9394-187418b57573", "comment": "Malware payload", "value": "a0b5254f15b8b427746c3fd01d7294ac9f645bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091975, "uuid": "b9774ee4-14c1-42b9-b8f4-1a04ad7f198e", "comment": "Malware payload", "value": "35309227fc5c93edc75799ac19e7de4b32d78f93315994cb6fdd042f687bed46ba241b6fda29a23a0c2574fbeb27f95c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "01b6fb9f-c84b-4c69-8201-40534cddbcc5", "value": "T11CF7333FF18B6079C4A9137A35B2D420897F2A61B4128C226BECF8DCCB251755D3F696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "ef8b759e-14b3-4e08-9abc-02313451d497", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "4e58672a-5c3c-4ce4-aebf-0bcbb385c664", "value": "1572864:wibp32FzeZjKmqyQvJOhcnU3LODgOlha16fkmFa+:QFCWm4hG4U3L3Oy1Wkmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091975, "uuid": "e192d1cf-1e83-4e68-97b6-26c75b6116ca", "value": 71695368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091975, "uuid": "88237372-b02b-49d1-92e7-33fca280556e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091975, "uuid": "397e8493-7b6c-4df3-b7b8-16aa662187fc", "value": "Certificado_2026_283823342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d889d42-1bff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773091848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091848, "uuid": "7dae5408-b40e-493d-9799-8bf6aba5896b", "comment": "Malware payload", "value": "7d057f2eaf33919fb939639a69b06c8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091848, "uuid": "12c1e80d-c12a-4eda-b9d2-4f3d9a9841de", "comment": "Malware payload", "value": "e867b6eab9ca3475cbed6f14d3eaab2ce742b22e7390c62c1185024aca62e11f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091848, "uuid": "2b615fcf-534d-48f4-8273-e99fde8aff5d", "comment": "Malware payload", "value": "03d32540990cf5b67cec2987705344c7ed30c845", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773091848, "uuid": "ddaad86d-e498-41a7-8533-16020bd9ff23", "comment": "Malware payload", "value": "da0e0c7435e3b1ea087067afb5f44f8484e5582259f2199bc1f25eb5ab60c9d0357f76b2e219e16e8ac9a0348789f1c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091848, "uuid": "1a2f37dd-c01b-4e69-9316-ab35245139ca", "value": "T1EBC3DC4A54EF10C683173D699B2B6E42D911E78F0E4EC8A1F22CCFC08F569B64AF45E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091848, "uuid": "fdd7164c-5fcc-4539-830f-15b317b564c5", "value": "1536:WwUCYnVTrATbfs0uv/V6AcAzZmqpK+HJfn1jBhvTIP:WVf4YluP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773091848, "uuid": "1d3ed434-3ce9-4b1b-8fba-e02caa795a4a", "value": 124578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773091848, "uuid": "6bafe09b-cf86-4e81-a87b-e163f5c6615e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773091848, "uuid": "862bf213-9749-4298-9ceb-f8513815e9b3", "value": "Travel_X_Config_917.wav", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15a6598-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773042704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042704, "uuid": "375f70b5-dccd-42ea-957c-4711475ac3f4", "comment": "Malware payload (NetSupport)", "value": "2df0d999c3d1319fc77f541824f91628", "object_relation": "md5", "Tag": [ { "name": "109-107-168-236", "colour": "#B1E696", "exportable": true, "hide_tag": false }, { "name": "akusa-icu", "colour": "#1493A7", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042704, "uuid": "f6fd28c4-c078-4e5f-a577-9cd6b16eea6f", "comment": "Malware payload (NetSupport)", "value": "e98c661466926a3e90cda557077e7b166ea5a64d324d09c0700c4d10d2f60662", "object_relation": "sha256", "Tag": [ { "name": "109-107-168-236", "colour": "#B1E696", "exportable": true, "hide_tag": false }, { "name": "akusa-icu", "colour": "#1493A7", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042704, "uuid": "99bf42f4-c5cd-4ec4-82de-fdfdcc4229e9", "comment": "Malware payload (NetSupport)", "value": "56904238c874eeff6d8d815c0f15b39add8aff2e", "object_relation": "sha1", "Tag": [ { "name": "109-107-168-236", "colour": "#B1E696", "exportable": true, "hide_tag": false }, { "name": "akusa-icu", "colour": "#1493A7", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042704, "uuid": "625c716d-8496-46ae-b0e5-1dc810b0d8f6", "comment": "Malware payload (NetSupport)", "value": "20b9c33a9da4ccead08eb54d5fc81319402568ee88966024aba296ea618e738714b65049b7b32483042fceeee3fd4473", "object_relation": "sha3-384", "Tag": [ { "name": "109-107-168-236", "colour": "#B1E696", "exportable": true, "hide_tag": false }, { "name": "akusa-icu", "colour": "#1493A7", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042704, "uuid": "5354a45e-faa4-495e-b276-404e3dcd4839", "value": "T1EAA2D116769D7562FFB5AAB5284286004FB3B84F63EB6491E7C0E8E5BC712780BC3453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042704, "uuid": "5c7f5e8f-be9f-4969-9a83-8a410e8a373d", "value": "384:b2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSf36u:b2+x6TLKQXK1myQCSr2VS4jTXaRnP/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042704, "uuid": "5adce6ce-2815-422b-a325-075be47f8f88", "value": 22195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042704, "uuid": "d664e998-c910-41e1-8438-9480bf44923e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042704, "uuid": "4d0e8861-09a3-4073-9bfd-756ec533817f", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a48163-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070760, "uuid": "1686904c-0649-4c9d-87ec-7459fe7a50bf", "comment": "Malware payload", "value": "c583c57ce655ee861646436f754018eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070760, "uuid": "6707d02f-a96c-4995-9ce8-ee969eb3a5ea", "comment": "Malware payload", "value": "ea2166269cbce65c0d993ea0e2225f549c4fe35b0d5f4631520d51459abdba71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070760, "uuid": "4a5d9425-2c3d-4432-8a6b-9f6954962f64", "comment": "Malware payload", "value": "d46d8162a811aec4a642b116b3c3f5701d062784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070760, "uuid": "4cd265ef-6b4d-4d71-826a-5e06e83133b7", "comment": "Malware payload", "value": "d603b5e4fc8a1bfd93bbcdf9f90c02bde9e8e3ecf89e2750475ff2ea2944a400c1b468b253a1c309b606c3ee4a36cae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070760, "uuid": "f1e0ef73-fc0b-40b9-bf3d-2c07666cc9c9", "value": "T1C0472302BDA51CB9C0ACC33594779A563B71BC444F25A3D73A90B3A92F7BBD05A3A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070760, "uuid": "9fea1bf4-99e8-4c81-921e-7918ade07df8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070760, "uuid": "68e6e6f9-4e8a-4b68-b7ac-4fe67fe70202", "value": "49152:xlr2eeznE2bJYBj6pYkLuEIY/3Rg+LW8CNii+rVwehn3pn/52VMPE7K7RW0I2j3W:xQnE3lEaiY4HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070760, "uuid": "2934d415-ddd6-4994-95a8-b46631b76f53", "value": 25728512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070760, "uuid": "8f538ae2-860c-4bf0-8991-bc2d9eaa5aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070760, "uuid": "b191b2fb-a2e0-4ae0-a69e-e587449fd657", "value": "xea2166269cbce65c0d993ea0e2225f549c4fe35b0d5f4631520d51459abdba71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a246d5-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1773038692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038692, "uuid": "0c4eedd3-5f65-4d9a-8a80-8b534e3fc9c5", "comment": "Malware payload (Metasploit)", "value": "bae160067ef98b6f2a8723535065e5b0", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038692, "uuid": "5ad31b2b-76c8-47a4-91b5-ffbc6c471829", "comment": "Malware payload (Metasploit)", "value": "ec49c764b10260e93d0117cb98d78af71562fd10d109cafe5e310ecd1d5261c6", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038692, "uuid": "8d8f560e-ad53-4302-8ec2-e64a4014355d", "comment": "Malware payload (Metasploit)", "value": "41a72aea91cf4f663401ee9ada9b2ab6af898669", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038692, "uuid": "99b378a9-f948-4e39-9f59-1cae23ed4a32", "comment": "Malware payload (Metasploit)", "value": "40b6f4aad1486af4034d23f0d8f3adefa315475e338a225089f0873ac647a9a803ef9bda390f760b560cc4af7cfe4e83", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038692, "uuid": "d06cfadd-948f-4153-b298-f5462a4cc36e", "value": "T18E81C8383AAF6A444CC30067BDB3A4D9AE101BA6D4F66800F4E5C095FDEB621D736794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038692, "uuid": "770fd558-6a09-4445-a0f0-02ae95031512", "value": "96:w5g9d+FvvOmLmDMslf84W0lE0lLZ80lR00lX3:nEvOfDMsOGXhVx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038692, "uuid": "b10f38ad-1e6e-4575-b9ef-7f7a40bbd3b8", "value": 3873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038692, "uuid": "4bbd7334-c510-4349-a2fe-72a261c026e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038692, "uuid": "00ead20e-1770-4569-af36-10964a7448ba", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc752d5a-1ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773054292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054292, "uuid": "cb8495e2-c111-4a18-9561-00b8dd7ed319", "comment": "Malware payload", "value": "cf8ecefab401a42de48550559b47c59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054292, "uuid": "a5ea4492-99d9-44d7-a873-3c43de51fe41", "comment": "Malware payload", "value": "ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054292, "uuid": "f351e92d-b7c8-4a2c-853a-332b8d351c73", "comment": "Malware payload", "value": "effc8dd633002511914320804b18e432650d05d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773054292, "uuid": "5dfb0af7-abd3-402d-b182-9ba9ce8fde6b", "comment": "Malware payload", "value": "aed260bb22f13033986406cbe0415140597bf1bbb96277da6bb1c354404dbf47b8f82323b69a282cea11f3fd1591b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "New-BoryptGrab-Stealer", "colour": "#51AD02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054292, "uuid": "1cb59476-4e86-4757-821f-7ee3b501e62c", "value": "T1CE05BF92FAC280F3DA56143051776B374EBEB9024535CDCBE3C41A9E8A316516F3F2A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054292, "uuid": "a42aa515-9c4c-4de4-8a73-58bc78821a8e", "value": "0b6a92d2faa7ee0242e30870841414ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054292, "uuid": "4ab38568-00ea-4668-812f-41561c9ac4d6", "value": "12288:rQ2CGD4Jv82Or9AnkcIbo6eSkEgAJY6C+VJ0iov31yWm6vRwK5XgbjmhtdX:820v82Oykce6NEg0Y1+VJ0JNPm6pDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773054292, "uuid": "11b8430a-9b56-47ac-9c62-b6b668939e29", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773054292, "uuid": "e17b1ae0-49ec-47ff-9703-063bcc93918c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773054292, "uuid": "531d00fd-b83c-42b5-b7c2-3fb796ed2193", "value": "ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402c57a7-1b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773048903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048903, "uuid": "0fc1b8ab-7fdc-474b-a8a1-5ad975d0e066", "comment": "Malware payload (Formbook)", "value": "70bade2736037c109c7ead9a760ca870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048903, "uuid": "de3dcd9e-12e6-43a9-8e33-832512a585e1", "comment": "Malware payload (Formbook)", "value": "efd00cb99be98e761546c2c362cd5d01502fb036dbeb64679fb7d41e8d1da1dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048903, "uuid": "82a03bc0-1187-492f-9ce4-8bed2710c848", "comment": "Malware payload (Formbook)", "value": "e355af70854c7c5a512ba8601f240d03c13c87af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048903, "uuid": "d7789145-723e-4eda-b8af-a54956ecee7a", "comment": "Malware payload (Formbook)", "value": "1aab818860ff1bc1de5312829bf38b7a2587f7c13939c81200ab8053cdd3e944a670cb865b8e8c785d1fbf4034074d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048903, "uuid": "50a1fc74-d7f1-49ae-9c99-b61630903dfe", "value": "T1D735121C615DC407C9AA573659B0F3B417BD1EDEA911C3224FEC6CBBBE32B925809386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048903, "uuid": "eaafca5d-69ee-436e-a558-38f5e591625f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048903, "uuid": "c4b730b7-782b-40f0-adbf-e9b87842c2ba", "value": "24576:/FqIgmJI5aOn6QAErbjjaIxm5xTjb8UR96IsH5fIYiEgqrg37ca:QUFEfHaIuXb8y9EZfInI47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048903, "uuid": "2a2cf063-336d-43bb-9866-852494fbe578", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048903, "uuid": "36b7fb66-b2ae-4bc1-9c2b-08dc265430c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048903, "uuid": "2d334cad-a354-4baa-a9b9-51665a3aacac", "value": "Sales Contract 03092026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e33bfa-1b6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773028211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773028211, "uuid": "55e6efd1-d279-431d-856b-3ae8b3cbc84e", "comment": "Malware payload", "value": "2850447afb40e96317e3bf5eb75183d5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773028211, "uuid": "30c45cb9-1df4-49a9-8f69-83f84288af71", "comment": "Malware payload", "value": "f1302793a9617443049578b2de26c76fcc78d7ec62d726090a4d488b01f3be06", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773028211, "uuid": "672a05ee-b642-40e4-9dd9-5ab9c45a489e", "comment": "Malware payload", "value": "2229dc6138a1fbcb9db223d1404cb16956172196", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773028211, "uuid": "c55cb4f6-4e13-463d-be23-1cbd75d8f376", "comment": "Malware payload", "value": "ab9c8925aad892bbc3c4faec0878508b73e544326785876ef1f902df0ca83844b760c4844348bdf8567b1923236f9112", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773028211, "uuid": "880c7a7b-8495-42d5-8fd6-cb817198abda", "value": "T1A255331ADE1FF306AE191FBA6B1D480B19199B2D93145C5EA15B031FFE83E070D869E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773028211, "uuid": "5461b6d6-fd46-40b3-ade6-384ec0cdc395", "value": "24576:18l9KsaJuZhZi41FxC/JIfi47YtPVG+E68kmeNCyJEcqs+U1vd4NYX:18lsZJuZhc+Ar47Yt0zly4yJhvYYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773028211, "uuid": "32ad5361-27fb-4b8a-829b-c01ea4667647", "value": 1305502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773028211, "uuid": "b3a088f1-57f1-400c-9db3-814c498d7efe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773028211, "uuid": "4d9e388c-d258-47cf-8796-7d7a6afa9bc8", "value": "PO-050326.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47244b3f-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070819, "uuid": "0a89a0b7-79ba-4b6c-b758-8b3c5b6f4c46", "comment": "Malware payload", "value": "c67d30dac7f1598b1be33bbeba353095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070819, "uuid": "fe7e46b2-e847-4c3f-8f16-02f87d4b45fd", "comment": "Malware payload", "value": "f3cceec4b6e85f9d051fd36d0edae7b5608382cb16fdf0867765499772ef66e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070819, "uuid": "32ed4a7a-f1be-4a8a-a8a5-ca8ca8040a28", "comment": "Malware payload", "value": "1c0ce0cc789ed3923785d36466e09fb961340d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070819, "uuid": "28e99f15-f4bc-4d97-9fa7-882f03fafe53", "comment": "Malware payload", "value": "96fbf5cc72a5a0a11c2a1e4ae4e2f8751f6a2cc18d6cca9dc2d7a07954be534c5ee1d8636d10e5326be4f07414533ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070819, "uuid": "9b25576a-f9c3-487e-80e6-9bb60b9fc180", "value": "T176A64957E8A555E8C0ADD63085779623BBB13C484B3123D72B60F7282F76BE0AE79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070819, "uuid": "72eb9d88-aa4d-4f2a-a352-a05cb97385d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070819, "uuid": "2d8f8788-6856-4ea7-87f3-6e147adb5740", "value": "49152:48kLksk1Xzu8jVQcV3BJ9GFZiPCxR5swmOrEMvaVPYdPpDaQh1DB3EcKHD2vb7Q+:4NgvYlsiEMy5Rq76iZ4D6T0zd/tpzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070819, "uuid": "b2150b00-b913-421a-a3ee-a200a200f973", "value": 10023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070819, "uuid": "c51e01c7-1e8b-436e-8069-785c4d8b8d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070819, "uuid": "4fa266ee-a9a2-46b8-8ea1-301d97ae3207", "value": "agent-windows-amd641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62dcd77-1b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773037102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037102, "uuid": "4bd25279-ccb3-438c-b652-f64b7c59a741", "comment": "Malware payload (Mirai)", "value": "4a75e8dd27444315b59214964a844ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037102, "uuid": "a88bdfa7-2174-411a-b729-10f63c9dbbd4", "comment": "Malware payload (Mirai)", "value": "f541bbb76be62aaf18263645c9cf39722431972c750fba33bd702029d92f8971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037102, "uuid": "5e662a05-a571-44eb-998b-dd9ed2e4ac2a", "comment": "Malware payload (Mirai)", "value": "a5661594642783b8c4927f355b9895d907c62ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773037102, "uuid": "de3ebe90-78e9-444b-84a2-7f13f6aa4062", "comment": "Malware payload (Mirai)", "value": "836986f0f0ac5563a986710dc680ed3550af26d8ba53aa06fe3f0ce80e6589bd153a48eeca587a28983242579fb1c879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037102, "uuid": "bc6faf05-39d8-4c0b-a52d-ab935a32c6d7", "value": "T1A843E746F603CAF3D45305F101ABAE7A8E31FEEA5822D396E3747DA5D9630C16503BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037102, "uuid": "8f8917c7-2b03-4190-b123-b2558cadcd17", "value": "1536:UUGqZFB05e481/UdeLyyVzx9OkWkmIs2:UUNZFW5e4Q/UdeLBVy5VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773037102, "uuid": "6a83474e-4c8c-483b-a003-072a279d528e", "value": 57456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773037102, "uuid": "781caca1-25dd-46db-a819-afbc3871e14f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773037102, "uuid": "d19c1ed2-3260-42b8-b761-d1ecce5dc2de", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf604e6-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773042749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042749, "uuid": "091ff436-bcc4-4b46-af0d-d7b41eefbca1", "comment": "Malware payload (GuLoader)", "value": "b5c564d988cc73b70b1abaa04dd858f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042749, "uuid": "c4d493c2-8c77-4bbc-b51a-2eea53695150", "comment": "Malware payload (GuLoader)", "value": "f715d6b481d6fe16d630b2318d73961ee4a1ee2050aa2d71d3037a14f7e44ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042749, "uuid": "fadc58b7-27cd-475a-88f7-dcd37db7a4b6", "comment": "Malware payload (GuLoader)", "value": "36a36b7df333233bfff08f5d14ad734f65270c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042749, "uuid": "3671dcbd-b0dc-471a-9885-673f5d9b8d99", "comment": "Malware payload (GuLoader)", "value": "48c33ec8967aa004f0964815e0e80606a73a16551c4ae11374cb0265f7422d6b607335a6152ef422f6f8fe55d2bc332f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042749, "uuid": "388f56de-d8f1-417c-92d9-2f2015660133", "value": "T12CC412217750A912D253C5719E96BC2BD5A9BC0CFCB486633319BBBE3D35322A84F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042749, "uuid": "17db013f-d73d-4712-83ef-c2a353410b2f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042749, "uuid": "5209f67a-b922-4b90-878f-cd7e44535939", "value": "12288:ZMwNPjD7QHvdzs2T0zXY6zStqR1bS6KnMT5i3L9Y:ZMwJa1oa0zo6zStoNSRMT5iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042749, "uuid": "cb0fd2f2-36d7-47d1-a4dd-7077e4392a71", "value": 583160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042749, "uuid": "36e9d07e-3a3c-432e-a8aa-7fd6e03e0ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042749, "uuid": "3fa0bd9c-9c6b-4897-9586-fc714c0cff56", "value": "Product Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da083b7-1b96-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773046698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046698, "uuid": "450bc752-6861-4e08-8fe3-41de6b2c91bf", "comment": "Malware payload (GuLoader)", "value": "cc73762dba1a36feb21c5298a5efe552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046698, "uuid": "65d5ff0f-61cc-4d68-a0c0-46fc044d5530", "comment": "Malware payload (GuLoader)", "value": "f7854856249a9c25b14f0e8231cf46bce738901e78797f48dfa51474aaeebfae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046698, "uuid": "f5711c6f-55a6-4c74-901e-fa5690dbd150", "comment": "Malware payload (GuLoader)", "value": "39974cf7b33a4baeabfc14e5da10ef1e48ddd52d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046698, "uuid": "6a762172-b5bb-459c-a586-a128872930fc", "comment": "Malware payload (GuLoader)", "value": "6a10e50e7a6b98e0c60bd5b5bb44dda8b49e5846f6e5b6a4e0df717b7733798ebbebed06213352706e407f9cdafde9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046698, "uuid": "17647dfa-57c6-4b91-be5f-14fd723a8bfb", "value": "T17E740103B3B0D623DB780631D8279B5A4A9BEDB81F91570B13587E4A3CB2741AE0F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046698, "uuid": "814b8267-66bc-4a58-9e00-cdb88926a1b0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046698, "uuid": "4b86cbee-cae2-490e-b556-7f75f2024e14", "value": "6144:8bfopTUgXRZKgphcxV3s4a43e/kDtEfczqDbo8U4:8bKRZp88w3ecxEfczqM8U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046698, "uuid": "0e97e375-04a3-4319-951d-de5ea282dd29", "value": 360272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046698, "uuid": "bb10651d-019a-4452-b350-bb0e65e657be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046698, "uuid": "65b82dc8-a767-40b5-bf15-25317fd49c12", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b635a3ee-1b82-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773038364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038364, "uuid": "9435af70-426e-4022-be62-ee82179c1fcf", "comment": "Malware payload (AgentTesla)", "value": "35372c39cedc3a21485add3f98158f4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038364, "uuid": "c7da5dca-4a5a-4060-a0c6-a5ddb8fc02cd", "comment": "Malware payload (AgentTesla)", "value": "f7b78b180fb4a368aaf639d3e5d1bbd4d1f9eb70480a1383dde721273fb8c5ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038364, "uuid": "7393e831-efd9-4cf9-b66f-bc72b24531cb", "comment": "Malware payload (AgentTesla)", "value": "8287b48a09c519989505b2ac913cb42dd7b6a015", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038364, "uuid": "e62a9963-1f59-43fa-b0af-01cde8659de0", "comment": "Malware payload (AgentTesla)", "value": "1c4433b8a0485cadff2006eec3c69eae26986a2a5940d8c8fff97325777c49b44e402f0c04abba2ca91fe6e0da4c7c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038364, "uuid": "3a72edf5-831d-4e7c-9b7f-1d3de9848408", "value": "T138162A84F184C746B913ADF1F760B0E15A8666E77D81B403F02F66B1FBA71F1E921262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038364, "uuid": "1f8e9e3d-7505-4ac2-837e-fe8abf9cbc4e", "value": "98304:Iwfn8BhGY5/v0AgV+dpJnCCCXD6y7TOWPCg+vyJSPf3qv/KEL1+34gYyp6S7Wr2y:Iwf8BQYCAgVEnCCCXOmdhSPvlv4ip6Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038364, "uuid": "e61d1a61-401e-40be-9f68-d6ffb314377e", "value": 4163225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038364, "uuid": "9a91673d-ef7e-45f1-a352-c5268387dd94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038364, "uuid": "c4f6368f-5303-4e77-b029-73db20a096ad", "value": "Outstanding Payment 4536209.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0685139-1c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773098591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098591, "uuid": "8f69ab81-1627-4b56-b211-789d1d5fb813", "comment": "Malware payload (Mirai)", "value": "ce01e5665234746d758aec459f5965d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098591, "uuid": "a1970c4c-b873-49a6-a8fd-a9c1a346eb15", "comment": "Malware payload (Mirai)", "value": "f833828e664e8584e467e03060f05ed481665063b90c5e35191bfb836abe6077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098591, "uuid": "7d87d8de-d907-4171-a7c7-bfa41b53edc1", "comment": "Malware payload (Mirai)", "value": "bbc6206ff1c0fd72328a473102001705aaeb440c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773098591, "uuid": "c4a61ca9-a3ca-44f1-adae-43668e039756", "comment": "Malware payload (Mirai)", "value": "d92f3c33dc20823ca2be72acfb7127a4b1e38b6599a6db5e5b66f25f975a5794fa3045a3c2432f095994425e439ac323", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098591, "uuid": "a879567f-6190-4cef-980f-aa8dcd75d782", "value": "T188B339C0AA47D4F5DD1642302277F73B9A32F17A1139DA93E3A89F327C52A41D90A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098591, "uuid": "5a12faf3-ffa8-4b69-a4b6-0e92180a2a1c", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhxohHw0pJbL0:XFmzY5mXBypzjYYZ/5+JElHL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773098591, "uuid": "6e563ebb-0cd9-49ec-9566-55d176f308e8", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773098591, "uuid": "87802162-438a-4549-bf65-ea9540648ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773098591, "uuid": "f6c109d3-54eb-4aa8-b015-882c405276b4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e700b96e-1bda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773076241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076241, "uuid": "3b1d613c-7691-4a1c-9b8b-c4b25f2d64c8", "comment": "Malware payload", "value": "122dd6d8aa1f5294f404b18680540ea8", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076241, "uuid": "998e90ab-d0ad-4cd3-a279-8942cf5e52e9", "comment": "Malware payload", "value": "f866e7f46bb6074062d67ebfa6c10a41631cd1cefce38466f85e66cb230409d6", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076241, "uuid": "1760e041-3f1f-421f-a209-da7578288312", "comment": "Malware payload", "value": "6df3ffee063863b2a8f9648b087333b07514876f", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076241, "uuid": "6ecd38b4-bb4e-4cda-9a08-c4d7263017c9", "comment": "Malware payload", "value": "fc50144ee2b99b17936574ff2c823ba205f9818a235529b6e50e023e2ab88c11a6d4d63be216106a0ba2615475202bd7", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076241, "uuid": "5c45f193-8cfa-4924-8296-0580d4826f7c", "value": "T17876C38EB3845BF855849BDD8317718E2392A2776FBB100D92E0854B792EF637630D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076241, "uuid": "5d83ecc0-bf86-4161-967b-faddd2084113", "value": "24576:Q0eb91v0eb91J0eb91M0ebx150eb9130eb91T0eb91E0eb9190eb91V0eb91K0ex:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773076241, "uuid": "d92e2cbf-6990-427e-afc7-12aa51935adb", "value": 7525908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773076241, "uuid": "4896fa2a-9fb0-439b-91f1-7dac8cd5311e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076241, "uuid": "f16d64d4-ad7a-4633-b6be-c2e1a5b60f02", "value": "reader", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1d9318-1bce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773070775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070775, "uuid": "5630f06b-9ec2-467c-84a9-66c5b28a0c12", "comment": "Malware payload", "value": "b5dfba393c4ab738dcf2c56ff0c0262a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070775, "uuid": "5ec9bf99-b48a-4049-a532-70a775beb4f8", "comment": "Malware payload", "value": "f86b529da07e43b992d37512f2f45946f716cd8ed0d5b8fde9d71c30c0b1fef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070775, "uuid": "295dc5aa-da30-4d63-bc65-6f17db3a1d33", "comment": "Malware payload", "value": "55cedfa11aa5dbd8e514c349f46793527d0374f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773070775, "uuid": "287914da-f46d-48e3-b65d-e122c1d62927", "comment": "Malware payload", "value": "1f411f4283fe98b4c5550334a4c36a4e565416b56060e8c727a98e7ec90d63872d6dab17cde0a25d8ec41d4df47e49f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070775, "uuid": "57e5816a-248e-4f10-93cb-36c9882f15cb", "value": "T1FAF61216BCE548B5C0A89235C466A6663B707C540F31A3DB3E90B7A93FB7BD04E3A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070775, "uuid": "a078286b-3e57-450c-9634-dc0911ca6a9d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070775, "uuid": "86f2d41b-d37c-424a-b344-d2be9bfa7fc9", "value": "49152:Z23170On/j8xmL8jOwzucwtZKhxb0aGiu97W6vFJKA/cizpi5I+dThf8SMOU+RHj:ZA1D0q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773070775, "uuid": "aeef430d-068b-453a-ae94-710b676dc821", "value": 16271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773070775, "uuid": "731954ad-d68a-4db1-ad7d-38f7fdb0ae50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773070775, "uuid": "735ed485-eb44-4a5b-af81-2698c5eff925", "value": "xf86b529da07e43b992d37512f2f45946f716cd8ed0d5b8fde9d71c30c0b1fef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cb88b6-1be9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773082521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082521, "uuid": "b6c4b6e8-aa21-44cb-9572-085bfb245f2b", "comment": "Malware payload", "value": "1ae008ae23b679eda31c44ed9a5de2dc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082521, "uuid": "5b09f7bc-dfe2-4c0e-9e58-26142fa879ce", "comment": "Malware payload", "value": "f8c44c94b72572840193c61eb61d6bb578841ff20126ea34d26201377882742b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082521, "uuid": "b6e64d65-db78-4aa7-a809-31e8506fcdb0", "comment": "Malware payload", "value": "d2a8e54650ebbae6205f2e94d2353a975411e979", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773082521, "uuid": "b7c05337-41dc-4ced-a432-181a8a1c1dab", "comment": "Malware payload", "value": "006967038435629fc6c5a7f1b403df06c935ec516708caa789ee3a1a093df2e9b3d60c7ed771501efa01e3af5e99262b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082521, "uuid": "bddc6398-b243-4ebf-a370-fac2e2f1c170", "value": "T11314D0551BE623D73111928FC2CAD0E27B969D93BD28E36CEF2E4D8DD4DC94019381AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082521, "uuid": "d2e90dee-6a58-4b32-9f2b-c08c821f0b93", "value": "3072:vn3BxuMmfpBDTqX79RhkpODhg6rBto4eHrw6bKCmodVVSq:vn3vuMmfTWX79Rhbtu5rVVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773082521, "uuid": "5d173182-91cd-4218-a55b-5fa351619e6d", "value": 205377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773082521, "uuid": "4de36717-c4f5-49b6-8c11-5e86297effcc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773082521, "uuid": "da6cc63c-23bc-4e46-b5b3-d47d7a288b5a", "value": "memecoin_insiderv4_06.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b8a27-1b8a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773041784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041784, "uuid": "51b5d2d5-0a82-4030-8f0f-410264ca5d24", "comment": "Malware payload (SmartLoader)", "value": "e482d9f2f0cdcd1b388e10c105f66502", "object_relation": "md5", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041784, "uuid": "19fba5a2-b935-48e8-b880-2cecb9cfbbdc", "comment": "Malware payload (SmartLoader)", "value": "f9436ccb986760ca379d6cd2f00726e032a1d9c250a9bd261d40d98b914e7ef9", "object_relation": "sha256", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041784, "uuid": "33be57ed-78e3-4e52-928f-6c0c26ddbe4f", "comment": "Malware payload (SmartLoader)", "value": "5b7f6e5802ffd5895185da01d8a24fa16eba186b", "object_relation": "sha1", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773041784, "uuid": "495116d4-1e30-41d1-b724-8bf718a5e73e", "comment": "Malware payload (SmartLoader)", "value": "e959c11beeac1337d02b8b3e84af0d62c85903e43eefdd0ce4bbeb7b59bba67b6df44cf15040240a9cea5e4a1a7c67d9", "object_relation": "sha3-384", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041784, "uuid": "2a20dd26-c12e-44a7-9392-6bf7ae4e0833", "value": "T14F64E8F0108408D6D6ABC695DF6759BA51772CF0978B2A8E0E1CF4F036AF591DA8DF02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041784, "uuid": "eac97857-c34c-4ac8-94a0-c3525f0e6c4b", "value": "3072:u2pEiyVKiCDl9Qyb+vdWehYx74R30h2wZ4WszR+fA0hnAU3OQePKkAX2SlY0UMm3:TzWvwq0hdJO+oA7aNs5s+AninIkN6ZR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773041784, "uuid": "6813e22a-db4f-4ff7-9a8e-114058ca1a9d", "value": 308347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773041784, "uuid": "68e2779e-7471-4d21-9bd5-7eb85e4da125", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773041784, "uuid": "8ba35e65-b3b9-418f-aa14-64164a4e2da7", "value": "dynasm.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d464ae5-1b9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773049757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049757, "uuid": "597206c7-b839-4697-837d-2a963c7fd503", "comment": "Malware payload (Phorpiex)", "value": "9263b13f522498256bd35d8f93c201b7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049757, "uuid": "c40f382f-b8e0-41a9-a545-da1f9a508562", "comment": "Malware payload (Phorpiex)", "value": "f9b95c0480786ca6fd3c56218c4f7cab76544f44b3cc5828d612d4899cfab18e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049757, "uuid": "871ce733-63e3-4ae1-8f06-052517e7c9f6", "comment": "Malware payload (Phorpiex)", "value": "2cea41676d840de99148c4414791359207c6188a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773049757, "uuid": "4c5daf85-7f72-45da-8491-833bc331acf8", "comment": "Malware payload (Phorpiex)", "value": "1bfcd497595bd42f5d71954aabe477294e261ec9d4667356291f3ecd29bb66a9c56e84989a9f309e7a7c3a15e6d2662f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049757, "uuid": "6284e1a1-dc28-46ed-a007-94d9f0e5e295", "value": "T199422A0AA8495831F3E204B1577F82938BBD19A337D5E9CBB78067090E723D5C1796AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049757, "uuid": "3eec4541-c1c0-42f1-9ced-1564bc55c6af", "value": "27080eab3ded4a4cce0697f22f2df921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049757, "uuid": "00dcadd1-e47e-424f-a5b8-6c34235c6eb0", "value": "192:yHbeU9I0Ljl0cBBeeyJnJXJxTNerBthIjVvGmW:ibTIDcBAJlxBerBsVvpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773049757, "uuid": "21a75923-c54e-49c9-ad83-2236e0e087a6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773049757, "uuid": "26cc65d8-ccc8-442b-9593-512bc218e3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773049757, "uuid": "ec96cd25-cc86-453b-92f3-5138a589c1d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aacada-1b99-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773048053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048053, "uuid": "27e96b4a-d622-47ef-a832-905e8caf10b9", "comment": "Malware payload (AgentTesla)", "value": "053b9c565c219f66a8b300a94efe1ed1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048053, "uuid": "424c1e2f-47a7-4eb5-982e-eff4a52403e7", "comment": "Malware payload (AgentTesla)", "value": "fae02b043db75f6f4e1e5eb15b03d376b27ab77ba78e95255ca20104cd387d75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048053, "uuid": "00e88059-4257-4b98-831d-72693d3d7a78", "comment": "Malware payload (AgentTesla)", "value": "561a2b68eba1b9f34165b2e8b6828431833089e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773048053, "uuid": "7c77e681-d294-4ca9-aa45-4c0b1be699c3", "comment": "Malware payload (AgentTesla)", "value": "0f53c3cd66ce4d79c6a9d28862e0a0a21e1c514799115a01acd4cbffd7c2cf4b4a8de859ef9c3ddfab6495a3dd2cdeda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048053, "uuid": "130b8250-97f3-4d5f-a063-0f6b57ca995f", "value": "T1E435AE0273D1D062FFAB92334B5AF6115ABC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048053, "uuid": "aa7fec60-fd2f-4c8f-ab99-0900d40b3fd4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048053, "uuid": "5c945a34-750d-4c09-8c0f-9d7c158a903d", "value": "24576:N5EmXFtKaL4/oFe5T9yyXYfP1ijXda3AU1XJTteDI:NPVt/LZeJbInQRa3A2Xbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773048053, "uuid": "c08b6645-6020-4e13-9198-500019efd6cc", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773048053, "uuid": "54536eca-a294-4aa8-b5ae-edb81c6823e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773048053, "uuid": "7bd3cd0b-bc3c-4acb-b637-49b8582d82e5", "value": "Proforma Invoice 06.03.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50a30a5-1b83-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1773038899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038899, "uuid": "e607603f-ac8e-4340-be74-e4529bcd4d6e", "comment": "Malware payload (AmateraStealer)", "value": "ac9fbfc28634d5ddd04b8820e4e38a74", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038899, "uuid": "faad6423-d4de-4e84-81ea-63e787516457", "comment": "Malware payload (AmateraStealer)", "value": "fb5324920197e3888ce7eb212b7a3d1cebe029c4ea92136913535772701c0a92", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038899, "uuid": "6e473927-2f2c-43d8-81b3-94dc592d0c4c", "comment": "Malware payload (AmateraStealer)", "value": "0ae32fe25c3dc2ffb9c81e6d4ea9e0ea95a2aed6", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773038899, "uuid": "59791672-4c87-4b73-ab2f-160f06eaae95", "comment": "Malware payload (AmateraStealer)", "value": "506fc601bc3178b2d5cd2abc3724c8ee25113842df8be56c841bf59f7dd69cc43cda2f8fa000ec0bc93f03f8cdd4cc0a", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038899, "uuid": "7edae212-d54d-4888-857a-0b5a0f39cb4c", "value": "T141456C8963EB15F6E5BA8A3AC552070FEB3134142721C7EF0262996BAE33FC1553C752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038899, "uuid": "0c932d0d-6906-494b-beab-e7b92157e293", "value": "001571946bdc0cf11569ce8b060c13f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038899, "uuid": "fbf71a62-7dfc-485e-9ec2-d35699496d46", "value": "24576:KAvMj33Z/u0xbVZMiLDoQtbJrJkkB6lL6h2CEzsuMEB:TabVZM8dbth6lL6h2FsuM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773038899, "uuid": "2f0d1c7d-afbd-4640-a4a6-2fa9d0f9f479", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773038899, "uuid": "8b859789-cc3e-4d29-bc5d-92f0a01a743f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773038899, "uuid": "67cd6296-3e06-4134-a897-9ded5de8ccb6", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce6134b-1bbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773063313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063313, "uuid": "1abd8ff8-14d9-4049-a542-35d56e2076c4", "comment": "Malware payload (Formbook)", "value": "8ccd3aef33f0e89c37bb6b68b8dfd9d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063313, "uuid": "d041d683-565b-40ac-ba3c-28dd38fc4955", "comment": "Malware payload (Formbook)", "value": "fbc524a328c9c20ff38c0429ec794110a69a40ff6c6aa0e3ce3cd2404b656076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063313, "uuid": "b38b50fe-b0dd-49ba-8603-902bc55dffab", "comment": "Malware payload (Formbook)", "value": "972bf8b4c76f61e6e1235bdb2491078e32f1f23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773063313, "uuid": "aeb51e76-00d2-4670-8636-31d11e9bf49d", "comment": "Malware payload (Formbook)", "value": "c4288b9e7cb19a8be5009c5fd1d51183ad4ca82d229487f10db610354303876e57dea153b660e83fc727129d3ebe7281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063313, "uuid": "546ee0af-49f9-4f9e-9ca3-c4db84efd3c9", "value": "T11C45CF027381D062FFAB91334B5AF6115BBC7A260123A62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063313, "uuid": "a9bfb671-8f41-41b6-8378-b028ea37f3ab", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063313, "uuid": "ba291089-3611-46bb-b6a9-50d0adf331fc", "value": "24576:95EmXFtKaL4/oFe5T9yyXYfP1ijXdaLWrz6UfXd+yhMXVSicc+:9PVt/LZeJbInQRaLMFV3hMXVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773063313, "uuid": "6e3a234c-6a41-4c52-9a3d-bf00c320e8c0", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773063313, "uuid": "202a6648-d6b8-4e19-9032-d3486ed935a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773063313, "uuid": "1c8d89eb-3525-4f09-84e0-0508463d22e0", "value": "JOYFUL LTO-139 ONE-010 ETPU KA26005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ba295-1b95-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773046576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046576, "uuid": "952b7234-666f-416c-8542-c31fba5e2e02", "comment": "Malware payload (Phorpiex)", "value": "634df354fa7fea3ff3b32c12c8026b71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046576, "uuid": "a6d96ea5-763f-4462-81a4-d0de4997d178", "comment": "Malware payload (Phorpiex)", "value": "fbc9ebc86b7dad668f43b64368888652ebe610eae488e40c56b4033d3e62b6f6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046576, "uuid": "8b1ca966-c9cc-436e-8f80-c618978b0df5", "comment": "Malware payload (Phorpiex)", "value": "e362bde491a44a811f9d689f6765dc8e0060f094", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773046576, "uuid": "47815387-241c-452c-8c88-9c00d3c8e1cf", "comment": "Malware payload (Phorpiex)", "value": "17d3dbc5db9540270d53f454dd3d25b827c63788ee7650e7f79f45836dc4c8d22a22ee05469330fa7e7e20ef07b19e3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046576, "uuid": "58d44895-ee13-46a2-8cf2-c4fe68189855", "value": "T1F5124A0B6E490072D7E00AF013764A9D5E7D463327C2B2FBF777D1890FA9644A0626F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046576, "uuid": "a082a84d-cd54-4b0c-ad1d-dd442eab28dc", "value": "c2613a3495375d2517af38e579459982", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046576, "uuid": "7558449e-9664-4d94-9a2b-874f020cfdfb", "value": "96:3EBulwoz3Yz/gFcBJdFrDDykx+Z0z9dlg8kPFJxGE9mZ2FFhSC7tCEGQJ:3WxozAmcBVx+qzdkPFJxTEZmFhvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773046576, "uuid": "95f734a4-f6d8-477b-99c9-e087523ffa6a", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773046576, "uuid": "0f35a87a-429b-4250-9de5-4a4fb8c42685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773046576, "uuid": "1d8836f1-bdcc-416a-a429-19a0120ced3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab841d6f-1b64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773025461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025461, "uuid": "ad285d0e-9c09-47d5-a308-8e453c6c90e0", "comment": "Malware payload (Mirai)", "value": "81af322e7d3dd7866d9d550cd06b9357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025461, "uuid": "5afd134c-46e0-4508-b4ec-969a96122028", "comment": "Malware payload (Mirai)", "value": "fbde9bc086880d98d11fc0703b12b6553a7538ce9b06a1dbf542f7d164dcd54a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025461, "uuid": "b8546e22-dbe4-4c6b-b74d-b9e305579818", "comment": "Malware payload (Mirai)", "value": "ed57822c57f61128d089cc555fff6892d1333363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773025461, "uuid": "4099de71-73cd-4dba-85a1-e27887f1cdb2", "comment": "Malware payload (Mirai)", "value": "0b1c780b9792afd2128a7decbb0d8ddb8ef96d2646a8385c893a9e0ca3449ff282a1197a2047b3899dc2f29ae2c3fc74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025461, "uuid": "afa27a8b-c4ef-427e-a7dd-d80477a5d275", "value": "T19DC31A05AF620EFBD86FCD3742AD0B0624DC5A5223B97B7A7674C828F54958B0BD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025461, "uuid": "e565a1c0-5302-4b04-9d92-233eb4a4f57d", "value": "1536:6QV78fxaCZqfbXGKGSXRACdk53+1VsU18TVzUPtZZg5cHwR2hyHKTDyR3LpgWe75:6LfxrIfGSXj1VB18TVz+tcR2WnN8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773025461, "uuid": "1f800b0d-5926-4955-9d44-e25232b3a19d", "value": 120292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773025461, "uuid": "f822070f-3a95-45dd-b6df-fe394a8838e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773025461, "uuid": "ee622622-cb8d-4962-94ad-7c08db965b45", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76d9eb6-1b87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773040621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040621, "uuid": "c2a0252b-bfae-44e4-992d-dcb191e2b4cb", "comment": "Malware payload", "value": "95e246a6c65ea27ac65ad33f829169f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040621, "uuid": "ff748528-b0de-4566-9471-1fd8a6b5973e", "comment": "Malware payload", "value": "fbf635431d44083c4deca6c87ee164b9be7bed8f51e133ed6e406544bcd6be41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040621, "uuid": "395f0434-9ff2-4c64-8349-931b4abd08df", "comment": "Malware payload", "value": "e2630f7fea65b61eb19ecd5bbb4dd93c385f7d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773040621, "uuid": "c7e94527-9965-41c3-a700-cb476135ab2a", "comment": "Malware payload", "value": "30d8e6a0f68e41e1b489f448fbbf352843a41b397bd541f65d59d2e84dc37c57dbe4c9e667e64a1b460b144f1621f4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040621, "uuid": "ca6dfdab-2bbf-4be6-88a6-eec94977be3d", "value": "T13263CF75D3A15C83C43EC270D5C3DAE4D130AD239ED30FBA6549381B6D79583ABA92E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040621, "uuid": "ed846ae6-6403-400b-9ea2-afdba689acc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040621, "uuid": "ebb54b48-78c9-4583-9c89-e00ca1469a3d", "value": "1536:lHbr4OGVIkMEohsMslRjBbgOXh3Qt6xJf3RrUKvFySF/EfGpgQ2:Jb9GV1M9hsMslRj53Xh6KlBrUAyzfUgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773040621, "uuid": "07ab61bd-604c-4a48-b0b0-00b00a44160c", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773040621, "uuid": "3d311676-db0c-408e-a9cb-a3b4d7b7f4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773040621, "uuid": "cd9796ac-bdcc-4adf-b49c-39c844cdc7b4", "value": "stok ve fiyat_ TEKKIM LAB A.S siparis 4500683916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09054ea7-1bdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773076298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076298, "uuid": "6a8d6103-1850-4b63-ab3d-f87223e25255", "comment": "Malware payload", "value": "6386e9cb5830af75dd3ea5e596f94ce3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076298, "uuid": "eccfbed8-a4ea-4e41-b771-8329085cd4b2", "comment": "Malware payload", "value": "fca258cb72b64fcb64ecfe1b908b3ef43b6b2a842b18d6cd41a8b7f507d49849", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076298, "uuid": "65d0e3e7-e2c7-469e-9706-f0778d52db83", "comment": "Malware payload", "value": "5ba53001aacb79143185acf3d652a7f906aefa74", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773076298, "uuid": "2ad46ea6-85a9-4363-b4c9-394faaa8ae39", "comment": "Malware payload", "value": "a1a66f37608e1b24b22ad61ba68d08f3bfa6a54dc050451b2e0c0a76cf699b6f228e0014cfe94640e41224b723161ed0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076298, "uuid": "08b64782-12c0-4795-9663-336ff671ff7d", "value": "T13C25238F696AA631D1F0A3796C77B39013749EC68E4416028C13F6992DFBDB019BDF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076298, "uuid": "83b68119-0af1-4596-89cc-bbb35ce156f2", "value": "24576:xnXLbjQhBp3sWDLkA8wwDYu9agnED7zNNDO4u:xn/mBp35l8wqD+znDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773076298, "uuid": "cb01a414-d812-4979-97e0-b81be0db8621", "value": 1003608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773076298, "uuid": "b34ef169-c3a2-45e5-a8aa-77cbf0e0cc88", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773076298, "uuid": "6c450f5d-d1af-4d61-94eb-85bc28a57000", "value": "09032026_1533_GI\u1ea4Y M\u1edcI.doc.lnk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cccca1a-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042374, "uuid": "fb8c22ab-1831-4940-b136-9b876d00e914", "comment": "Malware payload", "value": "b3bc2963bb67f6bc37a53bfff404b207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042374, "uuid": "50b12c3d-9dbb-4339-b4d3-579963fb652a", "comment": "Malware payload", "value": "fcce3b123e2bc56836eab78083e800cdaed7e84e14e3997d6e7090a34761dbcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042374, "uuid": "006a4826-f801-4bdb-8af2-328ce54b807e", "comment": "Malware payload", "value": "3e21f86ad0f0907e108ed33852ecead8d43c2d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042374, "uuid": "393bf40a-efe8-4be9-b0fa-17897486b8b2", "comment": "Malware payload", "value": "5e6557d4e420794a9246d2e31b73745456ff499dd4a80fabd9969a708469d42ff6ab2989f3c0a4536ebac1501272a690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042374, "uuid": "aaadbff7-9726-4269-951a-ebe71f2fa9e1", "value": "T157541315F5A6D052D6923B331C3F5A3A4AE3DBE418A866731794AF0D3DF4B50CF1920A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042374, "uuid": "a07e758d-b5cc-40c8-8e9a-c786212c0624", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042374, "uuid": "46af2491-3eb4-49c5-bd63-a4282a31f52c", "value": "6144:C3yztAAdXDo+R2U2Ago1FfheZeWRJsdjG/iJlZXcnghmNOU/NoMf:C3rAND72UrgAFfoJsdqKJsnpU6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042374, "uuid": "716f2c4a-bfc2-4eb1-a653-19c4d36ee4a9", "value": 300440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042374, "uuid": "6754918b-eafb-4fea-b853-f6ced51530fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042374, "uuid": "7a0f5370-8057-4e86-834a-5a85557d04f7", "value": "03032026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467f6b3-1bca-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1773069311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069311, "uuid": "7e32ea7c-00a5-4610-99f8-4ede1220c450", "comment": "Malware payload (Hajime)", "value": "7d2279446caad52f8d5c771e43105fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069311, "uuid": "74172455-0aea-4308-8b3d-411e4bf17cad", "comment": "Malware payload (Hajime)", "value": "fd6dd4a25fa4451d936e388e9240e48b381fe08018d8f31f1024ae54679827e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069311, "uuid": "f284a4cb-eba8-4919-8d0d-107754c84890", "comment": "Malware payload (Hajime)", "value": "5e3674d3c66c2c14a6004316da5124a0c5cb8b2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773069311, "uuid": "fb8113a1-ad61-4394-a0e6-8021abfccc20", "comment": "Malware payload (Hajime)", "value": "441831f07a58787370ffc57ab372756e31b10d0161f5d9e54ccd1224abad03e6a01a4d75e7d98aedba7fe7a9af7a3e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069311, "uuid": "eb5f321e-dd3d-4fa6-a531-63dbad298bbb", "value": "T1C862E1462EAC3B0BB4A185F1FB3D6E65B2055DDE773B9807D595642250B3137F400C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069311, "uuid": "962c4567-deff-458d-9319-b5bf0ddaa1ac", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSD4:YTYIDfYG6ZmewZ59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773069311, "uuid": "51af1dba-ad9a-4184-abf5-bb20f055a5fb", "value": 14828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773069311, "uuid": "207adee8-39dc-42ab-b4c7-d2314c1e408e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773069311, "uuid": "3bce7e98-c9de-41b9-abbb-22a18b1250b6", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b954918e-1b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773042664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042664, "uuid": "08125053-5078-4b50-a9b6-4ef2c7501957", "comment": "Malware payload", "value": "ab43767705591a10872d60597d66f40a", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042664, "uuid": "381c725d-fca1-4e66-b75a-2eff439cb5cb", "comment": "Malware payload", "value": "fde0c0bd91b7b4d4a1a15e4aa86830153de9845ef90a5cf499af4838fae9a3c1", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042664, "uuid": "6db5924d-c7b7-4b08-b538-530d6f8c8930", "comment": "Malware payload", "value": "abd4d8a68b4f035f0a9265f022f17ab4beafb89a", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773042664, "uuid": "97db1e65-698f-4600-8a2a-c282330386bb", "comment": "Malware payload", "value": "e65447ac2f3c906dea2940f7f5c0c939b6979c4412a57fc43e47777f1aa798d4ad133a226ba5781d72e1d9567d31c5a9", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042664, "uuid": "3e92a8fb-a630-40c5-bedd-0aa4199a1e9e", "value": "T16E13E1C83FC3B0A68B225077992B715A932F5C48774C4C4AC7A754D8B97C709F27AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042664, "uuid": "7075e09c-7c85-4879-ac0c-baffd9a8bc64", "value": "768:V/97XMk5sZOZl5FZNPVKKnnCM+h5DKZ20sNMg+s3AxGIXTTkwKqKW:V/9TMk5swZVZnKzLZJMg+swxGIXTTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773042664, "uuid": "fb8dfcf5-1825-45a1-90af-47f12b204610", "value": 42248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773042664, "uuid": "3cca7af5-82f7-43ce-9b3b-4e6df1f88b14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773042664, "uuid": "bbd70eeb-624a-4aa7-a021-971aa0de09fa", "value": "Inv-4091-CBM-4091-CUSTOM-Packing List.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }